Privacy Policy
Last updated: July 13, 2026
This Privacy Policy explains how Acinonyx Ltd ("we", "us", or "our") processes personal data when you visit or use Fat Pitches (the "Service"). Before launch, complete the controller identity, registered address, contact details, retention schedule, and any required data-protection-officer information.
Controller and contact
Acinonyx Ltd is the controller of personal data described in this policy. For privacy requests or questions, contact [email protected]. Replace this section before launch with the controller's full registered address, registration details, and data-protection contact where applicable.
Data we collect
Depending on how you use the Service, we may collect: account and profile data, such as your name, email address, authentication provider identifier, and login history; billing data, such as plan, subscription status, invoices, and Stripe customer or payment references; brokerage-integration data, such as encrypted authorization tokens, connected-account identifiers, account and order information necessary for enabled features, and integration logs; product data, such as watchlists, configured rules, journal entries, settings, and feature usage; technical data, such as IP address, browser and device information, log records, cookies, and error reports; and communications you send to us through support or chat.
How we use data
We process personal data to provide, operate, secure, troubleshoot, support, and improve the Service; authenticate users; operate brokerage-connected features you enable; prevent fraud, abuse, and security incidents; process subscriptions and maintain financial records; communicate with you; comply with legal obligations; and establish, exercise, or defend legal claims. Where required by law, our processing is based on performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, or your consent.
Brokerage credentials and tokens
We do not receive or store your Schwab username, password, PIN, or other credentials entered directly on Schwab's authentication pages. We store broker authorization tokens only after the broker issues them through the authorized connection flow. We encrypt tokens at rest using AES-256-GCM and restrict access to systems and personnel with a legitimate operational need. Tokens and associated brokerage data are used only to operate the connected features you enable, such as retrieving necessary account or order information and transmitting configured order instructions.
AI features
If you use AI features, we may send the minimum data needed to generate the requested output to an AI service provider. Our intended design is to send public market or public filing data and a ticker symbol, not your brokerage credentials, account data, or personal journal content, unless we clearly tell you otherwise before a feature is enabled. AI providers may process data under their own terms and data-processing commitments.
Recipients and service providers
We use service providers that process data on our behalf or provide infrastructure for the Service. These may include Charles Schwab & Co. for broker-connected features, Google for sign-in, Stripe for payments, PostHog for product analytics, Sentry for error monitoring, Resend for transactional email, Chatwoot for customer support chat, hosting and cloud providers, and AI providers for features you choose to use. We may also disclose data where required by law, to protect rights or safety, in connection with a corporate transaction, or with your direction or consent. We do not sell personal data and do not use brokerage data for advertising.
International transfers
Some service providers may process data outside the European Economic Area or the United Kingdom. When required, we use an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard. You may contact us for further information about applicable safeguards.
Retention
We retain personal data only for as long as necessary for the purposes described in this policy, including providing the Service, maintaining security, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, or regulatory obligations. Retention periods vary by data type. When data is no longer required, we delete it or anonymize it, subject to backups and legally required retention.
Security
We use administrative, technical, and organizational safeguards designed to protect personal data, including encryption for sensitive authorization tokens, access controls, logging, and security monitoring. No system is completely secure, and we cannot guarantee absolute security. You are responsible for using strong credentials and protecting access to your account and devices.
Cookies and analytics
We use necessary cookies and similar technologies to operate, secure, and remember your preferences in the Service. We use PostHog, self-hosted in the EU, to understand product usage and improve the Service. We do not use advertising cookies or sell personal data for targeted advertising. Where consent is required for non-essential cookies or analytics, we will request it through an appropriate consent mechanism. See our Cookie Notice for further details.
Your rights
Subject to applicable law, you may have the right to request access to, correction of, deletion of, or restriction of processing of your personal data; to object to certain processing; to receive portable data; and to withdraw consent where processing is based on consent. To exercise a right, contact [email protected]. You may also have the right to complain to the competent data-protection supervisory authority, including the Bulgarian Commission for Personal Data Protection where applicable.
Children
The Service is not directed to children, and you must not use it if you are below the minimum age required to enter into these Terms in your jurisdiction. We do not knowingly collect personal data from children.
Policy changes
We may update this Privacy Policy from time to time. We will post the revised version with a new "Last updated" date and, where required, provide additional notice. Your continued use of the Service after the effective date is subject to the updated policy.