# Privacy policy

**Draft.** This document is awaiting review by counsel and may change. Version 2026-10-17.

> What personal data Listed collects, why, who it goes to, how long we keep it, what we log for security, and the choices you have.

Updated Oct 17, 2026.

Listed is a service operated by Valor Security.

Effective Oct 17, 2026. Version 2026-10-17.

## Who is responsible for your data

Valor Security ([registered name, to be confirmed], [registered address, to be confirmed]) is the data controller for personal data processed through Listed. In this policy, "we" and "us" mean Valor Security.

For anything about your data, write to privacy@listed.markets.

## The short version

- You can read every public page without an account, and without cookies other than the ones the site needs to work.
- We use no analytics, no advertising and no tracking pixels, and we do not sell or rent personal data.
- Stripe takes payments. We never see your full card number.
- We log every request for security, and keep those logs for 90 days. The [security logging](/legal/privacy#security-logging) section says exactly what is in them.
- You can export your data as JSON and delete your account from your account page.

## What we collect

### When you browse

Every request is recorded in our security logs, whether or not you are signed in. See [security logging](/legal/privacy#security-logging).

### Your account

| Data | Where it comes from |
| ---- | ------------------- |
| Email address, display name, handle | You, at sign-up and in your settings |
| Password, stored only as an Argon2id hash | You, if you use a password |
| Name, email address and account id from Google or GitHub | That provider, if you sign in with it |
| Passkeys: a credential id, its public key, a name for the device and when it was added | Your device. We never receive your fingerprint, face or the private key |
| Two-factor: the shared secret for your authenticator app, and your recovery codes | Created when you turn two-factor on |
| Sessions: a session id, the browser and device it came from, its IP address, when it started and was last used | Each sign-in. You can see and end them in your account |
| Avatar | You, if you upload one |
| Which version of the Terms you accepted, and when | Sign-up, and each later version you accept |

### Agents and keys

| Data | Where it comes from |
| ---- | ------------------- |
| Agents you have authorized: the agent's client id, name and metadata domain, the scopes you granted, the spending cap, and when you consented | The OAuth consent screen |
| What each agent has spent under its cap | Agent purchases |
| Access and refresh tokens issued to those agents | The authorization server |
| Personal API keys, stored as a keyed hash, with their visible prefix and when each was last used | You, when you create a key |

### What you do on Listed

- Watchlists, filing alerts and saved screens.
- Research notes and their image and PDF attachments, and whether a note is shared by link.
- League memberships, forecasts and every saved version of them before the lock, your reasoning and when it is shown, scores, badges and your public profile setting.
- Comments you post, ratings you give, reports you send (with any note), and the links in member posts you open through our exit page. Each is kept with the id of the request that made it, which joins it to the security details below.
- Holdings files you import (CSV or OFX). We use the tickers in them to build a watchlist. An OFX file from a bank or broker can also contain account numbers and balances. We do not use those, and you can remove them before uploading.

### Payments

Stripe processes all payments on its own pages. We receive from Stripe a customer id, what you bought, the amount, the payment status, refunds and disputes, and basic card details: the brand, the last four digits, the expiry date and the country that issued the card. We use these to show you your purchases, switch paid features on and off, and detect card testing. We never receive or store your full card number or security code.

### Messages and email

- What you send through the contact form or a data-correction request: your name and email if you give them, and your message.
- Reports you send to our security, privacy, legal or copyright addresses.
- If you sign up for the daily digest without an account, your email address.
- Delivery records from our email provider, such as bounces and complaints.

### What we do not collect

No analytics or advertising cookies. No third-party trackers. No data bought from brokers. No location beyond the country our CDN associates with your IP address. Listed does not show you advertising.

