This Privacy Policy explains how Triple Nine Capital LLC ("AnkushAI", "we") collects, uses, shares and protects personal information when you use the AnkushAI website, apps, API, MCP server and related services (the "Service"), including features we add later. It is written to meet the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the EU and UK General Data Protection Regulation ("GDPR"), and other U.S. state privacy laws.
The short version: we collect what we need to run your account and the features you use. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not run advertising trackers. AI features send the content you submit to third-party AI providers to generate a response. You can access, export, correct or delete your data.
Triple Nine Capital LLC is the controller (or "business") responsible for your personal information. Contact us at support@ankushai.org.
| Category | Examples | Source |
|---|---|---|
| Account and identity | Email address, name, sign-in method (email code, Google, or a passkey on your device), account ID, plan, waitlist position and invite code, preferences, timezone | You; your sign-in provider |
| Trading journal and portfolio | Trades you log (symbol, side, size, prices, dates, P&L), notes, tags, screenshots, emotions or ratings you record, portfolio holdings you enter, watchlists, risk settings | You |
| Uploads | Chart screenshots for Chart Vision, images or files you attach | You |
| AI interactions | Prompts, questions, coach conversations, symbols you analyze, AI outputs, ratings and feedback | You; generated by the Service |
| Voice (preview features only) | Audio you record and its transcript, only if you use a voice feature. Audio is sent for transcription and is not kept by us after that | You |
| Learning progress | Lessons completed, quiz answers, placement results, trainer runs and scores | You; the Service |
| Payments (when you subscribe) | Subscription status, plan, billing country, transaction history. Card details are entered on Stripe's checkout and held by Stripe, not by us | Stripe |
| Brokerage data (only if you connect) | Read-only: the broker accounts you choose to share and their positions, balances and transactions. You sign in on the broker's own page; we never see your broker password. Access tokens are held by our sync service, not in the app | Your broker (currently Robinhood), with your approval |
| Portfolio sharing (Family) | Who you share your portfolio with or follow, what you chose to share, invite and acceptance times, and a log of when someone you share with viewed it | You; people you link with |
| Beta feedback (beta testers only) | The invite code you joined with and its group name; feedback you send (type, text and an optional screenshot you choose to attach); the page you were on, app version, device type, browser and screen size, and time; which app pages you open and when, so we can see which features get used. Used only to fix problems and improve the app; screenshots are stored privately and only the AnkushAI team can see them | You; automatically |
| API and agent usage | API keys (stored hashed), request logs, endpoints called, rate-limit counters, MCP client identifiers | You; the Service |
| Alerts and notifications | Alert rules you create, push subscription endpoints and keys (if you allow notifications), email and notification preferences | You; your device |
| Referrals | Your referral code, who referred you, and the referral cookie described in Section 14 | You; the link you arrived from |
| Device and usage | IP address, approximate location derived from IP, browser and device type, operating system, pages and features used, timestamps, crash and error logs, app version. We also record how the app is used (pages viewed, time on page, scroll depth, and where on the page you click or tap) to improve the product; we never record what you type into fields, and this data stays in our own systems | Automatically |
| Communications | Support emails and messages, survey responses | You |
We do not ask for Social Security numbers, government IDs, bank account numbers or brokerage passwords. Please do not put that kind of information in journal notes, prompts or uploads.
| Purpose | GDPR legal basis |
|---|---|
| Create and secure your account, authenticate you, provide the features you request (analysis, journal, coach, Chart Vision, portfolio, learning, API) | Contract |
| Process payments, subscriptions, trials, refunds and referral rewards | Contract; legal obligation |
| Generate AI responses by sending your request and the relevant context to AI providers | Contract |
| Send service messages, receipts, security alerts, and alerts or push notifications you turn on | Contract; legitimate interests |
| Send product updates and marketing emails (you can opt out anytime) | Consent or legitimate interests, as local law requires |
| Maintain, debug, secure and prevent fraud and abuse, including enforcing rate limits and our Acceptable Use Policy | Legitimate interests; legal obligation |
| Measure and improve the Service and calibrate our engine, using aggregated or de-identified data where possible | Legitimate interests |
| Comply with law, respond to legal requests, enforce our terms and protect rights | Legal obligation; legitimate interests |
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. AI analysis of markets is informational and is not a decision about you.
When you use an AI feature, we send the content needed for that request (for example your question, the ticker, our engine's computed data, the journal entries you ask the coach about, or an uploaded screenshot) to an AI model provider listed in Section 7. We route requests among several providers for reliability, so the provider used for a given request can vary.
We do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined in the CCPA, and have not done so in the past 12 months. We do not use third-party advertising cookies or pixels.
We send product updates, offers and promotions by email only if you opt in (an unchecked box on sign-up/sign-in, an in-app prompt, or Settings). Saying no never limits your account. To prove consent we record: your choice, the exact wording version, the date and time, where you gave it (sign-up, sign-in, prompt or settings), and the IP address and browser user agent. Every marketing email has a one-click unsubscribe link, and you can switch it off anytime in Settings → Email preferences. Account emails (sign-in codes, receipts, security and legal notices) are not marketing and still arrive. We keep the consent record for as long as your account exists and for up to 4 years after you opt out, as evidence of what you agreed to. We do not sell or share your email for others' marketing.
