Privacy Policy

Effective date: 2026-05-17.

Filing.fyi (“Filing.fyi,” “we,” “us”) is operated by Hootpods LLC, a Florida limited liability company. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. By using Filing.fyi (the “Service”), you agree to this policy.

If you do not agree, do not use the Service.

1. Audience and scope

Filing.fyi is operated from, and primarily directed to users located in, the United States. We do not knowingly market the Service to residents of the European Economic Area, the United Kingdom, or other jurisdictions whose data-protection laws would impose obligations on us that we have not opted into. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law. By using the Service you consent to the transfer of your information to, and its processing in, the United States.

The Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, email privacy@filing.fyi and we will delete it.

2. Information we collect

2.1 Information you provide

• Account information. When you sign in, we receive your email address and (depending on your sign-in method) your name and a provider-issued user ID from Google or Apple. We use Supabase Authentication; the JWT issued to your browser is stored in your browser’s localStorage and is not transmitted to any third party other than the Supabase auth service.
• Payment information. When you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not see or store your full payment-card number, CVV, or bank credentials. We receive and store: your Stripe customer ID, the subscription’s price ID and status, the period start/end dates, your trial end date (if any), and whether the subscription is set to cancel. Stripe’s own privacy notice applies to data you provide to Stripe.
• Comments and other content. When you submit a comment, watchlist entry, or other content, we store it together with your user ID, the ticker or filing it is attached to, your position-disclosure selection (long / short / none / prefer not to say), and the comment’s anchor location within the filing. Comments are public by default.
• Communications with us. If you email us, contact support, or submit a form, we keep the message and any information you include.

2.2 Information collected automatically

• Technical data. When you load a page or call our API, our servers (Cloudflare Pages, Cloudflare Workers, Google Cloud Run) automatically log information needed to operate the Service: IP address, user-agent string, request path, status code, and timestamps. We use these logs to operate the Service, detect abuse, and produce aggregate usage statistics.
• Bot-protection signals. On forms (sign-in, comment submission, custom-query submission) we deploy Cloudflare Turnstile. Turnstile may collect device and behavioral signals from your browser to determine whether you are a human. Turnstile is governed by Cloudflare’s privacy notice.
• Usage events. When you use paid features (for example, custom queries against a filing) we log the event — ticker, normalized question, timestamp, response cache key — to enforce daily quotas and bill correctly.

2.3 What we do not collect

• We do not run third-party advertising trackers, ad-network pixels, or third-party analytics scripts. No Google Analytics, no Meta Pixel, no PostHog, no Plausible.
• We do not collect or store financial-account information, brokerage credentials, social-security numbers, or government identifiers.
• We do not store the content of news articles we summarize; we link to the source.
• We do not scrape or store your data from outside our Service to build a profile of you.

3. How we use information

We use information to:

1. Operate the Service: serve pages, authenticate you, render your watchlist, attribute your comments.
2. Process payments and manage your subscription via Stripe.
3. Enforce daily quotas on paid features and detect abuse.
4. Send you transactional emails — welcome, payment receipts, payment-failure notices, subscription-cancellation confirmations, watchlist alerts. We do not send marketing email without your explicit opt-in.
5. Moderate user-submitted content (see §6).
6. Comply with law and protect Filing.fyi, our users, and the public.

We do not sell your personal information, and we do not “share” your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

4. Service providers (sub-processors)

We rely on the following service providers, each of which is contractually obligated to protect your data:

Provider	Purpose	Data shared
Supabase, Inc.	Authentication, database hosting	Email, OAuth provider ID, user ID, watchlist, comments, subscription state
Stripe, Inc.	Payment processing, subscription management	Email, customer ID, payment metadata
Cloudflare, Inc.	CDN, DNS, bot protection (Turnstile), edge logs	IP address, user-agent, request metadata
Google Cloud Platform	Backend hosting (Cloud Run, Cloud Scheduler)	Request logs, environment configuration
Resend, Inc.	Transactional email delivery	Email address, message body
Google LLC (Gemini API)	LLM inference for AI-generated analysis and custom queries	Filing text and your query text (see §5)
OpenAI, L.L.C.	LLM inference (fallback)	Filing text and your query text (see §5)
Anthropic PBC	LLM inference (fallback)	Filing text and your query text (see §5)

We may add or change service providers from time to time. Material changes will be reflected in a revised version of this policy.

