Privacy Policy

Stnding is operated by an individual trading as Stnding, established in the United Kingdom, which is the controller of the personal data described here. Write to team@stnding.com about anything on this page. Our full legal name and postal address are available on request from that address and will be published here.

Your brokerage and SnapTrade are separate controllers of the data they hold about you. Their own policies govern that, and disconnecting from Stnding does not end your relationship with them.

Account. Your email address, a password held only as a hash by our authentication provider, and the username you choose.

Profile. Anything you add to your profile: display name, biography, picture, and the links you put in it.

Brokerage data. If you connect an account through SnapTrade we receive, on a read-only basis, your positions, balances, cash movements and executed orders, and the name and type of the account. We do not receive your brokerage credentials, and we cannot trade or move money. We keep an identifier and a secret issued by SnapTrade so the connection can keep working.

What you write. Notes you attach to days of your record, and the settings you choose, including the publication delay and Discreet Mode.

Who you follow. The accounts you follow and who follows you.

Technical. Ordinary server and platform logs: IP address, browser, timestamp and the page requested, used to run the site, keep it up and investigate abuse.

We do not use analytics, advertising or cross-site tracking, and there are no third-party trackers on the site. We do not collect special category data, and you should not put any into your profile or notes.

Under UK and EU data protection law we need a legal basis for each use. Ours are:

• Performance of a contract for creating and running your account, connecting a brokerage, building and publishing your record, and sending you service email such as a confirmation or password reset.
• Your consent for publishing your record at all. Publishing is your choice, you set the delay, and you can make the record private or delete it at any time. Withdrawing consent does not affect what was published before.
• Our legitimate interests in keeping the service secure and available, preventing abuse, debugging faults and defending legal claims. We have considered these against your interests and use the least data that will do.
• Legal obligation where we have to keep or disclose something by law.

We do not sell personal data, and we do not share it for advertising or with data brokers. We have never done either.

If your profile is public, then your username, display name, biography, picture, follower counts, your notes, and your performance record are readable by anyone with the address, and can be indexed by search engines.

Two settings limit that, and both are applied on our servers before a page is sent, so a visitor is not given data they may not see. The publication delay withholds everything newer than the delay you set. Discreet Mode publishes the shape of the record without the amounts: percentages, weights and prices remain, while the account balance, position sizes and transfer amounts are removed.

Once something is published, other people may copy, screenshot or archive it. We cannot retrieve those copies. Publish accordingly, and do not put anything in your username, display name or biography that you would not want indexed.

• Supabase for the database, authentication and service email. Your account and record data is stored in Ireland. Their policy.
• SnapTrade (Passiv Inc.) in Canada, for the brokerage connection. Their policy.
• Vercel for hosting the website and its logs. Their policy.

Each acts on our instructions under a contract that requires it. We will update this list when it changes.

Account and record data is stored in Ireland. Some processing happens outside the UK and the EEA: Canada, for the brokerage connection, which the UK and the EU recognise as providing adequate protection for commercial organisations, and the United States, for hosting and logs, where we rely on the standard contractual clauses and the UK addendum to them.

• Account, profile, record and brokerage data: while your account exists, and deleted when you delete it.
• Server and platform logs: a short operational period, generally not more than 30 days, unless a specific security investigation needs longer.
• Backups: until they expire on their ordinary cycle, generally within 30 days, after which deleted data is gone from them too.
• Correspondence with us: as long as needed to deal with the matter and any dispute arising from it.

You can delete your account in Settings by confirming your username. That deletes the account itself and, with it, your profile, published record, daily values, positions, executed orders, cash movements, notes, follows, metrics and brokerage connection. Nothing of it is kept in a disabled state. We also ask SnapTrade to delete the user it holds for you, which ends its access to your brokerage.

What survives deletion: entries in security logs for as long as section 7 allows, backups until they expire, anything we are required to keep by law, and copies of your published pages already made by other people, which are not ours to remove.

If UK or EU data protection law applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. Write to team@stnding.com from the address on your account. We answer within one month, and we do not charge.

You can complain to a data protection authority. In the United Kingdom that is the Information Commissioner’s Office at ico.org.uk. In the EEA it is the authority where you live. We would rather you told us first, but you do not have to.

If you are in California or another US state with similar law, you may request access to and deletion of your data on the same footing. We do not sell or share personal data as those laws define it, so there is nothing to opt out of.

We use only what the service needs to work, so there is no cookie banner to click through:

• A first-party session cookie that keeps you signed in, set by our authentication provider.
• Local storage in your browser for your light or dark preference and, for the demonstration records, a session that never leaves the device.

There are no advertising cookies and no cross-site tracking. Blocking third-party cookies does not affect signing in. Blocking first-party cookies does.

What we do to protect this data, and what a brokerage connection can and cannot do, is on the Security page. No service can promise perfect security. If a breach affects your rights we will tell you and the regulator as the law requires.

Stnding is for people aged 18 or over and we do not knowingly collect data from children. If you believe someone under 18 has an account, tell us at team@stnding.com and we will delete it.

When this policy changes the date at the top changes with it. If a change materially affects you we will say so on this page and, where we can, tell account holders.