Privacy Policy

Last updated: August 8, 2026. SuMarket is operated by SuMarket LLC, a limited liability company registered in the State of Indiana, with its principal place of business in Bloomington, Indiana 47401.

SuMarket is intended for users 18 years of age or older. By using this service, you confirm you are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.

• Account information — when you sign in with Google, we receive your name, email address, profile picture, and Google user ID. When you sign in with Apple, we receive your Apple user ID and, on first sign-in only, your name and email address (Apple does not share this on subsequent logins). We store your user ID and email server-side to link your account data and manage your subscription. We do not store your password.
• Usage data — briefings you generate (sector, timestamp), reading streaks, total briefings read, sectors explored, time-of-day reading patterns, AI study-tool usage (to enforce the free plan's one-run-per-day limit), and progression data — XP points, streak freezes, course and flashcard progress, and your personal glossary's review schedule.
• Saved briefings — content and timestamps of briefings you favorite.
• Sura conversations — if you use Sura, our in-app AI assistant, we store the questions you send, the answers it returns, the sources it cited, which tools it ran, and any thumbs-up/down feedback you leave. Conversations are stored so you can return to them, and are tied to your account. See section 7a for how they are processed and section 10 for how long they are kept.
• Portfolio data — stock ticker symbols and optional share counts you manually add to your self-reported portfolio. We do not link to any brokerage account; all holdings data is self-entered. Optionally, you may import holdings by uploading a screenshot of a brokerage or portfolio app (requiring camera or photo library access on iOS) — the image is processed by an AI provider to extract ticker/share data, is not stored after processing, and the extracted data is shown to you for review before it is saved to your portfolio.
• Following list — market topics, sectors, or companies you choose to follow via the Following feature.
• Subscription data — your plan status (free or Pro), subscription ID, and billing period dates. We store only the subscription status and metadata — we do not store your payment card details. Payment processing is handled by Stripe, Inc. on the web and by Apple (via RevenueCat) for in-app purchases; see section 5.
• Browser and device storage — your selected sector is stored locally in your browser. If not signed in, saved favorites are also stored locally only. The SuMarket iOS app is a native application; it stores your sign-in token, your language and appearance settings, and a cached copy of the most recent brief on the device itself, and everything else server-side.
• IP address — we briefly process your IP address to prevent abuse of certain features (for example, limiting how many verification emails or briefings can be requested in a short period). Your IP address is used only for this rate-limiting purpose, is not stored as part of your account record, and expires automatically after a short window.

We do not collect Social Security numbers, government IDs, precise geolocation, or payment card information.

• To provide the service: generating briefings, managing your account, and processing your subscription.
• To personalize your experience: reading streaks, XP, saved briefings, your personal glossary, statistics, and briefing preferences.
• To verify your subscription status and enforce plan access — reading is free and unmetered on both plans; free accounts get one AI study-tool run per day and up to 5 followed subjects and companies combined, and Pro accounts get the study courses, the study tools without the daily limit, Sura on a monthly credit allowance, up to 15 follows, filings and earnings alerts, and paper trading.
• To improve and operate the service, diagnose technical issues, and prevent abuse.
• To communicate with you about your account, subscription, or service updates.
• We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

SuMarket Pro can be purchased on this website or in the iOS app. Purchases made on the website are processed by Stripe, Inc.; purchases made in the iOS app go through Apple's In-App Purchase system and are managed via RevenueCat (see section 6). In neither case does SuMarket LLC receive or store your full card number, CVV, or bank details — we receive only a customer or subscription identifier and a status. Stripe retains payment data subject to its own privacy policy at stripe.com/privacy.

SuMarket uses a secure session cookie to keep you signed in for up to 30 days. We do not use advertising cookies, tracking pixels, or third-party advertising or cross-site tracking. Your session cookie is HTTP-only, secure in production, and contains no sensitive personal data.

