--- title: "Privacy Policy — MoneyTrees" description: "How MoneyTrees collects, uses, shares and protects your information: OAuth account data, optional X data, subprocessors, retention and your rights." canonical: https://moneytrees.ai/privacy last-updated: 2026-11-03 --- # Privacy Policy Last updated October 27, 2026 This Privacy Policy explains how moneytrees.ai (“MoneyTrees”, “we”, “our”) collects, uses, shares, and protects information when you use the Service at moneytrees.ai. By using the Service you agree to this Policy. If you do not agree, do not use the Service. MoneyTrees is operated as a personal project by an individual based in California, United States. For purposes of GDPR, we act as the data controller for the personal data described below. ## 1\. Information we collect We collect only what is required to run the Service. We do not buy data, and we do not sell or rent your personal information. **(a) Account identifiers from your OAuth provider** - **Google sign-in** — email address, display name, profile image, and the Google account ID. We request only the minimum scopes needed for sign-in (`openid`, `email`, `profile`). - **X (Twitter) sign-in** — numeric user ID, username, display name, profile image. With your explicit consent, we also read tweets, bookmarks, and likes (scopes: `tweet.read`, `users.read`, `bookmark.read`, `like.read`, `offline.access`) to surface ticker mentions inside the app. We never post, like, follow, or DM on your behalf. **(b) Content you submit**: watchlists, alert configurations, chat prompts sent to the in-app assistant, paper trade orders, and account preferences. **(c) Technical data**: a session cookie or local-storage token issued by Convex Auth to keep you signed in, and standard server logs (IP address, user-agent, timestamp, request path) retained for up to 30 days for security and debugging. **(d) Subscription status**: when paid features are active, our billing partner (Stripe) shares only whether your subscription is active, tier, and renewal date. We never receive full card numbers or banking details. ## 2\. Legal bases for processing (GDPR) - **Contract** — to deliver the features you sign up for (sign-in, watchlists, alerts, paper trading). - **Consent** — for optional scopes (X read-access to bookmarks/likes). You may withdraw consent at any time by revoking the X app authorization at [x.com/settings/connected\_apps](https://x.com/settings/connected_apps) and deleting the X linkage in your MoneyTrees settings. - **Legitimate interest** — minimal server logging for security, abuse prevention, and debugging. - **Legal obligation** — to comply with applicable law. ## 3\. How we use information - To authenticate you and maintain your session. - To compute trend, sentiment, and mention metrics for tickers you follow. - To deliver alerts you configure. - To operate optional autonomous trading agents in Alpaca’s paper-trading environment when you enable them. - To prevent abuse, fraud, and violations of these Terms. We do not use your personal data for advertising, profiling for third parties, or training third-party AI models. ## 4\. Google API Services User Data Policy — Limited Use MoneyTrees’s use of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: - We use Google user data only to provide and improve the in-app features you signed up for. - We do not transfer Google user data for advertising. - We do not sell or rent Google user data. - We do not allow humans to read Google user data unless we have your explicit consent, it is required for security investigations, to comply with applicable law, or the data has been aggregated and anonymized. ## 5\. X (Twitter) developer obligations Our use of X data follows the X Developer Agreement and Developer Policy. We honor user deletions originating from X (deleted tweets, revoked tokens) and do not combine X data with unrelated datasets without your consent. You can revoke MoneyTrees’s access at [x.com/settings/connected\_apps](https://x.com/settings/connected_apps); doing so stops further ingestion and we delete cached X content within 30 days. ## 6\. Sharing & subprocessors We share data only with the service providers we need to operate MoneyTrees. Each is bound by their own privacy terms. - **Convex** (convex.dev) — backend, database, and authentication storage. Data center: United States. - **Vercel** (vercel.com) — static hosting and edge delivery. Data center: global edge network. - **Vercel AI Gateway** — routes your in-app chat prompts to the model provider you selected (Anthropic, OpenAI, or Google). Prompt content is processed by the selected provider in accordance with their terms. - **Google LLC** — OAuth identity verification when you choose Google sign-in. - **X Corp.