Catalyst · Edge
📜 Last updated 2026-06-27 · Plain language · Email [email protected] for any data request

Privacy policy — short, plain, GDPR-aligned.

No legalese, no dark patterns. We collect almost nothing, never sell what we collect, and respond to deletion or export requests within 14 days. The full surface is below — and described in plainer English on /security.

Effective date · 2026-04-25

01What we collect

We collect the minimum needed to run the service. The full surface is documented on /security. In short:

  • Email address — for login, Stripe receipts, and the optional newsletter.
  • Signup preferences — the markets (stocks / crypto) and tickers you choose during signup, plus which signup variant you saw. Used to tailor your newsletter and scanner. You can change or clear these any time by contacting us.
  • Product analytics (first-party) — an anonymous session identifier, pages viewed, and signup-funnel steps, stored on our own servers. Used only to measure and improve the product; never sold or shared.
  • Stripe customer ID — billing reference; we never see your card number.
  • API key — bcrypt-hashed at rest, rotatable any time.
  • Server logs — IP, User-Agent, request path, timestamp. Used solely for rate-limiting and abuse prevention.

02Why we collect it

Three reasons, all narrow:

  • Authentication — to know you are you.
  • Billing — to keep your subscription active via Stripe.
  • Abuse prevention — so a single bad actor doesn't degrade the service for everyone else.

Legal basis under GDPR: contract performance (auth + billing) and legitimate interests (abuse prevention). For the optional newsletter, the legal basis is your explicit consent — opt out by replying STOP at any time.

03Retention

  • Server logs — rotated and deleted after 30 days. No long-term archive.
  • Account data (email, hashed API key, Stripe customer ID) — kept while your account is active.
  • Post-cancellation — retained for 90 days in case of accidental cancellation or audit, then permanently deleted.
  • Newsletter list — until you unsubscribe. Unsubscribe purges your address within 7 days.
  • Stripe invoices — kept by Stripe per their own retention policy (typically 7 years for tax compliance).

04Third parties

We use a small, named set of processors for primary operations:

  • Stripe — payment processing only. Stripe receives your email, payment method, and billing address. Stripe privacy policy.
  • Beehiiv — newsletter delivery. Receives your email address and newsletter engagement data. Beehiiv privacy policy.
  • Transactional email provider (SendGrid / Resend) — delivers account, magic-link, and report emails. Receives your email address and message content.

That's it. No ad networks. No data brokers. No analytics SaaS (no Google Analytics, no Facebook Pixel, no Hotjar). We do not sell, license, or share your data with anyone for marketing or any other purpose, ever.

05Your rights

Under GDPR, CCPA, and similar regimes you have the right to:

  • Access — request a copy of all data we hold on you.
  • Deletion — request permanent deletion of your account and associated data.
  • Export — request a machine-readable export (JSON) of your account data.
  • Rectification — correct inaccurate data we hold.
  • Object / restrict — limit processing of your data.
  • Withdraw consent — for the newsletter at any time.

Email any of these requests to:

We acknowledge within 24 hours and complete within 14 days for most requests. Exports are delivered as a single JSON file via the email address on your account.

06Cookies

  • One first-party cookie: tier_token — keeps you logged in. HttpOnly, SameSite=Lax, expires after 1 year.
  • Zero third-party cookies — no advertising or tracking cookies of any kind.
  • The site works identically if you block all cookies; you'll just need to log in on every visit.

07International transfers

Our servers are located in the United States (DigitalOcean, NYC region). If you are in the EU/EEA or UK, your data is transferred to the US under the Standard Contractual Clauses (SCCs) approved by the European Commission. Stripe handles its own SCC framework for billing data.

08Children's data

Catalyst Edge is not directed at children under 18, and we do not knowingly collect data from anyone under 18. If you become aware that a minor has created an account, please email [email protected] and we will delete it within 7 days.

09Changes to this policy

We version this page. The Last updated date at the top is the source of truth. For material changes (retention windows, new third parties, scope of data collected) we email all paying customers and post a notice on /changelog at least 14 days before the change takes effect. You can object and request deletion before the new terms apply.

10Contact

Email [email protected] for any privacy question — the founder reads every message and replies within 24 hours. For security vulnerabilities specifically, see the bounty program on /security.

You are one page deep in a scanner that grades its own picks in public, wins and losses alike.

$99 once — the full ranked console, before the open.

Tier 1 setups touched +2% intraday 48.9% of the time across 374 tracked calls. Baseline for everything else: 40.9%. That is a +8.0 point edge, measured from the NEXT OPEN — the first price you could actually pay, not the prior close. We publish the misses too: https://catalystedgescanner.com/trust/

  1. Click Become a Founding Member below.
  2. Pay $99 once — not monthly, not ever again.
  3. You keep every future release at that price. Tomorrow's ranked list lands at 3:30 AM ET, before the open.

29 of 30 founding seats left. The price goes up when they are gone.

Become a Founding Member — $99 once

One payment. Lifetime access. The free daily picks stay free — this is for people who want the full console. Not buying today? Get tomorrow's ranked list free →