# PRIVACY POLICY

> **DRAFT — FREE ALPHA (PAPER TRADING ONLY) — NOT YET REVIEWED BY A LICENSED ATTORNEY.**
> For Sam Trading Intelligence (G4). Published for the free alpha only as a versioned draft. Not legal advice.
> Markers: `[[PLACEHOLDER: ...]]` = text that must be filled in (entity, contacts, dates, numbers); `[[VERIFY: ...]]` = fact to check; `[[ATTORNEY-REVIEW: ...]]` = question for counsel.

**Document:** `privacy` · **Draft version:** PP-0.1-alpha-draft.1 · **Effective:** October 13, 2026 · **Last updated:** October 17, 2026
**Source:** `/workspace/legal/04-Privacy-Policy.md` (sha256 `dc2dee5ba16e`, prior label PP-0.1 draft)
**Content-hash version:** the server version for `/legal/privacy` (header `X-Document-Version`) is `v-` + the first 12 hex characters of the SHA-256 of this exact file. It is recorded in `publish-drafts/README.md` and `SHA256SUMS`, not here, because a file cannot contain its own hash. Any edit, even one character, makes a new version and every user is asked to re-accept.

---

## 1. Who we are
This Privacy Policy explains how [[PLACEHOLDER: ENTITY — currently: **Sam Murphy**, an individual doing business as **Sam Trading Intelligence ("G4")**. Replace with the LLC's exact legal name and state of formation (e.g. "Sam Trading Intelligence LLC, a <STATE> limited liability company") after LEG-001/LEG-004; counsel to confirm whether a DBA/assumed-name filing is needed meanwhile]], and any successor business entity (**"G4," "we," "us"**), collects, uses, shares, and protects personal information when you use our websites, web dashboard, iOS, Android, desktop, and smartwatch apps, the Butler voice assistant, and related services (the **"Service"**). Contact: **samistoby@gmail.com** · **[[PLACEHOLDER: MAILING ADDRESS — business mailing address (registered agent / virtual mailbox; not a home address if avoidable)]]**.

**Short version:** We collect what we need to run G4. **We do not sell your personal information. We do not use health data for advertising. Face ID and fingerprints never leave your device. Card numbers go to Stripe, not us.** You can access, export, and delete your data.

### What other users can and cannot see
Your account is private by default. **Other users can never see** your email address or name, your password (stored only as a salted hash), your paper-trading balances, your individual paper positions and trades as your account data, your journal notes, your watchlists, your settings, or your usage and behavior data. There is no user directory, and every account record is served only to its signed-in owner.
Only three kinds of information are shared by design:
- **Strategy and outcome data** — the platform's aggregate strategy scoreboard (strategy combinations, verdicts, and scored outcomes). This is the platform's own research evidence, not your personal trades.
- **Games** — XP, streaks, achievements, duels, tournaments, and guild standings, shown under display names.
- **Community content you knowingly publish** — for example, posts you choose to make in community spaces.

## 2. Information we collect

### 2.1 Information you give us
| Category | Examples | Why |
|---|---|---|
| **Account** | Name or display name, email, password (stored only as a salted hash), sign-in-with-Apple/Google identifiers, time zone, country/state | Create and secure your account; communicate with you |
| **Profile and preferences** | Experience level, markets of interest, accessibility settings (e.g., dyslexia mode, font size, voice preferences), notification settings | Personalize the interface and accessibility (not to give personalized investment advice) |
| **Trading-tool data** | Watchlists, scanner settings, saved strategies, backtests, **paper-trading** positions and history, journal notes | Provide the features you use |
| **Butler and support** | Text and voice prompts to Butler, support chats with our AI-assisted support assistant and staff, feedback, survey responses | Answer requests, provide support, fix bugs |
| **Waitlist and community** | Email, referral codes, Discord username (if you link it) | Waitlist, referrals, community access |
| **Billing** | Plan, purchase history, billing country/ZIP, last 4 digits and brand of card, Stripe customer ID | Manage subscriptions and taxes. **Full card details are collected and stored by Stripe, not G4** |