If you sign up through another member's invite link (/r/CODE or a waitlist ?ref= link), we store their referral code with your account (first click wins; a small first-party cookie, `ak_ref`, holds the code for up to 60 days before sign-up). If that member is an affiliate, they can see, for commission tracking only: your first name and last initial, a masked email (for example p*@gmail.com; work-domain emails are masked too), the date you joined, and your subscription status, including whether a payment was refunded or disputed (chargeback)**, together with the commission amounts that result. They never see your full email, payment details, what you use in the app, or the reason for any dispute. The invite screen tells you this before you sign up. Affiliates must keep this information confidential and may not contact you about refunds or disputes. Our legal basis is our legitimate interest in running and paying a referral program accurately (GDPR Art. 6(1)(f)). To object, contact us and we will stop showing your name to the affiliate (they will see a masked email only).
Affiliates who get paid connect a payout account with Stripe (Stripe Connect Express). Stripe collects their identity and bank details directly and issues tax forms where required; we never receive bank account numbers.
| CCPA category | Collected? | Disclosed for a business purpose to |
|---|---|---|
| Identifiers (email, account ID, IP address) | Yes | Hosting, database/auth, email, payment providers |
| Customer records (name, billing info) | Yes | Payment providers |
| Commercial information (subscriptions, purchases) | Yes | Payment providers |
| Internet or network activity (usage, logs) | Yes | Hosting provider |
| Approximate geolocation (from IP) | Yes | Hosting provider |
| Audio (voice features, preview only) | Only if used | AI providers for transcription |
| Financial information (journal, portfolio; brokerage data if connected) | Yes | Database provider; AI providers when you ask for analysis |
| Inferences (trading style, skill level, preferences) | Yes | Database provider; AI providers |
| Sensitive personal information (account log-in; financial account data if you connect a broker) | Yes | Used only to provide the Service, as permitted by CCPA regulations |
We use sensitive personal information only for purposes permitted by CCPA regulations (to provide the Service you request, security and fraud prevention), so the "right to limit" does not apply.
We use the following categories of providers. The current, detailed list (with locations) is on our Sub-processors page, which we update when providers change.
A current list of named sub-processors is available on request at support@ankushai.org.
| Data | Kept for |
|---|---|
| Account, journal, portfolio, watchlists, alerts, learning progress, usage events | While your account is open. When you delete your account (Settings → Delete account), we delete it from our live database right away |
| Chart Vision screenshots | Sent to an AI provider to produce the result; we do not keep the image unless you attach it to a journal entry or to beta feedback |
| AI conversations and outputs | While your account is open, or until you delete them |
| Server and security logs | Kept by our hosting provider for a limited time under its own settings, and by us only as long as needed to debug or investigate abuse |
| Payment and tax records | Held by Stripe, and by us as long as tax and accounting law requires |
| Brokerage tokens (if connected) | Until you disconnect or delete your account |
| Backups | Our database provider keeps rolling backups for a limited period; deleted data drops out of them on that schedule |
| De-identified or aggregated data | May be kept indefinitely; it no longer identifies you |
Depending on where you live, you may have the right to:
You can delete your account and its data yourself at any time in Settings → Delete account. For any other request, email support@ankushai.org from your account email. We will verify your identity (usually by confirming control of your account email) and respond within 45 days (CCPA) or one month (GDPR), extendable where the law allows. You may use an authorized agent with your signed permission. We honor Global Privacy Control signals as an opt-out of sale and sharing.
Marketing emails include an unsubscribe link. Push notifications can be turned off in Settings or your device settings.
We are based in the United States and our providers may process data in the U.S. and other countries. When personal data is transferred from the EU, UK or Switzerland, we rely on the transfer safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where a provider is certified.
We use encryption in transit (TLS), access controls, hashed API keys, least-privilege access to production data, and provider-level encryption at rest. No system is perfectly secure; we will notify you and authorities of a breach as the law requires. Report security issues to support@ankushai.org.
The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact support@ankushai.org and we will delete it.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws have rights similar to those in Section 9. To appeal a decision on your request, reply to our response with "Appeal" in the subject line. Nevada residents: we do not sell covered information. "Shine the Light" (California): we do not share personal information with third parties for their direct marketing.
We use only essential storage and no advertising trackers. See our Cookie Policy. Because we do not track you across sites, we treat browser Do Not Track and Global Privacy Control signals as already satisfied. When your browser sends either signal, we also turn off our in-app usage and click recording for you.
If you arrive through an invite link, a first-party cookie (`ak_ref`) remembers the referral code for up to 60 days so the person who invited you gets credit. It is not shared with anyone and is not used for advertising.
We will update this Policy when what we collect or who processes it changes, and post the new date at the top. If changes are material, we will notify you in advance by email or in the app, and ask for consent where the law requires.
Triple Nine Capital LLC. Privacy requests and support: support@ankushai.org.