Privacy Policy

This Privacy Policy explains what information we collect about you, how we use it, who we share it with, and what choices you have. It applies to anyone who visits or uses the Service. By using OTC Squawk you agree to this policy and to our Terms of Service.

This policy applies to the Service as it is generally available to the public. When we add features that change what we collect or how we use it, we describe the new practice here before it takes effect, as set out in Section 18 (Changes).

3.1 Information you provide directly.

• Account credentials: email address and password (passwords are stored only as hashes by our authentication provider).
• Profile information: username, display name, bio, avatar image, banner image.
• Content: posts ("squawks"), comments, likes, follows, and any images or media you upload.
• Preferences: theme preference and notification preferences.
• Feedback: messages you submit through in-product feedback forms.

3.2 Information collected automatically.

• Device and connection data: IP address, user-agent string, browser type, operating system, and approximate location derived from IP.
• Activity data: timestamps of sign-in, page URLs you visit on the Service, and the actions you take (such as posting, liking, or following).
• Diagnostic logs: request and error logs maintained by our hosting and authentication providers for reliability and security.
• Cookies and local storage: see Section 7.

3.3 Information from third parties.

We may receive limited information about you from authentication providers when you sign in, and from market-data providers when you view information about a security. We do not buy personal information about you from data brokers.

• Operate the Service: create and authenticate your account, display your content, route notifications, run search.
• Personalize: remember your theme, notification, and other preferences.
• Moderate: detect spam, pump-and-dump activity, scams, and other prohibited conduct (see Section 5).
• Improve and develop: diagnose bugs, monitor performance, measure feature use, and design new features.
• Communicate with you: send transactional emails such as confirmations, notifications, security alerts, and changes to this policy.
• Comply with law and protect rights: respond to legal requests, prevent fraud or abuse, and enforce our Terms of Service.

We do not sell your personal information and we do not use it for cross-context behavioral advertising. We do not currently run third-party advertising on the Service.

We use an AI service from Anthropic, PBC (the Claude API) to help moderate user-submitted content. When you submit a squawk or comment, the text of that content, and any images attached to it, are transmitted to Anthropic's API so that an automated classifier can score it for spam, manipulation, scam patterns, and other policy violations.

Direct messages. Messages you send in a chat, and any photos in them, go through the same classifier. The rule there is deliberately narrow: a message is removed only for hate speech, threats, illegal content or sexual content, and only when the classifier is confident. Spam, scam talk, market talk and ordinary disagreement are not acted on in a private conversation. No person at OTC Squawk reads your messages unless somebody reports one.

• We send only the content itself, not your email or password.
• Anthropic processes the content as our service provider under its API terms and, per Anthropic's published policies, does not use API inputs to train its foundation models.
• You can review Anthropic's privacy practices at anthropic.com/legal/privacy.

Posts that score above an automated threshold may be auto-hidden pending human review. A human team member reviews any moderation decision that results in account suspension. We do not use AI for decisions that produce legal or similarly significant effects on you without an opportunity for human review and appeal. To appeal a moderation decision, contact us at the address in Section 19; we respond within a commercially reasonable time, typically 7 days.

• With other users: your username, display name, bio, avatar, banner, posts, comments, likes, and follows are visible to other users of the Service and, for public content, to anyone on the internet.
• With service providers: we share data with the third parties listed in Section 8 strictly to operate the Service.
• For feedback notifications: when you submit in-product feedback, the feedback text, your display name and handle, the page URL where you submitted, and your user-agent are forwarded to a private internal Discord channel monitored by the Metavesco team so we can respond quickly.
• For legal reasons: when required by law, court order, subpoena, or to protect the safety, rights, or property of Metavesco, our users, or others.
• In a business transfer: if Metavesco is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and provide choices to the extent required by law.

You can clear cookies and local storage at any time through your browser. Removing the authentication cookie will sign you out.