We do use privacy-preserving, cookieless product analytics provided by Vercel (Vercel Web Analytics and Speed Insights) to measure page views, referring sites, approximate country, device and browser type, and page performance. These do not set cookies, do not follow you across other websites, and do not build an advertising profile. They are used to understand which parts of the product are used and to find pages that are slow or broken.

SuMarket is available as an iOS application distributed through the Apple App Store. The iOS app is a native application that communicates with the same service described in this policy (sumarket.info) over its API. All data collection, storage, and processing described above applies equally to use of the iOS app. The app additionally asks your permission before sending push notifications, and may store a device push token so we can send the alerts you have enabled. On iOS, SuMarket Pro may instead be purchased through Apple's In-App Purchase system, processed by Apple and managed via RevenueCat, a subscription-management platform: your subscription status, product ID, and renewal date are shared with SuMarket to grant access, using your existing SuMarket account ID (not Apple's own anonymous purchaser ID) so the purchase can be tied to your account. SuMarket LLC never receives your Apple ID, card, or bank details — that payment data is held by Apple. RevenueCat's own privacy policy governs its processing of subscription events. Apple may also collect additional device-level data (crash reports, performance metrics) subject to Apple's own privacy policy.

We use trusted service providers to operate SuMarket. These providers may process limited account, usage, subscription, technical, or briefing-request data only as needed to provide, host, secure, authenticate, bill for, support, and improve the service.

• Authentication providers (Google, Apple) — to securely sign you in and verify your account.
• Payment processors — Stripe (web) and Apple/RevenueCat (iOS In-App Purchase) — to process subscriptions, refunds, taxes, fraud prevention, and billing records.
• Cloud hosting, database, and security providers — to run the website, store account and usage records, and protect the service.
• Content generation, data enrichment, and market information providers — to create briefings, retrieve relevant market or news context, and (if you use the optional portfolio screenshot import feature) extract ticker and share data from an uploaded image.
• Product analytics and performance monitoring (Vercel) — cookieless measurement of page views and page performance, as described in Section 5.
• Customer support and operational tools — to respond to requests and operate the service.

We do not sell your personal data, and we do not authorize service providers to use your personal data for their own advertising. Our AI content-generation providers are contractually and technically restricted to processing your data solely to generate the briefings and tool outputs you request — not for any other purpose. We may disclose information when required by law, to enforce our terms, or to protect SuMarket, users, or the public.

Sura is an optional assistant available to Pro subscribers. It is worth describing separately because, unlike the rest of the service, what it processes is text you write yourself.

• What is sent to AI providers — your question, recent messages in the same conversation, and context assembled on our servers about what you were reading: the briefing, company, or deal page you had open, the subjects and companies you follow, and terms from your personal glossary. This context is rebuilt on each turn from your account rather than stored inside the conversation. Your email address and payment details are never sent.
• Which providers — Google (Gemini models) as the default, with Anthropic (Claude models) as a fallback when a request fails or returns unusable output. Both are bound by the same restriction described above: they process this data only to produce the answer you asked for.
• Web search — if answering needs current information, Sura may send a search query to Tavily, a third-party search API. The query is derived from your question and is not accompanied by your identity, your account, or your holdings.
• What we store — your messages and Sura's replies, the sources cited, a record of which tools ran, and per-request usage counts used to enforce your monthly credit allowance. Tool records deliberately store only the arguments the model proposed, not the account data the tool then read, so our diagnostics do not become a second copy of your watchlist.
• Do not send sensitive information — Sura is a study and research assistant. Please do not send account numbers, government identifiers, passwords, or health information in a conversation, and note that SuMarket does not provide personalized investment advice.

SuMarket is operated from the United States and is directed only to users in the United States, as stated in our Terms of Service. Your personal data is processed and stored in the United States by SuMarket LLC and the service providers described in Section 7.

We do not market or offer SuMarket in the European Economic Area, the United Kingdom, or Switzerland, and we have not appointed a representative under Article 27 of the GDPR. If you access SuMarket from outside the United States on your own initiative, your data will be transferred to and processed in the United States, whose data-protection laws differ from those of your home country. Wherever you are, you may ask us to access, correct, export, or delete your personal data using the routes in Section 11, and we will honour that request — those routes are open to everyone, regardless of what law applies to you.

