1. Introduction

Summit Valley ("we," "our," or "us") is operated by Townsquare Digital. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our web application and services at summitvalley.app (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account information: Email address and display name provided during registration via Clerk
• Financial account data: When you connect a bank account via Plaid, we receive account balances, holdings, and transaction history from your financial institution
• Exchange API keys: When you connect a brokerage or crypto exchange, we store your API credentials to retrieve portfolio data on your behalf
• Wallet addresses: Blockchain wallet addresses you choose to connect

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, and interaction patterns
• Device information: Browser type, operating system, IP address, and timezone
• Error and performance data: Collected via Sentry for debugging and service improvement

2.3 Information from Third Parties

• Plaid: Account and transaction data from your connected financial institutions. Plaid's privacy policy applies to data collected during the bank linking process
• Market data providers: Publicly available financial market data (prices, indicators) associated with assets you track

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Display your portfolio holdings, scores, and financial analytics
• Send account-related notifications and security alerts
• Respond to your requests and support inquiries
• Monitor for fraud, abuse, and security incidents
• Comply with legal obligations
• Analyze usage patterns to improve the Service

We do not sell your personal information to third parties. We do not use your financial data for advertising purposes.

4. How We Share Your Information

We share your information only with trusted service providers who help us operate the Service:

• Clerk — identity and authentication management (SOC 2 Type II)
• Supabase — secure database storage (SOC 2 Type II, ISO 27001)
• Plaid — bank account connectivity (SOC 2 Type II, PCI DSS)
• Netlify — hosting and content delivery (SOC 2 Type II)
• Sentry — error monitoring (no financial data transmitted)
• Anthropic — AI-powered signal analysis (indicator data only, no PII)

We may also disclose information if required by law, court order, or government authority. We do not share your financial account data, balances, or transaction history with any third party beyond what is necessary to operate the Service.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account:

• Personal account data is deleted within 30 days
• Financial connection data (Plaid tokens) is revoked and deleted immediately
• Anonymized, aggregated usage data may be retained for analytics

6. Data Security

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 (via Supabase)
• Access to production systems is protected by multi-factor authentication
• Bank credentials are never stored — all bank connectivity is handled by Plaid
• API keys are stored encrypted and are never logged or exposed to staff

Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

You may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Portability: Request your data in a machine-readable format
• Opt-out: Opt out of non-essential communications

California residents (CCPA): You have the right to know what personal information we collect, to delete it, and to opt out of its sale. We do not sell personal information.

To exercise any of these rights, contact us at sunny@summitvalley.app. We will respond within 30 days.

8. Cookies and Tracking

We use minimal cookies necessary to operate the Service, including session tokens for authentication. We do not use third-party advertising cookies or tracking pixels. You can control cookie settings through your browser preferences.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at sunny@summitvalley.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we will notify you via email or in-app notification.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy:

Summit Valley / Townsquare Digital
Email: sunny@summitvalley.app
Website: summitvalley.app