Privacy Policy

We collect the following categories of information:

• Account information. The username and email address you provide at signup, and your password (which we store only as a salted cryptographic hash — we never store or can see your actual password). We also record which version of our User Agreement you accepted and when.
• Payment information. If you subscribe to a paid plan, payments are processed by Stripe. We do not collect or store your full card number, CVC, or bank details — Stripe does. We store a Stripe customer identifier, your subscription and plan status, so we know what you are entitled to.
• Technical and usage information. Your IP address (used for security and rate limiting), and standard server-log information such as browser type, device information, and timestamps generated when you access the Service.
• Cookies. A strictly necessary session cookie to keep you logged in, and a preference cookie that remembers your chosen terminal theme. See Section 6.
• Communications. Emails we send you (such as a welcome message) and any messages you send us, including replies to our emails.

We do not intentionally collect sensitive personal information (such as government IDs, health data, or precise geolocation), and we ask that you not send it to us.

We use the information we collect to:

• Create and maintain your account and authenticate you.
• Provide, operate, and improve the Service.
• Process subscriptions, payments, and related billing through Stripe.
• Send you transactional and service messages (for example, a welcome email, receipts, and important account notices).
• Protect the Service, detect and prevent fraud and abuse, and enforce rate limits and our terms.
• Comply with legal obligations and respond to requests.

If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases: performance of a contract (to provide the Service and your account); our legitimate interests (to secure, maintain, and improve the Service and prevent abuse); compliance with a legal obligation; and your consent, where required (for example, certain marketing). You may withdraw consent at any time.

We do not sell your personal information. We share it only as follows:

• Service providers (subprocessors) who operate the Service on our behalf and process data under contract: Vercel (hosting and content delivery), Neon (database), Stripe (payments), and Resend (email delivery).
• Legal and safety. When we believe disclosure is required by law, regulation, legal process, or to protect the rights, property, or safety of TreyBae, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

We use only the cookies needed to run the Service. A strictly necessary, HTTP-only session cookie keeps you signed in; a small preference cookie remembers your terminal theme. We do not use third-party advertising cookies or cross-site tracking. Because these cookies are essential or purely functional, they operate without a separate consent banner in most jurisdictions, but you can block cookies in your browser (though the Service may not work properly without the session cookie).

We keep your account information for as long as your account is active. If you ask us to delete your account, we will delete or anonymize your personal information within a reasonable period, except where we must retain certain records to comply with legal, tax, accounting, or fraud-prevention obligations (for example, Stripe retains transaction records as required by law).

We take reasonable technical and organizational measures to protect your information, including encryption of traffic in transit (HTTPS), hashing of passwords, signed session tokens, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your password confidential; you are responsible for activity under your account.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights by emailing us at John@treybae.ai. We will respond within the time required by applicable law. You can unsubscribe from marketing emails at any time using the link in those emails; we may still send you essential account and transactional messages.

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use and share it, to request deletion or correction, and to not be discriminated against for exercising your rights. We do not sell or share your personal information for cross-context behavioral advertising. To make a request, email John@treybae.ai.

We and our service providers are based in the United States, and your information will be processed there. If you access the Service from outside the United States, you understand your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

The Service involves trading-related information and is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 (or under 13 as defined by the U.S. Children's Online Privacy Protection Act). If you believe a child has provided us information, contact us and we will delete it.

The Service may link to third-party sites or services (such as Stripe's checkout). Their privacy practices are governed by their own policies, not this one. We encourage you to review them.

We may update this Policy from time to time. When we do, we will revise the “Effective date” above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.