Privacy Policy

1. Information we collect

We collect information you provide directly when you create an account, subscribe, or contact us:

• account details (email, display name) — collected via Google sign-in or a password account you create;
• subscription and billing identifiers held by our payment processor (Stripe) — we never see your card number;
• content you create on the platform (notes, reading lists, bookmarks, follows);
• messages you send through support or editorial contact channels;
• commercial API key metadata when you mint an fnp_ key — the key's name, the permissions you selected, the four-character prefix shown in the console, the plan it inherits, and the timestamps for creation, last use, and revocation. The plaintext key itself is never stored; we keep only an Argon2 hash so we can verify incoming requests.

2. Automatically collected information

When you access the editorial Service we may automatically collect:

• browser type, language, and operating system;
• IP address, location at a country/region level, and approximate session timing;
• pages viewed and articles opened (for editorial analytics and personalisation);
• device identifiers necessary for security (rate limiting and abuse detection).

We hash IP addresses for rate-limit and abuse logs rather than storing them in plaintext. Editorial analytics is anonymous unless you've opted into personalised analytics in your account settings.

When you call the commercial API (api.finnotes.com) we additionally record, for each request: timestamp, request-id, the path template (not the full query string), HTTP status, latency, the points charged, and which fnp_ key was used. These records are the source of truth for billing, rate-limit enforcement, fraud detection, and per-request audit. We do not log request or response bodies. If you have enabled the optional per-request audit log in your developer console settings, the same record is also surfaced back to you via /v1/logs for your own visibility.

3. How we use information

We use the information we collect to:

• provide and maintain the Service (account state, subscription state, content delivery);
• improve editorial coverage (which articles are read, what data series readers consult);
• detect, investigate, and prevent fraudulent or abusive activity;
• respond to your requests, support tickets, and corrections.

4. Sharing and disclosure

We do not sell your personal information. We share information only:

• with service providers who help us run the platform under contract (Stripe for billing, Google for sign-in, our hosting provider for infrastructure);
• when required by law (court order, regulator request, civil legal process);
• to protect our rights, property, or safety, or that of our users, when we believe disclosure is necessary;
• with your explicit consent, when you share content publicly through the Service.

5. Data security

We implement technical and organisational measures appropriate to the sensitivity of the data — TLS in transit, encrypted backups, principle-of-least-privilege access control to production systems, and audit logging of administrative actions. No method of transmission over the internet is 100% secure; we do not and cannot guarantee absolute security.

6. Your rights and choices

Depending on your location, you may have rights to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your account and associated data;
• opt out of non-essential analytics (toggle in the account console);
• export your data in a portable format.

Most of these rights are exercisable directly from your account console. For anything you can't do from there, email [email protected].

7. Retention

Account data is retained while your account is active. After you delete your account, primary identifiers are anonymised within 30 days, and historical editorial records (notes, reading lists, bookmarks) are dissociated from your identity. Aggregate, anonymised analytics may be retained indefinitely. Backups cycle out within 30 days.

Commercial-API per-request audit records (described in section 2) are retained for 90 days for billing reconciliation, dispute resolution, and abuse detection, then aggregated into account-level usage counters and deleted from the per-request store. API key hashes are retained while the key is active and are deleted on revocation. The Argon2 hash cannot be reversed back to the plaintext fnp_ string.

8. Cookies and analytics

FinNotes uses a small number of cookies.

• finnotes_auth — your session token. Essential for signed-in features and cannot be declined while you remain logged in.
• finnotes_consent — remembers your choice for the analytics banner so we don't ask again for 180 days.
• Google Analytics 4 — measures aggregated traffic patterns (pageviews, reading depth, referring sources). Loads in Consent Mode: we don't drop any GA cookies (_ga, _ga_*) until you click Accept on the banner. If you Decline, GA stays disabled. We never enable advertising or personalization storage. IP addresses are anonymised before they reach Google. You can change your choice anytime by clearing the finnotes_consent cookie — the banner will re-appear.

We do not run third-party advertising cookies, retargeting pixels, or any cross-site tracking beyond what is described above. Any new cookie category will be announced here before it is rolled out.

9. International transfers

Our infrastructure may process data in the United States and other jurisdictions. Where required, we use safeguards consistent with applicable law (e.g. standard contractual clauses).

10. Children

The Service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes are noted on this page and via an account email where appropriate, with the "Last updated" date refreshed.

12. API key handling and the Agent Skill

API keys. When you mint a commercial-API key from platform.finnotes.com/api-keys, the full fnp_ string is shown to you exactly once, in a one-time secret modal. We never store the plaintext key — only its Argon2 hash (so we can verify incoming requests) and the metadata listed in section 1. If you lose the plaintext, we cannot recover it; mint a new key and revoke the old one.

Agent Skill. Our optional helper package (finnotes-news-and-data-skill, MIT licensed) is installed on your own machine when you choose to use it with Claude Code, Codex, OpenClaw, or another agent runtime. When you import the downloaded Agent JSON handoff file, the skill writes your fnp_ key to ~/.finnotes/credentials.env (mode 0600 — readable only by your user) and the non-secret metadata (key prefix, plan, permissions) to ~/.finnotes/profile.json. Both files live entirely on your machine. FinNotes has no access to either file or to the agent runtime that reads them; we only see the API requests the skill makes, which arrive at our servers like any other authenticated API call. The skill's exception-handling guide instructs the agent runtime to treat credentials.env as off-limits to its file-reading tools, so the key is not surfaced into the AI model's context.

If you uninstall the skill by deleting the ~/.finnotes/ directory, you remove the local credential immediately. Server-side, the key remains active until you explicitly revoke it from the developer console.

13. Contact

Questions or concerns about this Privacy Policy can be sent to our Privacy Team at [email protected].