Legal

Privacy Policy

Last updated Thu Oct 15 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

Effective date: 2026-10-15.

Filing.fyi (“Filing.fyi,” “we,” “us”) is operated by Hootpods LLC, a Florida limited liability company. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. By using Filing.fyi (the “Service”), you agree to this policy.

If you do not agree, do not use the Service.

1. Audience and scope

Filing.fyi is operated from, and primarily directed to users located in, the United States. We do not knowingly market the Service to residents of the European Economic Area, the United Kingdom, or other jurisdictions whose data-protection laws would impose obligations on us that we have not opted into. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law. By using the Service you consent to the transfer of your information to, and its processing in, the United States.

Our Terms require users to be 18 or older, and the Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, email privacy@filing.fyi and we will delete it.

2. Information we collect

You can read every page on Filing.fyi without an account. We collect account information only if you sign in, which you need to do only to request a data refresh, follow companies, or buy the ad-free plan.

2.1 Information you provide

Account information. When you sign in, we receive your email address and (depending on your sign-in method) your name and a provider-issued user ID from Google or Apple. You can also sign in with an emailed link. We use Supabase Authentication. Your sign-in token is stored in your browser (see §7) and is sent only to Supabase and to our own servers.
Data refresh requests. When you ask us to refresh a company’s page, we record that you asked, which company, and when, so we can enforce the daily refresh limit and email you when the update is ready.
Watchlist and email-update settings. Any signed-in reader can keep a watchlist. We store the companies on it, your email address and whether email updates are on, so updates can reach you if you have the ad-free plan. We email watchlist updates only to ad-free subscribers. We also keep a record of which updates we have sent you (so you are not emailed twice) and a random token used for the unsubscribe link in update emails. Your watchlist is private to your account.
Payment information. When you subscribe to the ad-free plan, payment is processed by Stripe, Inc. We do not see or store your full payment-card number or security code. Stripe collects your card details and billing details such as your postal code. We receive and store: your Stripe customer ID, the subscription’s price ID and status, the billing-period start and end dates, and whether the subscription is set to end. Stripe’s own privacy notice applies to data you provide to Stripe.
Comments. Public comments are not currently open to all readers. If you submit a comment, we store it together with your user ID, the ticker or filing it is attached to, your position-disclosure selection (long / short / none / prefer not to say), and the comment’s anchor location within the filing. Published comments are public.
Newsletter sign-up. If you sign up for the weekly email, we store the address you entered, where on the site you entered it, when, and the status of the sign-up (pending, confirmed or unsubscribed). See §2.4.
Communications with us. If you email us, contact support, or submit a form, we keep the message and any information you include.

2.2 Information collected automatically

Technical data. When you load a page or call our API, our servers (Cloudflare and Google Cloud Run) automatically log information needed to operate the Service: IP address, user-agent string, request path, status code, and timestamps. We use these logs to operate the Service, enforce rate limits, detect abuse, and produce aggregate usage statistics.
Web analytics. We use Cloudflare Web Analytics to count page views and visits. It runs a small script in your browser that reports the page you viewed, how long it took to load, the referring site, and your browser and country. It sets no cookies, doesn’t use local storage, and doesn’t track you across websites or build a profile of you; we see only aggregate statistics.
Error reports. If our servers hit an error, we send a report to Sentry so we can fix it. A report can include request details such as the path, your IP address, and your user ID if you are signed in.
Advertising data. Readers who are not on the ad-free plan see ads served by Google. Google and its partners may collect information through cookies and similar technologies, as described in §7. We do not load advertising code for signed-in ad-free subscribers once we have confirmed your plan (if that check fails, for example because of a network error, you may see ads on that page).

2.3 What we do not collect

We do not use cookie-based or cross-site analytics or tracking pixels: no Google Analytics, no Meta Pixel, no PostHog. Our only analytics is Cloudflare Web Analytics, described in §2.2.
We do not collect or store financial-account information, brokerage credentials, social-security numbers, or government identifiers.
We do not store the content of news articles; we link to the source.
We do not scrape or store your data from outside our Service to build a profile of you.
We do not send your personal information to AI providers (see §5).

You can sign up for a weekly email without an account. It is double opt-in: entering an address only sends that address a confirmation link, and we send the newsletter only to addresses that have clicked it. For each sign-up we store the email address, the status (pending, confirmed, or unsubscribed) and when it changed, which form on the site was used, two random tokens (one for the confirmation link, one for the unsubscribe link, so neither link reveals the address), and when we last sent you an issue. We do not store the IP address of the sign-up beyond the server logs in §2.2.