## Why we use it, and on what legal basis

Where data protection law such as the GDPR or UK GDPR applies, we rely on these legal bases:

| Purpose | Legal basis |
| ------- | ----------- |
| Running your account and the features you use: watchlists, alerts, notes, leagues, exports | Performing our contract with you (the [Terms of use](/legal/terms)) |
| Taking payments, switching Pro and export packs on and off, refunds | Performing our contract with you |
| Showing your forecasts, reasoning and the discussion on them publicly | Your choice to turn on a public profile, which you can turn off |
| Showing your comments and counting your ratings | Performing our contract with you, and our legitimate interest in keeping the discussion honest |
| Sending the daily digest to someone without an account | Your consent, which you can withdraw with the unsubscribe link |
| Security logging, preventing fraud and abuse, enforcing rate limits and spending caps | Our legitimate interest in keeping the service and its members secure |
| Answering messages, correction requests and reports | Our legitimate interest in running the service, or a legal obligation |
| Keeping tax and accounting records, and answering lawful requests | Legal obligation |

Some decisions are made automatically: a lockout after repeated failed sign-ins, a refused agent purchase that would pass its cap, and league scores. None of them has a legal or similarly significant effect on you. If you think one was wrong, write to privacy@listed.markets and a person will look at it.

## Who can see what

- **Everyone:** your display name, handle and avatar wherever you appear; your comments, wherever you post them; your forecasts, reasoning, scores and badges, if you turn on a public profile. With a public profile, your reasoning is published as soon as you save it unless you choose to seal it until the lock, and others see that you have forecast an open target, and when, but not your figures until it locks.
- **Anyone with the link:** a research note you share by link, and its attachments.
- **Only you:** your email address, watchlists, alerts, saved screens, private notes, imported holdings, agents, keys and purchases.

Public content can be read by anyone, including other people's agents, through the site, the API and the MCP server.

## Who we share data with

We share personal data only with the providers that run parts of the service for us, under contracts that limit what they can do with it:

| Provider | What for | What they receive |
| -------- | -------- | ----------------- |
| Stripe | Payments, subscriptions, the billing portal, tax calculation | Your email address and the payment details you enter on Stripe's pages |
| Amazon Web Services | Hosting, our CDN, databases, file storage, malware scanning of uploads, sending email | All data the service holds, stored in the United States |
| Google or GitHub | Signing in, only if you choose it | They already know you; we receive your name, email and account id |
| Pwned Passwords (Have I Been Pwned) | Checking whether a new password has appeared in a known breach | The first five characters of a hash of the password, never the password or your email |

We also disclose data when the law requires it, to protect people's safety, or to defend legal claims. If the service is transferred to another business, your data goes with it under this policy, and we tell you first.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

## International transfers

The service is hosted in the United States. If you use it from elsewhere, your data is transferred to the United States. Where the law requires a safeguard for that transfer, we use one recognised by the law that applies, such as the European Commission's standard contractual clauses or the UK's international data transfer addendum.

## How long we keep it

| Data | How long |
| ---- | -------- |
| Your account and everything in it | Until you delete it, or delete your account |
| Deleted data in database backups | Up to 7 days, until those backups expire |
| Sessions | Until you sign out, the session expires, or you sign out everywhere |
| Agent consents and tokens | Until you revoke them or they expire. The consent and spending record stays with your account |
| Uploaded files that pass our checks | Until you delete them, or delete your account |
| Uploaded files that fail our checks | 30 days, for security review, then deleted |
| Purchase and refund records | As long as tax and accounting law requires |
| Messages, correction requests and reports | Until resolved, then up to 12 months |
| Digest subscription without an account | Until you unsubscribe |
| Security logs, security events and admin actions | 90 days, as set out below |

When you delete your account, your forecasts, reasoning, comments, ratings and reports are deleted, along with the comments others left on your forecasts, they are removed from leaderboards and profiles, and your shared notes stop working.

## Security logging

We log every request to Listed, and certain security events, to protect the service and the people who use it. This section is the full list.

### What each request record holds

- the time, a request id, the method (such as GET or POST), the host and the path;
- the query string, with secret parameters (such as tokens, codes, keys and passwords) removed;
- the response status, the size of the request and of the response, and how long the response took;
- the referrer, if your browser sent one;
- our CDN's own id for the same request;
- your IP address, as our CDN received it;
- the country and the network (its autonomous system number, or ASN) that our CDN associates with that IP address;
- the user agent your browser or client sent, and the fingerprint of its TLS connection (JA4);
- if you are signed in, your account id, which is an opaque number and never your email address; if an agent made the request, its OAuth client id and the scopes it holds;
- whether the request carried an agent signature (Web Bot Auth), whether that signature verified, which agent signed it, and which agent the user agent claims to be.

