Privacy Policy

We collect your account email address, optional name, account identifiers and account timestamps, including your last sign-in. Sign-in records include hashed email verification codes, expiry times and attempt counts. If you register a passkey, we store its credential record, optional name and usage timestamps.

OAuth and session records include the connected app, granted permissions, token hashes, expiry and revocation records, and website session records. We receive the tool arguments you submit, including MonkQL text. Saved queries store their names, descriptions, text, timestamps and append-only version history. Creation retry receipts store the original saved-query response so that an identical retry can return the same result.

We record content-free operational and usage facts, such as account and connected-app identifiers, request or run identifiers, tool names, success or failure, timing, symbol and dataset counts, intervals and usage credits. These usage records do not contain query text, prompts, symbol names or tool results. We also record content-free product events, such as an account being created, an AI app connecting, a query counting toward the plan, a plan limit being reached, a checkout being opened and a subscription starting, ending or being refunded, identified only by an internal account identifier. Website analytics collects the information described under Analytics and Cookies below.

If you subscribe to Monk.trade Pro, the purchase is sold through Link, a Stripe service that acts as merchant of record: Stripe and Link collect your payment details, billing address and email to process the payment and calculate tax, and Link sends your receipts and invoices. Their handling of that information is covered by Link’s and Stripe’s privacy policies. We never receive or store card numbers. We store your Stripe customer and subscription identifiers, your plan, subscription status, price and renewal date, and, on the Free plan, a count of today’s queries that resets at 00:00 UTC.

We use this information to provide the service, authenticate users and connected AI apps, send transactional messages, prevent abuse, and improve product reliability.

We do not sell or rent personal information. We share only what is necessary with service providers that operate infrastructure, email communications and payment processing (Stripe, and Link as merchant of record for Pro purchases), or when required by law.

When you request a tool action through a connected AI app, Monk.trade returns the requested tool results to that app. Results can include market data, charts, evidence, saved-query text and version history, depending on the tool and the permissions you granted. The connected app handles the results under its own privacy policy. You can revoke an AI connection on your signed-in account page (monk.trade/account); revocation stops that connection’s access but does not delete results already received by the app.

We use encrypted connections and access controls designed to protect user data.

Account information and content-free usage records have no automatic retention limit and are kept until the account is deleted. Operational logs and traces, which carry internal account identifiers but no email address, query text or payment details, are kept by our monitoring service for 30 days and are not removed earlier by account deletion. Saved queries and their versions are kept until the query or account is deleted. Updating a query preserves earlier versions; deleting it permanently removes its version history. Creation retry receipts can retain the original response after query deletion: their replay window is 24 hours, after which periodic cleanup removes them. Account deletion also removes these receipts.

Sign-in verification records, OAuth token records and website session records have no automatic retention limit and are kept until those records are deleted. Account deletion also removes its OAuth tokens, sessions and passkeys. Email sign-in codes are valid for 10 minutes and allow five tries; expiry ends their validity rather than deleting their records. Pending OAuth requests and unused authorization codes expire after 10 minutes and are removed by periodic cleanup. Token expiry and connection revocation end access rather than deleting the stored token or session records.

To delete your account, email [email protected]. You may also request access to, correction of, or deletion of your personal information by contacting [email protected].

Google Analytics measures visits to website pages, including sign-in and your account page, with one page view per page you open. We send the page’s path and title and the referring website’s origin (or the previous Monk.trade page), without URL query parameters or fragments. We also send a few product events with no personal details: that you signed in and how (email code or passkey), that you opened checkout and the billing interval, that a Pro purchase completed, and that you copied setup text. Google also receives basic browser, device and coarse-region information, and session information when analytics cookies are enabled. We do not send account identifiers, questions, symbols, email addresses, payment details or tool results. Advertising features and ad personalization are disabled. Development hosts are excluded.

We use essential cookies for authentication and service operation. Google Analytics uses Consent Mode’s region defaults: inside the European Economic Area (EEA), the United Kingdom, the Crown Dependencies, Switzerland and Gibraltar, it sends cookieless measurements and sets no new analytics cookies. Outside those regions, analytics cookies are enabled unless you opt out as described below. Advertising storage and advertising uses are disabled everywhere.

We honor Global Privacy Control (GPC): when your browser sends this signal, Google Analytics sends cookieless measurements and sets no new analytics cookies, regardless of region. We also honor a previously stored analytics denial from our former consent control. We read that choice without changing it or storing a new choice.

Cloudflare Web Analytics also runs on website pages through a cookieless beacon injected by Cloudflare. It collects page paths, referrers, browser and operating system, device category, country and performance timing. It measures visits and page performance without cookies, browser storage or fingerprinting to identify visitors.

You can block analytics requests with your browser’s tracking protection or a content-blocking extension. You can also block or delete cookies in your browser settings. Blocking cookies alone may still allow cookieless measurements.

Questions about privacy can be sent to [email protected].