Every issue carries a one-click unsubscribe link, and mail programs that support the one-click standard (RFC 8058) can unsubscribe you without opening a page. Unsubscribing takes effect immediately; we keep the address marked as unsubscribed so we do not email it again. Email is delivered by Resend, Inc. as our processor (see §4), which receives the address and the message. The newsletter contains no advertising and no personal information about you; it lists what changed on the site in the past week. To have a newsletter address deleted rather than marked unsubscribed, email privacy@filing.fyi.

3. How we use information

We use information to:

Operate the Service: serve pages, authenticate you, run data refreshes, and keep your watchlist.
Process payments and manage your ad-free plan via Stripe, including turning ads off while your plan is active.
Enforce refresh limits and rate limits, and detect abuse.
Send you transactional emails: a welcome message, payment receipts and payment-failure notices, plan-cancellation confirmations, account-deletion confirmation, notices when a refresh you requested is ready or could not be completed, and, if you have the ad-free plan, email updates about companies on your watchlist (on by default; you can turn them off on your account page). Every update email has an unsubscribe link. We send the weekly newsletter only to addresses that confirmed a sign-up (§2.4). We do not send marketing email without your explicit opt-in.
Show advertising to readers who are not on the ad-free plan.
Moderate user-submitted content (see §6).
Comply with law and protect Filing.fyi, our users, and the public.

We do not sell your personal information for money. See §7 and §9.2 for how advertising cookies relate to “sharing” under California law.

4. Service providers

We rely on the following service providers:

Provider	Purpose	Data involved
Supabase, Inc.	Authentication, database hosting	Email, sign-in provider ID, user ID, watchlist, email-update settings, refresh requests, subscription status
Stripe, Inc.	Payment processing, subscription management	Email, customer ID, payment and billing details
Cloudflare, Inc.	Website hosting, CDN, DNS, bot protection, edge logs, cookie-free web analytics	IP address, user-agent, request metadata
Google Cloud Platform	Backend hosting (Cloud Run, Cloud Scheduler)	Request logs
Resend, Inc.	Transactional email delivery	Email address, message content
Functional Software, Inc. (Sentry)	Server error reporting	Request details, IP address, user ID
Google LLC (AdSense)	Advertising for readers not on the ad-free plan	Cookie and device identifiers, IP address, pages viewed on Filing.fyi
Anthropic PBC, Google LLC (Gemini API), OpenAI, L.L.C.	AI-generated write-ups about public filings	Public filing text and market data only; no personal information

We may add or change service providers from time to time. Material changes will be reflected in a revised version of this policy.

5. AI-generated content

Our synthesis prose is generated by third-party large-language-model (“LLM”) providers from public SEC filings and market data. Our forensic scores and verdict labels are mechanical computations and do not call an LLM. No information about you, including what you read, follow, or ask to refresh, is sent to an LLM provider. Filing.fyi does not currently offer a feature that sends your own questions to an AI provider.

6. User-submitted content and moderation

Public comments are not currently open to all readers. When they are, comments may be displayed publicly together with your display name and position disclosure. We do not edit the body of your comment. We may:

Approve a comment (publish it).
Reject a comment (do not publish it).
Place a comment in shadow state (visible to you, not to others) if it appears to violate our rules but we are not certain.
Remove or shadow content that we believe is unlawful, defamatory, abusive, spam, manipulative (pump-and-dump), or otherwise in violation of our Terms.

Decisions are made by automated screening and human review. Submitting a comment does not create any obligation by us to publish, retain, or reply to it.

If you want a comment removed, email privacy@filing.fyi with the URL and a description.

7. Cookies, browser storage, and advertising

Storage we use. We store a few items in your browser:

your sign-in token and your Supabase session (in localStorage), so you stay signed in;
your light or dark theme choice (in localStorage);
a short-lived note of whether you are on the ad-free plan (in sessionStorage, kept for up to 10 minutes), so we don’t have to check on every page;
a small number of essential cookies set by Cloudflare for security and bot protection (Cloudflare Web Analytics itself sets no cookies).

Stripe sets cookies on its own checkout and billing pages.