** — OAuth identity verification and authorized read-access to your X content when you choose X sign-in. - **Alpaca Securities LLC** — paper-trading order routing. No live funds. - **Stripe** — subscription billing (only if you subscribe). - **PostHog** — product analytics and error reports. - **X Corp. and Reddit, Inc.** — advertising pixels that tell us when a visit from one of our ads leads to a sign-up or a subscription. See section 10. We may disclose information if required by law, valid legal process, or to protect the rights, safety, or property of MoneyTrees, our users, or the public. ## 7\. International transfers MoneyTrees is operated from the United States and our primary subprocessors store data in the United States. If you access the Service from the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to and processed in the United States. We rely on [Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) and equivalent safeguards offered by our subprocessors for these transfers. ## 8\. Retention - **Account data** — retained while your account is active. - **Cached X content** — deleted within 30 days of you revoking X access. - **Server logs** — up to 30 days, then deleted or anonymized. - **Chat history** — retained until you delete a conversation or your account. - **After account deletion** — data is removed within 30 days, except where retention is required for legal, accounting, or fraud-prevention purposes (typically up to 7 years for financial records). ## 9\. Your rights Regardless of where you live, you have the following rights: - **Access** — request a copy of the personal data we hold about you. - **Rectification** — ask us to correct inaccurate or incomplete data. - **Erasure** (“right to be forgotten”) — ask us to delete your account and associated data. - **Portability** — receive your data in a machine-readable format. - **Restriction or objection** — ask us to limit or stop certain processing. - **Withdraw consent** — at any time, for the processing that depends on consent (without affecting prior processing). **EEA / UK / Swiss residents** may lodge a complaint with their local supervisory authority if they believe we have violated applicable data-protection law. **California residents** have additional rights under the California Consumer Privacy Act / California Privacy Rights Act, including the right to know the categories and specific pieces of personal information collected, the right to delete, the right to correct, the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights. **We do not sell personal information. We “share” it, as the CCPA / CPRA defines the term, only through the advertising pixels in section 10, and a browser that sends Global Privacy Control never loads them.** A verifiable consumer request may be made by emailing [privacy@moneytrees.ai](mailto:privacy@moneytrees.ai); we will respond within 45 days as required by law. To exercise any right, email [privacy@moneytrees.ai](mailto:privacy@moneytrees.ai) from the address tied to your account. Account deletion is also available in-product under Settings. ## 10\. Cookies & local storage We use strictly-necessary cookies and local-storage entries to keep you signed in and preserve your session; disabling these will prevent you from signing in. We also use PostHog for product analytics, and the X and Reddit advertising pixels, which set their own cookies and tell those platforms when a visit from one of our ads leads to a sign-up or a subscription. To opt out of the advertising pixels, turn on Global Privacy Control in your browser. ## 11\. Security All traffic to moneytrees.ai is encrypted in transit (HTTPS / TLS 1.2+). Data at rest is encrypted by our subprocessors. Access to production systems is restricted, logged, and protected by 2FA. Despite our safeguards, no internet transmission is 100% secure. If we become aware of a personal-data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours where required by law. ## 12\. Children The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected data from a child, email [privacy@moneytrees.ai](mailto:privacy@moneytrees.ai) and we will delete it. ## 13\. Automated decision-making Optional autonomous trading agents make paper-trading decisions on your behalf when you enable them. These decisions are simulated, do not move real money, and can be paused or disabled at any time. They are not used to take legal or significant decisions about you within the meaning of GDPR Article 22. ## 14\. Changes We will update the “Last updated” date when this Policy changes. Material changes will be announced in-product. Continued use after the effective date constitutes acceptance. ## 15\. Contact - Privacy questions / data-subject requests: [privacy@moneytrees.ai](mailto:privacy@moneytrees.ai) - Legal / terms: [legal@moneytrees.ai](mailto:legal@moneytrees.ai) - Questions about autonomous agents: [agents@moneytrees.ai](mailto:agents@moneytrees.ai)