Several U.S. states — including California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Utah — give residents specific rights over their personal information. Rather than administer a different policy per state, we extend the following rights to every SuMarket user in the United States:

• The right to know what personal information we collect about you, where it came from, why we process it, and who we share it with. Section 2 lists the categories we collect (identifiers such as your email and user ID; commercial information such as your subscription status; internet and usage activity such as the briefings you read and the tools you run; and the content you write to Sura). We collect it from you and from your sign-in provider, and from nobody else.
• The right to access and to obtain a portable copy of your personal information.
• The right to correct inaccurate personal information.
• The right to delete your personal information — available directly in the product, see Section 11.
• The right to opt out of the sale or sharing of personal information, and of targeted advertising and profiling. We do none of these, so there is nothing to opt out of: we do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for automated decisions that produce legal or similarly significant effects. Because we do not sell or share, we do not act on opt-out preference signals such as Global Privacy Control — not because we ignore them, but because the outcome they ask for is already our default.
• The right not to be discriminated against for exercising any of these rights. We will not deny you the service, charge you a different price, or give you a lower quality of service because you made a privacy request.
• The right to appeal. If we decline a request, we will tell you why, and you may appeal by replying to that decision or writing to contact@sumarket.info with the subject line “Privacy Appeal”. We will respond to an appeal within 45 days. If we deny the appeal, you may contact your state Attorney General.

To exercise any of these rights, use the Delete Account option in your Profile or contact us at contact@sumarket.info. We will verify your request against the email address on your account. You may use an authorised agent to make a request on your behalf; we will ask the agent for written proof of your authorisation and may ask you to confirm it directly.

• Usage, reading and streak records — up to 400 days.
• Subscription status records — the duration of your subscription plus 90 days.
• Sura conversations, their sources and their usage counts — until you delete your account.
• Saved briefings, your glossary, study progress, portfolio and following list — until you remove them or delete your account.
• Rate-limiting records tied to an IP address — a short rolling window, measured in minutes to hours, after which they expire automatically.

Operational backups. We take a nightly encrypted snapshot of durable account data so that a failure or a bad deployment cannot cost you your streak, your glossary, or your subscription record. Snapshots are kept on a rolling 14-day cycle and are overwritten in the ordinary course. Deleting your account removes your data from our live systems immediately; a copy may remain in an unexpired backup for up to 14 days. Backups are not used to restore a deleted account and are not accessed except to recover from a system failure.

You may request deletion of all personal data at any time by contacting us or by using the Delete Account option in your Profile, on the web or in the app. We will process deletion requests within 30 days.

You have the right to access, correct, export, or delete your personal data. You may delete your account directly from your Profile — on the website at sumarket.info/profile or in the SuMarket app — this immediately and permanently removes your usage history, favorites, streak and XP records, your personal glossary, display name, mood history, portfolio, following list, study and course progress, your Sura conversations and their usage records, and your subscription record. To exercise any other rights, contact us at contact@sumarket.info. We will respond within 30 days.

We use industry-standard security practices including HTTPS encryption, HTTP-only session cookies, encrypted backups, and access-controlled server infrastructure. We do not store passwords — sign-in is handled by Google or Apple — and we do not store payment card details. No system is 100% secure; we cannot guarantee absolute security of your data.

If we discover a breach of security affecting your personal data, we will notify you by email at the address on your account, and notify regulators, as required by applicable law and without unreasonable delay. Our notice will describe what happened, what data was involved, and what you can do.

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the date at the top of this page. Continued use of SuMarket after changes constitutes acceptance of the updated policy.

This Privacy Policy is governed by the laws of the State of Indiana, United States, without regard to its conflict of law provisions.

SuMarket LLC · contact@sumarket.info · 619 980 1185 · Bloomington, IN 47401