Privacy policy
In force from 10 October 2026. The short version: we keep your e-mail and what you paid for, nothing else about you, and we do not sell it or show you advertising.
Who we are
This site, spyforecast.com, is run under the name SpyForecast by Sayed Mohdy, Calgary, Alberta, Canada. When this page says “we”, it means SpyForecast. You can reach us on the support page, or at support@spyforecast.com.
What we keep, and why
| Your e-mail address | To have an account and to know who you are when you sign in. If you sign in with Google, the address comes from Google. |
| Your password | Never kept as you typed it. We keep only a salted one-way hash (scrypt), which we cannot turn back into your password. An account that signs in with Google has no password here. |
| Your Google identifier | Only if you use “Continue with Google”: the number Google gives your account, so the next sign-in finds the same account. We never see your Google password. |
| Your plan | Whether you are a member, monthly or yearly, the date you joined and the date your paid period ends, whether it renews by itself or ends on a given date; and any pass for the Viewer we gave you. This is how we know what to open for you. |
| Your Stripe references | The customer number and the subscription number Stripe gives your payment, so that a payment finds your account. Never your card number. |
| How you use the account | The last time you signed in or were seen (written at most every six hours), and how many files you downloaded and when. A request you send us from the account page, with the note you wrote. |
| A note of ours | Occasionally a line only we can read, for example “paid by bank transfer, 12 May”. |
| Your support messages | What you write on the support page and what we answer, kept with your account (or, for a visitor, with a secret held in the visitor’s browser), so that the conversation is there when you come back. If you leave an e-mail address there, we keep it with the conversation. |
| The web server’s log | The address your request came from, the page asked for, the time, the browser’s own description of itself, the site you came from and how much we sent. We keep it for 45 days, on our own server only. We use it to keep the site safe (for example to slow down someone trying thousands of passwords or to turn away automated programs), to count how many people and how many programs use the site, and to find faults. It is not shared, not sold and not used to follow you around. |
We do not keep your card number: payment is made on Stripe’s own page (see “Payments” below).
What we do not do
- No advertising, no advertising trackers, no analytics service, no “like” buttons.
- No scripts, fonts or images loaded from other companies: every page is served from spyforecast.com.
- We do not sell your details and we do not give them to anyone for their own use.
- We do not send marketing e-mail. When we write to you it is an answer to something you asked.
Cookies and what your browser keeps
- Sign-in cookie (
sf_session): set when you sign in, readable only by our server (HttpOnly), sent only to spyforecast.com, kept for up to 30 days and removed when you sign out. Without it you cannot stay signed in. - Google sign-in cookie (
sf_oauth): lives for ten minutes while you sign in with Google, then it is removed. - Your browser’s own storage: your list of starred tickers, the last ticker you opened, and your chart settings are kept in your browser on your device. They are never sent to us. Clearing the site’s data in your browser removes them.
Both cookies are needed for the account to work, so there is no cookie banner: we set nothing else.
Payments
A membership is paid through Stripe, an outside payment provider. The card or bank details are typed on Stripe’s own page and go to Stripe, not to us. Stripe tells us that a payment arrived, for whom and for which period, and when the subscription is cancelled or ends, and we record the plan and the paid-until date on your account. Because the plan renews automatically, Stripe keeps your card on file and charges it for each new period until you cancel. Stripe’s privacy policy covers what it keeps, including the checks it runs to prevent fraud.
Who else can see it
- Our hosting company, which runs the server this site sits on, and therefore holds the files described above on our behalf.
- Google, only when you choose “Continue with Google”: Google knows that you signed in to SpyForecast, as it does for any site you use it with.
- Stripe, only when you pay: it receives your e-mail address, the amount and your payment details.
- An authority, if the law requires us to hand something over.
How long we keep it
Your account stays as long as you want it. If you ask us to delete it, the e-mail, the hash, the plan record and the usage figures are removed from the account file. We may keep a plain record that a payment was made where tax or accounting rules ask for one. Server logs are kept only as long as they are useful for security and for finding faults, then they are rotated out.
Your rights
You can ask us, on the support page or at support@spyforecast.com, to tell you what we hold about you, to correct it, to give you a copy, or to delete it. Write from your signed-in account, so that we know the request is yours. If you forgot your password, the support page is the way: we reset it by hand. If you believe we mishandled your data you may also complain to the privacy authority where you live; in Canada that is the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
Safety
The site is served over HTTPS only. Passwords are hashed, the sign-in cookie cannot be read by scripts on the page, and the members’ data is not served to anyone who is not signed in with the plan. No system is perfect; if we ever learn that your details were exposed, we will write to you.
Children
The site is about trading and is not meant for anyone under 18. We do not knowingly keep the details of a child; if you think we do, write to us and we will remove them.
Changes
If this page changes in a way that matters, the date at the top changes with it. See also the terms of use.