Privacy Policy

Last updated: 2 September 2026

TickerWorth is a stock-valuation tool. This policy describes what the service actually collects and what it does with it. It is written against the running code rather than from a template, so where something is not done, it says so.

What we collect

• Your account: your email address, a bcrypt hash of your password (we never store or log the password itself), the date you signed up, and — if you chose to give them — a display name and an experience level from the signup questions. Both are optional and can be left blank.
• What you build in the app: your watchlist, any portfolio holdings and option positions you enter, saved screens, your dashboard layout, your investment-profile answers, alert preferences, and any feedback you send us. Portfolio entries are figures you type in; we do not connect to your broker and we never receive your actual trading account.
• Billing: if you subscribe, the customer and subscription identifiers issued by Dodo Payments, which plan you are on, and your subscription status. Card details never reach us — they are handled entirely by Dodo Payments.
• Visitor analytics: a record of page views, described in its own section below. It sets one first-party cookie and stores no IP address.
• Advertising click identifier: if you reached us from an ad, the identifier the ad platform put in the link. It is stored on your account so we can tell the ad platform that the click led to a sign-up. Described below.

What we do not collect

• We do not store a per-person history of the tickers you look up. Company lookups are counted in aggregate, keyed by the ticker itself, to power the "trending" and "most searched" lists — those counters are not linked to any account or visitor.
• We do not store your IP address in our database. Your IP is used in memory, while the request is being served, to apply rate limits and to count the free daily valuations; those counters expire on their own and are never written to disk.
• We do not sell your personal information. We run no third-party tracking script, no advertising network and no ad targeting on the site: no other company's code runs on these pages, and nothing about your visit is sent to one from your browser.

Analytics, in detail

We count visitors ourselves rather than embedding a third-party analytics script. Nothing here is shared with anyone, and none of it is used to target advertising:

• One first-party cookie, and no fingerprint. Visits are grouped by a random 16-character identifier stored in a cookie named tw_vid, kept for up to 400 days. It is generated at random rather than derived from anything about you or your device, so it says only that the same browser came back — it cannot be computed from your IP, and clearing it makes you a genuinely new visitor rather than the same one recognised again. It lets us see, for example, that someone read three valuations over a week before signing up. Page scripts cannot read it and it is never sent to another company.
• If you block or clear that cookie, nothing breaks. Visits then fall back to an identifier computed as a salted SHA-256 of your IP address, your user-agent string and the current UTC date, truncated to 16 characters — it cannot be reversed to an IP and it changes every midnight UTC.
• What is stored per view: the page path or ticker, that identifier, a device class (mobile, tablet or desktop), and where you arrived from — the referring site's host only, never the full URL, plus any campaign tags in the link.
• What is never stored: your raw IP address, your raw user-agent string, and full referrer URLs.
• How long: page-view records are automatically deleted after 180 days.

Advertising measurement

We buy search ads. When you click one, the ad platform appends an opaque identifier to the link, which we keep in the tw_gclid cookie and store on your account if you sign up. Later, from our server, we tell that platform "this click became a sign-up".

What that does not involve: no advertising script runs on these pages, your browser never contacts an ad platform on our behalf, and we send no personal information — the platform receives back only the identifier it issued in the first place, plus the fact that it converted. The identifier is written once and never changed, so one sign-up can never be reported twice.

How we use it

To run the service and keep you signed in, to operate your subscription, to send the account email described below, to enforce free-tier limits and prevent abuse, and to understand which parts of the site people use.

Cookies

Every cookie the site sets is first-party — set by tickerworth.com, readable only by tickerworth.com, and never sent to another company. All four are HttpOnly (scripts on the page cannot read them), SameSite=Lax (not sent along with requests from other sites), and marked Secure on HTTPS.

• vm_session — your signed session token; it exists only to keep you signed in. Up to 30 days. Signing out clears it and invalidates the token itself, on every device.
• tw_vid — the random analytics identifier described above, so we can tell a returning reader from a new one. Up to 400 days.
• tw_ref — set only if you arrived through a partner's link, so that partner is credited if you later subscribe. It holds their public handle, nothing about you. 90 days.
• tw_gclid — set only if you arrived from one of our ads, holding the identifier the ad platform put in that link. 90 days.

There are no third-party cookies of any kind, and none of these is used to target advertising to you, build a profile of you, or follow you to other sites — none of them can leave this one. The last two exist so we can tell where a sign-up came from; they are not read while you browse.

Third parties we rely on

• Dodo Payments — payment processing — which is the merchant of record: it is the seller shown on your receipt and card statement, and it collects and remits any applicable sales tax or VAT. Their privacy policy governs your card data. If you subscribed through a provider we used previously, that subscription is still billed and managed there.
• Render — hosting. The application runs on Render's infrastructure.
• Neon — the managed PostgreSQL database where your account and the data above are stored.
• Resend — delivery of account email (password resets, subscription and trial notices). Your email address is shared with them so the message can be sent.
• Market data providers (Yahoo Finance, via the yfinance library) — to fetch quotes and financials. We send them the ticker being looked up; we do not send them anything about you.

Security

Passwords are hashed with bcrypt and are never stored or logged in readable form. Sessions are signed tokens held in the HttpOnly cookie described above, served over HTTPS. Changing your password, changing your email address, or signing out invalidates every session token previously issued for your account. No system is perfectly secure, but we take reasonable measures to protect your data.

Data retention and deletion

Page-view analytics are deleted automatically after 180 days. Your account and the data you have entered are kept for as long as the account exists.

There is currently no self-serve way to delete your account from within the app. To request deletion of your account and the data associated with it, email hello@tickerworth.com. Requests are handled manually, and some records may be retained where we are required to keep them for legal or accounting reasons.

Your rights

Depending on where you live (for example under the EU/UK GDPR or the California CCPA), you may have the right to access, correct, export or delete your personal data, and to object to certain processing. You can change your email address and password yourself in the account settings. For anything else, including access and deletion requests, email hello@tickerworth.com — these requests are handled by hand rather than through an automated tool.

Children

The Service is not directed to children under 13 (or the applicable age in your jurisdiction) and we do not knowingly collect their data.

Contact

Questions about privacy, or a request about your data? hello@tickerworth.com.

Terms of Service · Home