### 2.2 Smartwatch and health data (optional)
If you choose to enable smartwatch features, and only after you grant permission in your device's settings (Apple Health/HealthKit, Google Health Connect, or your watch's equivalent), we may access: **[[PLACEHOLDER: heart rate, heart-rate variability, activity/step data, sleep data — CONFIRM exact list against the app build. Build check 2026-10-12: Apple Watch reads resting heart rate + sleep analysis (HealthKit, opt-in, on-device); Wear OS reads live heart-rate sensor (opt-in, on-device)]]** (**"Health Data"**). We use Health Data **only** to provide the watch features you turn on, for example **[[PLACEHOLDER: optional "stress check" or "take a break" reminders before trading, focus/wellness insights]]**.
- Health Data is **optional**. G4 works without it. You can revoke access at any time in your device's health permissions.
- **We do not sell Health Data, share it for advertising or marketing, use it for credit, insurance, or employment decisions, or use it to train AI models.** We do not disclose Health Data to third parties except service providers that process it on our behalf under contract, or as required by law.
- **[[PLACEHOLDER: Preferred design: process Health Data on your device and do not upload it. If any Health Data is sent to our servers, state that here, describe encryption, and set a short retention period such as 30 days.]]**
- We comply with Apple's HealthKit and Google's Health Connect requirements, including that Health Data is not used for advertising or data mining and is not stored in iCloud by us **[[VERIFY: current platform rules]]**.
- Watch features are **for general wellness only. They are not a medical device** and do not diagnose or treat any condition.
- Where state law treats Health Data as "consumer health data" or "sensitive data" (for example, Washington's My Health My Data Act, Nevada SB 370, and state comprehensive privacy laws), we obtain your **separate, express consent** before collecting it and honor your rights to withdraw consent and delete it. **[[ATTORNEY-REVIEW: confirm whether a standalone Consumer Health Data Privacy Policy link is required on the homepage.]]**

### 2.3 Biometric unlock (Face ID, Touch ID, Android biometrics)
You may use Face ID, Touch ID, or Android biometric unlock to open the app. **This is handled entirely by your device's operating system. Your face geometry, fingerprints, and other biometric templates stay on your device in its secure hardware. G4 never receives, collects, stores, or has access to them.** We receive only a yes/no result telling us whether authentication succeeded. G4 does not use facial recognition or voiceprint identification. **[[PLACEHOLDER: If Butler ever identifies users by voice, stop: biometric laws such as Illinois BIPA and Texas CUBI would require notice, written consent, and a retention schedule first.]]**

### 2.4 Information collected automatically
- **Device and log data:** IP address, device type, operating system, app version, browser, language, crash logs, and timestamps.
- **Usage and analytics data:** screens viewed, features used, clicks, session length, and events (for example, "ran a scan"), collected with **[[PLACEHOLDER: PostHog / Mixpanel / Plausible / GA4 — list actual tools]]**. Where possible we pseudonymize analytics and do not use session replay on screens showing financial or health information.
- **Cookies and similar technologies:** essential cookies (sign-in, security, fraud prevention), preference cookies, and analytics cookies. See Section 8 for choices.
- **Approximate location:** derived from IP address (city/state level) for security, tax, and eligibility. We do not collect precise GPS location.
- **Legal acceptance records:** when you accept our Terms, Risk Disclosure, or this Policy, we record the date and time, IP address, device/browser information, and the document version, as proof of agreement.

### 2.5 Information from third parties
Sign-in providers (Apple, Google), Stripe (payment status), Apple and Google app stores (subscription status), Discord (if you link it), and market-data providers (non-personal market data).

## 3. How we use information
We use personal information to: provide, maintain, and secure the Service; create and manage accounts; process payments and subscriptions; deliver alerts and notifications; power Butler and AI features; provide customer support (including through our AI-assisted support assistant, with escalation to a human); personalize the interface and accessibility settings; analyze usage and fix bugs; prevent fraud, abuse, and security incidents; send service messages and, with your permission where required, marketing (you can unsubscribe at any time); keep records of legal acceptance; comply with law and enforce our Terms. **We do not use your data to give you personalized investment advice.**

**AI processing.** Butler prompts and support chats may be processed by third-party AI providers **[[PLACEHOLDER: NAME PROVIDERS — build check 2026-10-12: no user-prompt LLM provider call found in g4-api-src; confirm before publish]]** under contracts that restrict them from using your data to train their models **[[VERIFY: each provider's API terms]]**. Do not share sensitive personal information (such as account numbers or Social Security numbers) with Butler or support chat. We do not use Health Data to train AI models. **[[PLACEHOLDER: State whether G4 uses de-identified usage data to improve its own models.]]**

