Privacy Policy

1. Scope

This Privacy Policy explains how Steady Otter (“Steady Otter,” “we,” “us,” or “our”) handles information when you visit or test the Portfolio Mix website, software, simulations, and related features (collectively, the “Service”).

The Service is an unfinished alpha made available solely for testing and evaluation. Its features and data practices may change as development continues. We will update this Policy before materially different practices take effect when required by law.

2. Information we collect

Information you provide

• Testing inputs. If enabled, the Service may process portfolio simulations, assumptions, preferences, uploaded files, simulation parameters, and other content you choose to submit.
• Communications and feedback. If you email us or send feedback, we receive your email address and the information you include in your message. If you use the in-product error report, we also store the current page path; pseudonymous user, session, run, and request references; the app version and run status; and bounded browser, locale, time-zone, screen, and viewport details so we can investigate the report. We do not attach cookies, authentication tokens, CSRF values, query strings, or unrelated form contents.
• Account information. You may sign in with Google or with an invited email address and access code. Google provides your verified email address, name, and a stable Google account identifier. For access-code sign-in, we store the invited email address, a salted one-way credential hash, invitation and use timestamps, revocation status, and bounded security-attempt records. We use this information to identify and secure your account and derive pseudonymous session and run-owner references. We do not store Google access or refresh tokens, and we cannot recover an access code from its stored hash.
• Waitlist information. If you ask to join the waitlist, we store your full name, verified Google email address, relationship to the founder, and submission time so we can review and respond to your access request.

Do not submit passwords, authentication credentials, Social Security or tax-identification numbers, bank or brokerage account numbers, payment card data, government identification, health information, or similarly sensitive information. Portfolio inputs may reveal details about your finances even if they do not include your name.

Information collected automatically

When you access the Service, our servers and infrastructure providers may automatically process technical and usage information such as your IP address, browser and device type, operating system, requested pages, referring page, request date and time, response status, and security or error diagnostics. We use this information to deliver, protect, debug, and evaluate the Service.

The administrator can review server-side usage history, including your account reference and email when signed in, sign-in times, requested routes, allowlisted request parameters, response status and duration, IP address, and bounded browser information. Run-submission records also include the YAML submitted for execution and the resulting run reference. We exclude passwords, access codes, cookies, OAuth and CSRF tokens, raw query strings, and unrelated form contents. Static resources and health probes are excluded. Usage history supports alpha operation and debugging; it is accessible only to the administrator.

Cookies and similar technologies

As of the effective date, the public alpha does not intentionally use advertising cookies or third-party behavioral analytics. The Service may use strictly necessary cookies or similar storage if required for security, preferences, sessions, or alpha functionality. We will update this Policy if our use materially changes.

3. How we use information

We may use information to:

• provide, operate, and maintain the Service;
• run requested mathematical simulations and return test outputs;
• authenticate invited users and associate their test runs;
• review and respond to waitlist access requests;
• monitor reliability, prevent abuse, and protect users and systems;
• diagnose errors, perform testing, and improve the Service;
• respond to questions, feedback, and support requests; and
• comply with law and enforce our Terms of Use.

We do not use the Service to execute transactions, access financial accounts, or take financial actions for you.

4. How we disclose information

We may disclose information:

• to infrastructure, hosting, security, and other vendors that process it for us under appropriate restrictions;
• when required by law, legal process, or a valid government request;
• when reasonably necessary to protect rights, safety, and security or to investigate fraud, abuse, or a violation of our Terms; or
• as part of a merger, financing, reorganization, sale, or transfer of the Service or its assets, subject to applicable law.

We do not sell personal information or share it for cross-context behavioral advertising. We do not disclose personal information to data brokers.

5. Retention

We retain information only for as long as reasonably necessary for the testing, operational, security, legal, and dispute-resolution purposes described in this Policy. Retention varies by data type. Alpha test data may be deleted at any time, including when features change or testing ends. Backup copies and security logs may remain for a limited period before deletion.

6. Security

We use reasonable administrative, technical, and organizational measures intended to protect information. No method of transmission, storage, or processing is completely secure, and this alpha Service may contain defects. You submit information at your own risk and should not use the Service to store your only copy of anything.

7. Your choices and privacy rights

You may choose not to provide optional information and may stop using the Service at any time. Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of personal information, or to object to or restrict certain processing.

To make a privacy request, email contact@steadyotter.com. We may need to verify your request and may retain information where permitted or required by law. You may also have the right to appeal our response or contact your local privacy regulator.

Because the public alpha does not intentionally use third-party behavioral advertising, it does not currently respond differently to browser “Do Not Track” signals.

8. California privacy notice

In the preceding 12 months, the categories of personal information we may have collected are identifiers such as an IP or email address; internet or other electronic network activity; information in communications, testing inputs, or simulation simulations; and inferences generated by a requested simulation. We collect this information from you, automatically from your use of the Service, and from vendors that help us operate it. Sections 3 and 4 describe the business purposes for collection and the categories of recipients.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

California residents may have rights to know, access, correct, or delete personal information; receive a portable copy; opt out of sale or sharing; limit certain uses of sensitive personal information; and not receive discriminatory treatment for exercising privacy rights. These statutory rights apply only if and to the extent the California Consumer Privacy Act applies to Steady Otter and the information at issue. We will not discriminate against you for making a privacy request. You or your authorized agent may submit a request using the contact information below, and we will verify and respond to it as required by applicable law.

9. Children

The Service is intended only for adults and is not directed to children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate.

10. International use

The Service and its providers may process information in countries other than the country where you live. Those countries may have different data protection laws. Where required, we use lawful safeguards for international transfers.

11. Third-party services

When you use the optional simulation AI Wizard, Continue sends your investment thesis and available ETF catalog context to OpenAI to select draft universe symbols. The thesis is stored with the simulation when you save it. Clear removes it from the draft and lets you continue manually.

The Service may contain links to or rely on third-party services. Their privacy practices are governed by their own policies, not this Policy. We encourage you to review them before providing information.

12. Changes to this Policy

We may update this Policy at any time as the alpha evolves, including without prior notice. We will post the revised Policy and update its effective date. If applicable law requires additional notice or consent, we will provide it.

13. Contact

Questions or requests about privacy may be sent to contact@steadyotter.com.