Privacy policy

SECspotter (“we”, “us”) runs secspotter.com, a site that shows institutional holdings and other filings made with the U.S. Securities and Exchange Commission (SEC). This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

Information we collect

When you visit the site

Our hosting and security provider receives the information every web request carries: your IP address, your browser and device type, the page you asked for and the time. The provider uses it to deliver pages and to block attacks and automated abuse, and it may set a short-lived security cookie for that purpose.

We count visits with the provider’s web analytics, which reports totals such as page views. It doesn’t use cookies and doesn’t identify you.

Your browser keeps a few things on your device, such as whether you chose the dark theme and, once you sign in, the token that keeps you signed in. Your settings stay on your device.

When you create an account

• Email address. We use it to sign you in, to confirm your address, to send a link to reset your password when you ask for one, to send the alert emails you ask for, and for messages about your account.
• How you sign in. If you create an account with an email address and password, your password goes straight from your browser to our sign-in provider which stores only a salted, one-way hash of it. We never see or store your password, and no one can read it back from the hash. If you sign in with Google instead, Google shares your name, email address and profile picture with our sign-in provider; we use only your email address.
• Account records: a user ID, the date you created your account, when you last signed in, and whether you have confirmed your email address.
• Favorites and alert settings: the funds and companies you save, and which alerts you turn on.
• Alert email records: when we sent each alert or test email, so we stay within our sending limits.

When you contact us

If you email us, we keep your message and our reply so we can help you.

How we use your information

We use personal information to:

• run the site and your account, including sign-in, favorites and alert emails;
• send messages about your account or changes to this policy;
• keep the site secure and prevent fraud and abuse;
• understand overall use of the site, from totals that don’t identify you;
• meet legal obligations.

We don’t sell your personal information or share it for cross-context behavioral advertising. We don’t show ads, and we don’t use your information to make automated decisions that have legal or similarly significant effects on you.

Who we share it with

We share personal information only with the service providers that help us run SECspotter, under contracts that limit how they may use it:

• Hosts the site and our account database, protects them from attacks, measures traffic and sends our alert emails.
• Handles sign-in, keeps the hash of your password, and sends the emails that confirm your address and reset your password.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a sale or merger of SECspotter. In a sale or merger, this policy would continue to apply to your information.

How long we keep it

We keep personal information for as long as we need it for the purposes in this policy, such as running your account, or as long as the law requires. We don’t commit to keeping or deleting it within any set period.

Your choices and rights

• Download your data or delete your account from your account page at any time.
• Stop alert emails with the unsubscribe link in every alert, or on your alert settings page.
• Ask us to access, correct or delete your personal information, or to object to or limit how we use it, by emailing privacy@secspotter.com. We answer within a reasonable time, and we may first need to confirm that the request comes from you.

California residents have the right to know what personal information we collect and how we use it, to access, correct and delete it, and to opt out of its sale or sharing. We don’t sell or share personal information, so there is nothing to opt out of. We won’t treat you differently for using any of these rights.

In the European Economic Area, the United Kingdom and Switzerland, we use your information to provide the service you signed up for (to perform our contract with you), for our legitimate interests in keeping the site secure and understanding how it is used, and to meet legal obligations. You also have the right to receive your data in a portable format, and to complain to your local data protection authority.

Where your information is processed

SECspotter is run from the United States, and our providers process information in the United States and other countries. Where the law requires it, they protect international transfers with approved safeguards such as the European Commission’s Standard Contractual Clauses.

Security

We use encrypted connections everywhere, never see or store your password (our sign-in provider keeps only a one-way hash of it), keep account data in access-controlled systems, and limit who can reach it. No system is perfectly secure, so we can’t guarantee that your information will never be accessed without permission.

Children

SECspotter isn’t for children under 16, and we don’t knowingly collect personal information from them. If you think a child has given us personal information, email us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version on this page with its effective date. If a change is significant, such as adding paid plans, we will also email account holders before it takes effect.

Contact

Email privacy@secspotter.com with any question about this policy or your information.