### Security events

We also record these events, each with the same request details:

- sign-in failures, with the email address that was tried stored only as a keyed hash, never in plain text;
- successful sign-ins, and whether the device was new;
- account and IP lockouts, wrong two-factor codes, and password reset requests;
- agent consents granted or declined, and tokens issued;
- every MCP tool call, and calls refused for lack of a scope;
- rate-limit hits;
- rejected uploads, with the reason;
- suspicious input: stored text that matches rules for known attacks, with its first 200 characters kept as sent;
- payment declines and disputes, and agent purchases refused because they would pass the cap;
- content held for moderation;
- comments and reasoning posted or deleted, ratings given, reports sent, links in member posts opened through our exit page, and rating patterns our hourly check flags.

### Admin actions

Every action our staff take in the operations console is logged: who did it, what they did, when, and from where.

### Why

For security, abuse prevention and service integrity: to detect, investigate and learn from attacks such as credential stuffing, card testing, account takeover and scraping beyond our published limits; to enforce rate limits and spending caps; and to check that the service is working correctly. Our legal basis is our legitimate interest in keeping the service and its members secure.

### At the edge

Before a request reaches our servers, it passes through our CDN, where Valor Security runs security checks on it, including on what you submit in forms. Those checks are covered by this section: the same purposes, the same access limits and the same retention.

### How long

Request logs, security events and admin actions are kept for 90 days, then deleted. The most recent 30 days can be searched. Older records are kept only in compressed raw form until they are deleted at 90 days. Our CDN's and load balancer's own logs are kept for the same 90 days.

### Who can see them

Access is limited to Valor Security's security staff, who must sign in with two-factor authentication. Every access to the logs is itself logged. We do not use security logs for advertising or marketing, we do not sell them, and we disclose them only where the law requires it or to deal with a specific attack or fraud.

## Your rights

Depending on where you live, you have rights over your personal data. You can:

- **see it:** ask for a copy of the data we hold about you;
- **take it with you:** download your data as JSON from your account page at any time;
- **correct it:** change most of it in your settings, or ask us;
- **delete it:** delete your account from your account page. That removes your data, apart from what we must keep by law (such as purchase records) and security logs, which expire on their 90-day schedule;
- **object or restrict:** object to processing based on our legitimate interests, or ask us to restrict it;
- **withdraw consent:** turn off your public profile, or unsubscribe from the digest, at any time;
- **complain:** to the data protection authority where you live or work.

For anything you cannot do from your account page, write to privacy@listed.markets. We reply within 30 days, and tell you if the law allows us longer and we need it. We may ask you to confirm your identity first.

**US state privacy rights.** If a US state privacy law applies to you, you have the rights it gives, including to know, delete and correct personal data. We do not sell personal data or share it for cross-context behavioural advertising, so there is nothing to opt out of. We honour Global Privacy Control signals all the same. We will not treat you differently for using your rights.

## Children

Listed is not for children under 13, and we do not knowingly collect their personal data. Paid features and agent purchases require the account holder to be at least 18. If you believe a child under 13 has an account, tell us at privacy@listed.markets and we will delete it.

## How we protect data

Passwords are hashed with Argon2id. Two-factor authentication and passkeys are available to every member. API keys and the email addresses in failed sign-in records are stored as keyed hashes. All traffic is encrypted in transit. Uploaded files are checked and scanned before anyone else can see them, and are served from a separate domain. No method is perfect, so if you find a weakness, please report it under our [vulnerability disclosure policy](/legal/vulnerability-disclosure).

## Changes to this policy

Each version of this policy is dated. If we make a material change, we tell members by email and on the site before it takes effect.

## Contact

- Data controller: Valor Security ([registered name, to be confirmed])
- Address: [registered address, to be confirmed]
- Email: privacy@listed.markets

Other documents: [/legal.md](/legal.md)