We count page views ourselves, in-house, with no third-party analytics service. To count daily visitors, your IP address and browser are combined into an anonymous identifier using a key that changes daily; the raw IP address is never stored, and yesterday's identifiers cannot be linked to today's. Nothing is stored in your browser for this.

Referral checks. If you joined through an Ambassador's referral link, then while your referral is in progress we record the pages you open on OTC Squawk and when, how long each page was on screen, whether you scrolled or tapped, your device type as your browser reports it (for example, "iPhone, Safari"), and a scrambled code made from your network address. The address itself is not stored. We keep the same scrambled network code for Ambassadors. We use this only to count the days you use OTC Squawk toward your referral and to check that referred accounts belong to separate, real people, and we delete it 90 days after your referral finishes. Ambassadors see only your progress (for example, "4 of 7 days"), never these records. A small cookie remembers which day your network code was last recorded, so it is written once a day.

Daily activity. While you are signed in, we record whether you opened OTC Squawk on a given day, how long its pages were on screen in total, and whether you scrolled. We keep one tally per day, not which pages you opened. We use it only to count how many members use OTC Squawk each day, and it is deleted with your account.

• Account and profile data: retained while your account is active.
• Content (posts, comments, likes, follows): retained while your account is active. After you delete content, copies may persist in backups and caches for up to 90 days.
• Deactivated accounts: when you deactivate your account in Settings, your profile, posts and comments are hidden from everyone right away and you are signed out. We keep the account for 30 days so you can restore it by signing back in. After 30 days it is permanently deleted: your login, profile, posts, comments, likes, follows, uploaded images and Squawk Talk recordings are erased, and your username and email can be used again. Copies may remain in backups for up to 90 days after that.
• Records kept after deletion: ambassador earnings and payout records are kept for tax and accounting purposes, moderation and audit records for safety, and any answer you gave to the optional question about why you are leaving, to improve the service. In each case the link to your account is removed. Full data export is planned; until it ships, email us at the address in Section 19.
• Direct messages: retained while the conversation exists, and removed with your account when it is deleted. A message taken down by the automated check in Section 5, or reported by someone, is hidden from everyone but kept for up to 90 days with the reason it was removed, so the report can be reviewed and an appeal answered. After 90 days it is erased.
• Server access logs (IP, user-agent, request metadata): retained by Vercel and Supabase for up to 90 days for security and reliability.
• Authentication logs: retained by Supabase per its standard retention windows.
• Feedback messages: retained for up to 24 months for product improvement, then deleted. You may request earlier deletion by contacting us at the address in Section 19.

• Access the information you provided through your account and your in-app activity.
• Correct your profile information at any time by editing it in-app.
• Delete your account from /settings/danger. It is deactivated at once and permanently deleted after 30 days; see Section 9.
• Export a JSON archive of your account by emailing the contact in Section 19. Self-service export is planned; until it ships, email us and we will send your archive.
• Object or restrict certain processing as described in Sections 12 and 13.

To exercise any right, contact us using the information in Section 19. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising your rights.

• Right to know the categories and specific pieces of personal information we collect, use, disclose, and sell or share.
• Right to delete personal information we collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information.
• Right to limit use and disclosure of sensitive personal information.
• Right to be free from discrimination for exercising any of these rights.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. The categories of personal information we collect, our purposes, and the categories of third parties we disclose to are described in Sections 3, 4, 6, and 8.

You may exercise these rights by contacting us using the information in Section 19. An authorized agent may submit requests on your behalf with verifiable authorization.

• Contract (Article 6(1)(b)) to provide the Service.
• Legitimate interests (Article 6(1)(f)) for security, fraud prevention, moderation, and improving the Service.
• Consent (Article 6(1)(a)) where required, such as for optional features.
• Legal obligation (Article 6(1)(c)) where required.

Subject to applicable law, you have rights to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local supervisory authority.

Our service providers are located in the United States. International transfers are covered by appropriate safeguards, including standard contractual clauses where required.