5. AI and the “chat with filings” feature

Our synthesis prose and, for paid users, custom-query answers are generated by third-party large-language-model (“LLM”) providers — currently Google Gemini, OpenAI, and Anthropic — operating under their respective enterprise / API privacy terms. (Our forensic scores and verdict labels are mechanical computations and do not call an LLM, so no filing text or query text is sent to a third party when you load those.)

When you submit a custom query, the text of your query and the relevant SEC-filing excerpts are sent to the LLM provider for inference. We instruct providers, where supported by their API terms, not to train their models on our API traffic. Do not include personal information, account numbers, passwords, or anything sensitive in a query. The LLM provider may temporarily retain your query for abuse-monitoring per its own retention policy.

We log query metadata (ticker, normalized question hash, timestamp) on our own servers to enforce quotas and operate a cross-user cache. We do not associate cached LLM answers with your identity in a way that would expose your queries to other users.

6. User-submitted content and moderation

Comments and other content you submit may be displayed publicly together with your display name and position disclosure. We do not edit the body of your comment. We may:

• Approve a comment (publish it).
• Reject a comment (do not publish it).
• Place a comment in shadow state (visible to you, not to others) if it appears to violate our rules but we are not certain.
• Remove or shadow content that we believe is unlawful, defamatory, abusive, spam, manipulative (pump-and-dump), or otherwise in violation of our Terms.

Decisions are made by automated screening and human review. Submitting a comment does not create any obligation by us to publish, retain, or reply to it.

If you want a comment removed, email privacy@filing.fyi with the URL and a description.

7. Cookies and similar technologies

We use a minimal set of first-party storage mechanisms:

• A Supabase authentication token in localStorage so you stay signed in.
• A small number of essential cookies set by Cloudflare for security and bot protection.
• Stripe sets cookies on its own checkout pages.

We do not use cookies for advertising. Your browser’s “do not track” signals do not change our behavior because we already do not engage in cross-context behavioral advertising.

8. Data retention

• Account data: retained while your account is active and for up to 24 months after you delete your account, except where we must retain longer to comply with law.
• Subscription and billing records: retained for at least 7 years to comply with tax and accounting law.
• Comments: retained indefinitely while published. On account deletion, comments are soft-deleted: your user ID is dissociated and the body is replaced with “[deleted]” so that downstream threads do not break.
• Usage events (custom-query logs): retained for 13 months for fraud and quota enforcement.
• Server logs: retained for up to 90 days.

9. Your rights

9.1 All users

You can:

• Access the information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data, subject to the retention exceptions in §8.
• Export your account data in a machine-readable format.
• Object to specific processing where the law gives you that right.

To exercise these rights, email privacy@filing.fyi from the email address on your account. We will verify your identity and respond within 45 days (or the period required by applicable law).

9.2 California residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (“CCPA”) as amended by the CPRA:

• The right to know what personal information we have collected, used, disclosed, and (where applicable) sold or shared.
• The right to delete personal information, subject to legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of sale or sharing of personal information. We do not sell or share personal information within the meaning of the CCPA, so there is nothing to opt out of.
• The right to limit the use of sensitive personal information. We do not collect sensitive personal information within the meaning of the CCPA.
• The right not to be retaliated against for exercising these rights.

You may submit requests through the email above. We do not charge a fee. If we cannot verify your request we will tell you why. You may designate an authorized agent to act on your behalf with written authorization.

9.3 Other US states

Residents of states with comparable privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, and others) have rights similar to those above. Use the same email to exercise them.

10. Security

We use industry-standard measures — TLS in transit, encryption at rest, signed JWTs, audited service providers, and least-privilege access controls — to protect personal information. No system is perfectly secure. If we discover a breach of personal information that legally requires notification, we will notify affected users in the manner required by law.

11. Links to third-party sites

The Service contains links to third-party websites, including Amazon product pages reached through our affiliate links. We are not responsible for the privacy practices of any third party. Read their privacy notices before providing them personal information.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be posted on the Service and, for material changes that adversely affect your rights, communicated to subscribers by email. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

13. How to contact us

Privacy inquiries: privacy@filing.fyi General inquiries: hello@filing.fyi Postal address available on written request to the email above.

Hootpods LLC, the operator of Filing.fyi.