Privacy Policy

Using the free tools

Running a backtest sends the tickers, weights, dates and starting amount you entered to our API so it can be computed. That input is not stored, not linked to you, and not shared. Your browser's IP address is used in memory for a few seconds to enforce a rate limit on the endpoint, and is not written to any database.

What we do keep is the shape of the run, so we can tell whether the tool is being used: that a backtest was run, how many holdings it had, and how many years it covered. Never the tickers, never the amount. The FIRE calculator computes entirely in your browser and sends us nothing at all — not the figures you type, not the results; we record only which control you adjusted, by name, so we know the sliders are worth keeping.

Results are encoded in the page URL so you can share or re-open them. That URL is created by your browser; we do not record which URLs are generated or shared.

Cookies

• Google Analytics cookies (named _ga and _ga_…), which hold a randomly generated id so that a second visit counts as a returning browser rather than a new person. They are first-party and readable only on this site.

There are no advertising cookies and no cross-site trackers. Blocking analytics — with a content blocker, or by refusing the cookies — leaves the site working exactly the same.

Measuring traffic

Three things count usage here, and all of them stop at counts: which pages are read, which sites and searches lead to them, roughly where and on what kind of device, and which buttons and links get used. Nothing you type into a tool is ever sent to any of them.

• Cloudflare Web Analytics — sets no cookie, stores no identifier in your browser and does not fingerprint your device, so it cannot recognise you between visits or on any other site.
• Google Analytics 4 — sets the cookies described above. Google receives the request, which includes your IP address, and derives an approximate location from it; the reports we see are aggregate. GA4 does not use third-party cookies, and the advertising and ad-personalisation features are not enabled.
• Our own counting — a record of which links and buttons get used, sent to our API and stored on our own database. It sets no cookie: events are grouped by a random id held in your tab for as long as that tab is open, which is discarded when you close it. No IP address is stored with it.

If you subscribe to the weekly

The subscribe box asks for an email address and nothing else. We send one email to confirm it, and nothing more goes to that address until the link in it is clicked. If it is never clicked, the address receives nothing else from us.

What we keep: the address, which edition you signed up for (English or Chinese), the page and the spot on it where you signed up, and when you confirmed or unsubscribed. We do not store your IP address or your browser. Links in the weekly carry a campaign tag so Google Analytics can count visits that came from it; there are no tracking pixels and no per-recipient open tracking.

Every issue has an unsubscribe link, and mail apps that show their own “Unsubscribe” button use the same one-click route. Unsubscribing takes effect immediately. We keep the address marked as unsubscribed so it is never mailed again by mistake; to have it erased entirely, write to hello@sweetvaluelab.com.

If you create an account

You never need one to read a page, run a tool or call the public API. The only thing an account does is let you issue personal API tokens, which an AI agent can use to act on your behalf.

Sign-in is handled by Neon Auth, and your password (if you set one) goes to it directly from your browser — it never passes through our API. What is kept is your email address, your name if you gave one, and, if you signed in with Google, the fact that the account is linked to that Google account. It lives in this project's own database.

For the tokens themselves we store only a hash of each one, plus the name you gave it and the day it was last used. The token itself is shown once, when it is created, and cannot be recovered afterwards — not by you and not by us. Revoking one takes effect immediately. To delete an account and everything attached to it, write to hello@sweetvaluelab.com.

Who else processes data

• Cloudflare — serves this website and its static files, and provides the cookieless traffic measurement described above.
• Google Cloud (Cloud Run) — runs the API.
• Neon — hosts the Postgres database, and through Neon Auth the sign-in flow and the account record behind it.
• Google — Google Analytics on every page, as described above.
• Resend — sends the weekly and its confirmation email. It receives the address and the email being sent to it, and nothing else about you.
• Financial Modeling Prep and SEC EDGAR — market and filing data. We send them ticker symbols and date ranges. They receive nothing about you.

Like any hosted service, these providers keep their own infrastructure logs, which can include IP addresses. That is outside our control and governed by their policies.

Our own logs

The API records the method, path, response status and duration of each request — enough to spot an outage or a broken endpoint. These logs do not contain IP addresses and are not stored in the database.

Retention and deletion

Without an account, nothing here is tied to a person and there is nothing to delete on request: the click counts carry a per-tab random id that is gone when the tab closes, and the analytics providers hold only aggregates. With an account, the things tied to you are the ones listed above — your email address and your tokens' hashes — and they are deleted when the account is. A subscription to the weekly is the one other thing tied to an address; see above for how it ends. Questions to hello@sweetvaluelab.com.

Selling data

We do not sell your data, rent it, or share it with advertisers. There are no advertisers.

Children

This site is not directed at children.

Changes

If this policy changes in a way that affects what is collected or who processes it, the date at the top of this page changes and the previous version stays in the public repository's history.

Contact

Questions about this policy, or a request about your data: hello@sweetvaluelab.com.