Privacy Policy
Last updated: October 30, 2026
Options Insights ("we," "us," "the platform") is a trading analytics tool. We handle real brokerage data and take your privacy seriously. This policy explains exactly what data we collect, how we protect it, and who else touches it.
1. What Data We Collect
Account Information
- Email address, username, and hashed password
- Optional: phone number (if you enable SMS notifications)
TastyTrade Data
- Trade transactions (buys, sells, expirations, assignments)
- Open and closed positions
- Account numbers and account metadata
- This data is pulled from the TastyTrade API through the read-only connection you authorize on TastyTrade's own page
Free Report
- To make a free report we aim to pull your trades from the one TastyTrade account you pick, back to the day of your 200th most recent closed trade, plus the opening trades of any position still open on that day. If you have fewer closed trades, we use the available history. If the history lookup reaches its page or time limit, we use the oldest day read, so the report may cover fewer trades.
- We email you a private link to the report. The link works for 14 days.
- About 14 days after we email the report, we delete the free report account and its trade data, and we remove our access to your TastyTrade account (see section 4). If you subscribe, this automatic deletion does not apply.
Query Data
- The text of your natural language queries to the Query Assistant
- Anonymized token counts and cost metadata (never associated with your query content in billing records)
Stored Credentials
- TastyTrade OAuth tokens (access token and refresh token), stored with field-level encryption (AES-256). We never see or store your TastyTrade password.
- Databento API key (only if you provide one), stored encrypted. This is your own Databento account relationship; we only transmit your key to the Databento API on your behalf.
Site Visit Counting
- When you open our home page or the free report page, we count the visit. Each count stores which page it was, the post tag in the link that brought you (the
utm_source,utm_medium,utm_campaignandutm_contentlink parameters, or “direct” when there is none), the page version you were shown, a random visitor number, and the time. - For this counting we set one cookie of our own,
oi_ft, for 90 days. It holds that random visitor number and the first post tag you arrived with. It is signed so our site can detect changes to it. The signature does not hide its contents from you. - We do not store your IP address, your browser’s user agent, or your email address with these counts. Known crawlers and common automated tools are not counted. We use no third-party analytics and no advertising pixels.
- If you sign up for the free report, your signup, your TastyTrade connection, the delivery of your report and any later payment are each counted once and credited to that first post tag, so we can see which posts and page versions work.
2. How We Store and Protect Data
- Hosted on Railway (cloud infrastructure) with PostgreSQL on Supabase.
- Row Level Security (RLS) is enforced at the database layer: your data is scoped to your user ID. No other user can query your data.
- API keys and credentials are encrypted at rest using field-level encryption (Fernet/AES-256). We never store secrets in plaintext.
- TLS in transit: all connections between your browser, our servers, and third-party APIs use HTTPS.
3. Third-Party Services
We use the following third-party services. Each has its own privacy policy that applies to data they process.
| Service | Purpose | What Data Passes Through |
|---|---|---|
| TastyTrade API | Read-only data pull of your trades, positions, and account info | OAuth tokens (we never see your TastyTrade password; you authorize via TastyTrade's OAuth page) |
| Stripe | Payment processing for monthly subscriptions | Payment details (we never see your raw card number) |
| OpenRouter | Routes Query Assistant prompts to AI language models | Your query text is transmitted to generate SQL and responses. We use a platform-owned account, so you do not need an API key. |
| Databento | Options price data (your own API key) | Your Databento API key is transmitted to their API on your behalf. We store your key encrypted but have no independent Databento data relationship. |
| SendGrid | Transactional email (account emails, sync notifications, free report links) | Your email address and notification content |
| Twilio | Optional SMS notifications | Your phone number (only if you provide one) |
4. Data Retention and Deletion
- Your data is retained while your account is active.
- A free report account and its trade data are deleted about 14 days after we email the report, or about 14 days after you picked the account if no report was emailed. If you subscribe, this automatic deletion does not apply.
- If you delete your account, all data is permanently deleted within 30 days, except the visit and funnel counts and the one-report-per-person record described below.
- Visit and funnel counts (see “Site Visit Counting” above) are kept after your account is deleted, including the automatic deletion of free report accounts. Each kept count holds only: the step (site visit, free report page visit, signup, connection, report delivered, payment), the post tag, the page version, the free report version, the random visitor number, the time, and, for the signup and later steps, the internal number of your account. They hold no name, email address, IP address, user agent or trade data.
- While your account exists, its random visitor number links your earlier visits to it.
- After your account is deleted, that internal number no longer belongs to any account, but if you received a free report it can still be matched to our one-report-per-person record, which keeps the same number together with one-way hashes (not the plain text) of your email address and account number so the same person cannot claim a second free report.
- We do not sell your data to third parties. Ever.
- We do not use your trade data for any purpose other than displaying it back to you and building analytics for your account.
5. Your Rights
- Right to know: You can ask what data we hold about you by emailing support@optionsinsights.ai.
- Right to delete: You can delete your account and all associated data from your account settings page. This removes everything within 30 days, except the visit and funnel counts and the one-report-per-person record described in section 4.
- Right to disconnect: You can revoke TastyTrade access at any time by removing your credentials from your account settings.
- Right to export: You can request an export of your data by emailing support@optionsinsights.ai.
Questions about your data? Contact us at support@optionsinsights.ai.