Effective Date: [TO BE SET]
This Policy explains what Morning Call collects, why, who it goes to, and what you can ask us to do about it. It is incorporated into the Terms of Service.
| What | Why | Where it lives |
|---|---|---|
| Email address | To identify your account, confirm it is yours, and contact you about it | Stored in plain form so we can email you |
| Name | Shown on the desk; used to address emails to you | Stored in plain form |
| Password | To sign you in | Never stored. We keep a PBKDF2-HMAC-SHA256 hash with a per-account random salt and 260,000 iterations. We cannot read, recover, or tell you your password |
That is the complete list of what we ask you for. There is no profile, no preferences, no financial questionnaire, and no optional fields.
| What | Why | Kept for |
|---|---|---|
| Session record — a hash of your session token, the time it was created and expires, and your browser's user-agent string | To keep you signed in and to let us end sessions when a password changes | Deleted automatically once expired; sessions last 12 hours |
| Email confirmation tokens — a hash of the token, never the token itself | To confirm your address | Deleted automatically once expired or used; they last 48 hours |
| Account activity log — that an account was created, signed in, had its role or password changed, or was deleted, with the time | Security and accountability. It is how we could answer "who changed this and when" | See Section 6 |
| Server request logs — the IP address the request came from, the path requested, and the response status | Operating and debugging the service; rate-limiting sign-in attempts | 14 days. Written to a file on the server, rotated daily and deleted after fourteen days. Not sent to any external logging service and not included in our backups |
We do not log the content of pages you view beyond the URL path, and we do not build a profile of your reading.
Email addresses are not written to these logs. Where the server records that a message was sent, or that a password reset was asked for, the address is reduced to its domain first — ***@gmail.com, never the address itself. These logs exist to answer "is delivery failing"; they do not need to record who, so they are not permitted to.
One cookie. It is named mc_session, it holds a random session token, and it exists solely to keep you signed in. It is marked HttpOnly (JavaScript cannot read it), SameSite=Lax (it is not sent from other sites), and Secure, so a browser will not send it over an unencrypted connection. The site is served over HTTPS only. It expires after 12 hours.
There are no analytics cookies, advertising cookies, or third-party cookies, because there is no analytics or advertising.
Browser storage. The site stores one value in your browser's sessionStorage, and only for staff accounts: a flag remembering whether an editor has switched into the "view as member" preview. It is per-tab, contains no personal data, and disappears when the tab closes.
We use it to run the Services and for nothing else. Specifically:
We do not use your data to train any AI model, ours or anyone else's.
No user data is sent to the AI model. This is worth stating precisely because it is unusual for a product built on one. When Morning Call asks a large language model to draft a Call, what it sends is a dossier of market data, price statistics, news headlines and regulatory filing references for a single ticker. It contains no account, no email address, no session, and nothing about who is reading. There is no path by which a user's information reaches the model.
Data leaves our systems in only these ways:
| Recipient | What they receive | Why |
|---|---|---|
| Resend (email delivery) | Your email address, and the text of the account message being sent to you | To deliver account email. They act on our instructions and may not use it for anything else |
| DigitalOcean (hosting) | Whatever transits or is stored on the server, which is located in the United States | To run the service |
| Wix (domain registrar and DNS) | Nothing about you. They answer the question "what address is morningcallpredictions.net at" | The domain is registered there; the site itself is not hosted by them |
| Tiingo, Inc. | Ticker symbols only | Market data. They receive nothing about users |
| Anthropic | Market data and news for one ticker | Drafting Calls. They receive nothing about users |
| SEC EDGAR, news sources | A contact address for Morning Call, as their terms require | Gathering filings and headlines. They receive nothing about users |
We will also disclose information if we are legally required to, or where necessary to investigate suspected abuse of the Services — and we will tell you unless we are prohibited from doing so.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
deleted-user-1041. The log continues to show that one account was created, signed in, and was deleted, and when — it no longer shows whose. This is deliberate: a log that can be erased by the person it records is not an audit log, and one that keeps your address after you leave is not deletion.You can, at any time:
Depending on where you live — California under the CCPA/CPRA, the EU or UK under the GDPR, and several other jurisdictions — you may have additional rights, including to a portable copy of your data and to object to certain processing. We will honour those requests regardless of where you live. We will not discriminate against you for making one.
To make any request, use Settings → Contact support inside the Services and choose "Privacy or my data". The message reaches us directly, already identified as coming from your account, which means we do not have to ask you to prove it is you. We will respond within 30 days.
If you no longer have an account — because you deleted it, or cannot sign in — write to us at [MAILING ADDRESS]. We do not currently operate an email address for the domain, so post is the route that does not depend on having a session. We recognise this is slower than email and are working on it.
All of these are available to you directly, without asking us, from Settings in the site header: your account details, changing your password or email address, signing out other devices, downloading your data, and deleting your account.
If you have forgotten your password, use Forgot your password? on the sign-in screen and we will email you a link to set a new one. The link expires in one hour, works once, and signs out every device using the account.
HttpOnly and SameSite=Lax; state-changing requests additionally require a header a cross-site form cannot set.No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal information, we will notify you and any regulator that applicable law requires, without undue delay.
The Services are not directed at anyone under 18, and the Terms require you to be 18 to use them. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.
Morning Call operates from the United States and your information is stored and processed there. If you access the Services from outside the United States, you are transferring your information to a country whose data protection laws may differ from your own.
We may update this Policy. If we change it materially, we will update the Effective Date and tell you through the Services or by email before the change takes effect. We will not apply a materially different use of data already collected without your consent.
Questions, requests, or complaints: Settings → Contact support inside the Services if you have an account, or [MAILING ADDRESS] if you do not.