What this site stores,
and who else sees it
This is a description of what the software actually does, written from its own database schema rather than from a template. Where something is kept, it says for how long. Where a third party is involved, it says which and what reaches them.
01 The short version
There are no analytics, no tracking pixels, no advertising networks and no third-party trackers on this site. Nothing you do here is sold, shared for marketing, or used to build a profile of you anywhere else.
What is kept is what a small site needs to run: an account so you can sign in, a log of what was clicked so the owner can see whether anything is broken, and an email address if — and only if — you asked to be emailed.
Tickr Lab is run by one person. Questions, corrections and deletion requests go to the contact form if you have an account, or to the address in section 8.
02 If you only visit
Every request to the home page writes one row recording the time, your IP address, your browser's user-agent string and the page that referred you. That is how the owner knows anyone is here at all, since nothing else measures it.
These rows are deleted after 60 days. No account, no cookie and no identifier links one visit to another.
The site loads its typeface from Google Fonts, which means Google receives your IP address and user-agent when a page loads, as it would on any site using that service. This is the only third-party request a signed-out page makes.
03 If you have an account
What the account itself holds
Your email address, the name you gave at registration, your role, and when
you joined. Your password is never stored — only a scrypt hash of it
with a random per-account salt, which cannot be reversed back into the password. A count of
failed sign-in attempts is kept so an account can be locked after repeated guesses.
The activity log
Signed-in actions are recorded as facts, never content: which page was opened, that
a sort or a filter happened, that a question was asked. A chat row records
asked — it does not record the question. Rows carry your email, an IP address
and how long the action took, and are deleted after 60 days.
What you create
Your saved column layout, starred screens, and any personal portfolios you build — kept against your email for as long as the account exists, so they follow you between machines. A per-day counter limits assistant use.
Sessions
Signing in sets sp_session, a random token that expires after 30 days and can
be revoked. The guest preview sets st_guest for 24 hours and
st_gid, a random id used only to keep one guest's log entries together — it is
not linked to any person. Your browser also keeps a few display preferences locally
(which phone view, which chart range, whether a hint was dismissed); those never leave your
device.
04 If you subscribe to the mailing list
Subscribing stores your email address, the date, the page you subscribed from and the IP address that submitted the form. The last two exist to evidence that the subscription was genuinely requested.
Nothing is sent until you click a confirmation link. Every message carries a one-click unsubscribe that works for ever and needs no sign-in. Unsubscribing does not delete the row — the row becomes the record that you asked to stop, which is what stops you being added back by accident. Ask and it will be deleted outright.
A log of messages sent keeps the recipient, the subject, whether the provider accepted it and its size, for 90 days. No message bodies are stored, ever.
05 Who else sees any of it
| Service | What it is for | What reaches it |
|---|---|---|
| Vercel | Hosting | Every request, including your IP address |
| Turso | The database | Everything described above, at rest |
| Resend | Sending email | The recipient address and the message |
| Anthropic | The assistant at /chat | Your question and the screener table. Only when you ask something |
| Google Fonts | The typeface | Your IP and user-agent, on every page |
| Twelve Data | Market data | Nothing about you. Ticker symbols only |
If you sign in with Google, Google tells this site your Google account id, your email address, whether that address is verified, and your name. Nothing is sent back to Google, and no other Google data is requested or accessible.
No data is sold, rented, or shared with anyone not named above.
06 How long things are kept
| What | Kept for |
|---|---|
| Visitor rows (IP, user-agent, referrer) | 60 days |
| Activity log | 60 days |
| Record of emails sent | 90 days |
| Sign-in sessions | 30 days, or until you sign out |
| Your account and what you created | Until the account is deleted |
| A mailing-list subscription | Until you ask for it to be removed |
07 What you can ask for
You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Deleting an account removes its sessions, saved layout, personal portfolios and usage counters, and signs it out everywhere. Mailing-list removal is immediate and needs no account.
This is a small site run by one person; requests are handled by hand, and quickly.
08 Contact
Tickr Lab
44-28 Purves Street, Long Island City, NY 11101
Signed-in users can use the contact form. Anyone else can reply to any email received from this site — replies reach a real person.
09 Changes
If this page changes materially, the date at the top changes with it. It is written to match the software, so it is updated when the software is — not on a schedule.