Advertising cookies. For readers who are not on the ad-free plan, we show ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and other sites on the internet. You can:

opt out of personalized advertising from Google at Ads Settings;
opt out of personalized advertising from many third-party vendors at aboutads.info;
learn how Google uses information from sites that use its services at How Google uses information from sites or apps that use our services;
avoid ads with the ad-free plan: while you are signed in on it, we do not load advertising code once we have confirmed your plan.

Visitors in U.S. states with privacy laws. We use Google’s U.S. state privacy settings for AdSense. In states whose laws give you the right to opt out of the sale or sharing of personal information for targeted advertising, Google may show you a privacy message with a link to opt out. When you opt out, Google limits its use of your information on Filing.fyi so that it is not used for personalized advertising.

Visitors from the EEA, the UK and Switzerland. Google shows you a consent message before any personalized ads are served, and you can decline or change your choice there.

Your browser’s “Do Not Track” setting does not currently change how ads are served on the Service.

8. Data retention

Account data (your account, watchlist, email-update settings, records of updates we have sent, refresh requests, and our copy of your subscription status): kept while your account is active and deleted when you delete your account. Copies may remain in our database backups for a short period (currently about 7 days) before they are overwritten.
Payment records: Stripe keeps payment and invoice records under its own retention policy and as required by tax and accounting law. We keep invoices and payment records that we need for our own tax and accounting obligations for at least 7 years.
Comments: retained while published. On account deletion, your comments are detached from your identity and their text is removed, so that threads remain readable.
Server logs and error reports: retained for up to 90 days.
Emails you send us: retained as long as needed to handle your request and for our records.

9. Your rights

9.1 All users

You can:

Access the information we hold about you.
Correct inaccurate information.
Delete your account and associated data from your account page at any time, subject to the retention exceptions in §8.
Export your account data in a machine-readable format, on request.
Object to specific processing where the law gives you that right.

To exercise these rights, email privacy@filing.fyi from the email address on your account. We will verify your identity and respond within 45 days (or the period required by applicable law).

9.2 California residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (“CCPA”) as amended by the CPRA:

The right to know what personal information we have collected, used, disclosed, and (where applicable) sold or shared.
The right to delete personal information, subject to legal exceptions.
The right to correct inaccurate personal information.
The right to opt out of the sale or sharing of personal information. We do not sell personal information for money. When Google’s advertising cookies are used to personalize ads (see §7), that may be considered “sharing” for cross-context behavioral advertising under the CCPA. In the past 12 months we may have shared identifiers (cookie and device IDs, IP address) and internet activity (pages viewed on Filing.fyi) with Google for this purpose. You can opt out through the privacy message Google shows to visitors in California and other covered states, or with the choices in §7. We do not knowingly share the personal information of consumers under 16.
The right to limit the use of sensitive personal information. We do not collect sensitive personal information within the meaning of the CCPA.
The right not to be retaliated against for exercising these rights.

In the past 12 months we have collected the following categories of personal information: identifiers (such as email address, user ID, and IP address), commercial information (your ad-free plan status and payment history), and internet activity (pages viewed and requests made on the Service). We collect them from you, from your browser, and from Stripe and your sign-in provider, for the purposes in §3, and disclose them to the service providers in §4.

You may submit requests through the email above. We do not charge a fee. If we cannot verify your request we will tell you why. You may designate an authorized agent to act on your behalf with written authorization.

9.3 Other US states

Residents of states with comparable privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, and others) have rights similar to those above, including the right to opt out of targeted advertising. Use the same email to exercise them.

10. Security

We use industry-standard measures — TLS in transit, encryption at rest, signed sign-in tokens, reputable service providers, and least-privilege access controls — to protect personal information. No system is perfectly secure. If we discover a breach of personal information that legally requires notification, we will notify affected users in the manner required by law.

11. Links to third-party sites

The Service contains links to third-party websites, including filings on the SEC’s EDGAR system and Amazon product pages reached through our affiliate links. Ads shown on the Service also link to third-party sites. We are not responsible for the privacy practices of any third party. Read their privacy notices before providing them personal information.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be posted on the Service and, for material changes that adversely affect your rights, communicated to ad-free subscribers by email. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

13. How to contact us

Privacy inquiries: privacy@filing.fyi General inquiries: hello@filing.fyi

Hootpods LLC, the operator of Filing.fyi 1825 Ponce de Leon Blvd, Ste 233, Coral Gables, FL 33134