## 4. How we share information
**We do not sell personal information, and we do not "share" it for cross-context behavioral advertising** as those terms are defined in California law. We share information only with:
- **Service providers** who process data for us under contract: hosting/cloud **[[PLACEHOLDER: e.g., Vercel, AWS, Supabase]]**, database, analytics **[[PLACEHOLDER: list]]**, email **[[PLACEHOLDER: e.g., Resend/Loops]]**, AI providers **[[PLACEHOLDER: list]]**, customer support tools **[[PLACEHOLDER: list]]**, crash reporting **[[PLACEHOLDER: e.g., Sentry]]**.
- **Stripe** for payment processing. Stripe processes your payment information as an independent controller under its own privacy policy (stripe.com/privacy) and may use it for fraud prevention.
- **Apple and Google** for app store purchases, sign-in, and push notifications.
- **Legal and safety:** when required by law, subpoena, or court order, or to protect the rights, safety, and property of G4, users, or others, including to investigate fraud or market manipulation.
- **Business transfers:** to an entity formed to operate G4 (such as an LLC), or in a merger, acquisition, financing, or sale of assets, subject to this Policy.
- **With your consent** or at your direction (for example, connecting a third-party service).

## 5. Data retention
We keep information only as long as needed for the purposes above: account data for the life of your account and up to **[[PLACEHOLDER: 30]] days** after deletion (backups up to **[[PLACEHOLDER: 90]] days**); paper-trading and strategy data until you delete it or your account; billing and tax records as required by law (generally up to **[[PLACEHOLDER: 7]] years**); legal acceptance logs for the life of your account plus **[[PLACEHOLDER: 7]] years** (to prove agreement in disputes); support chats **[[PLACEHOLDER: 24]] months**; analytics **[[PLACEHOLDER: 25]] months**; Health Data **[[PLACEHOLDER: on-device only / no more than 30 days on our servers — build check 2026-10-12: both watch apps process on-device only]]**.

## 6. Security
We use reasonable administrative, technical, and physical safeguards, including encryption in transit (TLS) and at rest, access controls, least-privilege access, multi-factor authentication for administrative accounts, and logging. No method of transmission or storage is 100% secure. If a breach affects your personal information, we will notify you and regulators as required by law **(including, where applicable, the FTC Health Breach Notification Rule)**.

## 7. Your rights and choices
Depending on where you live (for example, California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with privacy laws), you may have the right to: **know/access** the personal information we hold; **correct** it; **delete** it; **port** it (get a copy in a usable format); **opt out** of sale, sharing, targeted advertising, and certain profiling (we do not do these); **limit** use of sensitive personal information; **withdraw consent** (for example, for Health Data); and **appeal** our decision on your request. We will not discriminate against you for exercising your rights.
- **How to make a request:** in-app at **Settings → Privacy → Download my data / Delete account**, or email **samistoby@gmail.com**. We will verify your identity and respond within the time required by law (generally 45 days). You may use an authorized agent where the law allows.
- **Account deletion:** you can delete your account inside the app and on the web, as required by the Apple App Store and Google Play. **[[PLACEHOLDER: Provide the web deletion URL required by Google Play.]]**
- **Marketing:** unsubscribe via the link in any email or in notification settings.
- **Health and device permissions:** manage in iOS/watchOS Settings → Health, Android Health Connect, or your watch app.
- **Global Privacy Control (GPC):** we honor GPC browser signals as an opt-out request where required.

## 8. Cookies and analytics choices
You can manage non-essential cookies through our cookie banner/settings **[[PLACEHOLDER: implement]]** and your browser settings. On mobile, you can reset your advertising identifier and limit tracking in device settings. **We do not use the Service for third-party targeted advertising** and do not use Apple's App Tracking Transparency tracking **[[PLACEHOLDER: confirm; if this changes, the ATT prompt and this Policy must be updated]].**

## 9. Children
The Service is **not intended for anyone under 18**, and we do not knowingly collect personal information from children under 13 (or under 18). If you believe a minor has given us information, contact us and we will delete it.

## 10. Location of processing
G4 is based in the United States and the Service is intended for US residents. Information is processed and stored in the United States. **[[PLACEHOLDER: If you later open G4 to the EU/UK, add a GDPR/UK GDPR section covering legal bases, international transfers, and a representative, if required.]]**

## 11. Changes
We will post any changes here and update the "Last updated" date. For material changes, we will notify you by email or in-app before they take effect and, where required, ask for your consent.

## 12. Contact
Privacy questions or requests: **samistoby@gmail.com** · **[[PLACEHOLDER: MAILING ADDRESS — business mailing address (registered agent / virtual mailbox; not a home address if avoidable)]]**.

---

*DRAFT PP-0.1-alpha-draft.1 – free alpha only – not yet reviewed by a licensed attorney. Not legal advice.*