Privacy policy
This page explains what ALPHA collects when you visit seewhatothersdont.com, ask for access, or use the terminal, and what we do with it. We have tried to write it the way we build the product: specific, and without anything we cannot back up.
Who we are
ALPHA is operated by Victor Lafforgue, an independent trader (trabalhador independente) registered in Portugal, tax number (NIF) To be completed: NIF, professional address To be completed: professional address in Portugal. For the purposes of data protection law (the EU and UK General Data Protection Regulation), we are the controller of the personal data described here. You can reach us about privacy at To be completed: privacy contact email.
The short version
- We collect what we need to run the site and the terminal, and what you choose to enter.
- Analytics run only if you press Accept on the cookie banner. Decline, and nothing loads.
- Your account and the data you enter are stored in the EU (Ireland) and on our server in Germany.
- We do not sell your data, we do not run advertising, and we do not share your data with advertisers.
- You can ask for a copy of your data, a correction, or its deletion at any time.
What we collect
When you visit the site
Our web server records standard request logs: your IP address, the page requested, the date and time, the browser's user agent string and the referring page. We use them to keep the service running, to investigate errors and to defend against abuse. They are not used for marketing and not combined with analytics.
Analytics, only with your consent
If you press Accept on the cookie banner, we load PostHog, an analytics service, from its EU cloud (requests pass through our own domain on their way there). It then records which pages you view, what you click, how far you scroll and which sections of the home page you reach, page speed measurements and any error the page runs into, along with your browser and device type and an approximate location derived from your IP address. It may also record your session (how the page looked and where you moved and clicked) so we can see where the site confuses people: everything you type into a field is masked before it leaves your browser and is never recorded. PostHog stores a random identifier in your browser so that visits can be counted. We do not attach analytics to your name or email. If you press Decline, or make no choice, the analytics code is never downloaded. You can change your choice at any time with "Cookie settings" at the bottom of every page.
When you request access
The request access form asks for your email address and, if you want to give them, your name, the plan you are considering and a short note. We use these only to reply to you about access. To keep the form free of automated spam we check how quickly it was filled, include a hidden field that people never see, and limit how many requests one network can send. If we switch on Cloudflare Turnstile, a spam check by Cloudflare, it runs on the form page and Cloudflare processes technical data about your browser to tell people from bots.
When you create an account
You sign in to the terminal with an emailed sign-in link or with your Google account. We store your email address and, with Google sign-in, the basic profile Google shares with us (your name and profile picture). We also store your subscription plan and its status.
What you enter in the terminal
The terminal saves what you choose to put into it, so that it is there the next time you sign in:
- portfolios and positions, watchlists, and your calendar plans;
- trades you record and trade files you import;
- your journal, including the daily check-ins, which can hold self-reported scores such as sleep, focus and stress;
- in live rooms: your membership, invite codes, and the messages and trade callouts you post. Voice, video and screen sharing pass in real time through a media server we run on our own server in Germany. ALPHA does not record calls.
Treat what you post in a room as visible to the other members of that room. Journal check-ins are private to your account.
Payments
When paid plans are live, payments are handled by Stripe. Your card details go directly to Stripe; we never see or store your full card number. Stripe tells us your subscription status and the details it shares with merchants, such as the card brand, the last four digits and your billing country, and we keep invoices and payment records as tax and accounting law requires.
Emails
Sign-in links are sent by our authentication provider, Supabase. We send you service emails about your account and your subscription. We will only send marketing emails if you have agreed to them, and every one will carry an unsubscribe link.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running your account, storing what you enter, providing your plan | Performance of our contract with you |
| Replying to an access request | Steps you asked us to take before a contract |
| Server logs, spam and abuse prevention, security | Our legitimate interest in a safe, working service |
| Analytics | Your consent, which you can withdraw at any time |
| Invoices and payment records | Legal obligation (tax and accounting) |
Where your data lives
Accounts and everything you enter in the terminal are stored in a Supabase database hosted in the EU, in the AWS eu-west-1 region (Ireland). The site, the terminal and the live room media server run on a server we rent from Hetzner in Germany, which is also where the server logs are kept. PostHog analytics, if you accept them, are stored in PostHog's EU cloud.
Some providers, such as Stripe, Google (for Google sign-in) and Cloudflare (if Turnstile is switched on), may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the European Commission's standard contractual clauses or the EU to US Data Privacy Framework, as set out in each provider's data processing terms.
Who processes it for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts, sign-in emails, the terminal's database, access requests | EU (Ireland) |
| Hetzner | The server that runs the site, the terminal and live rooms; server logs | Germany |
| PostHog | Analytics, only after you accept | EU |
| Stripe | Payments and subscriptions, once paid plans are live | EU and United States |
| Sign-in, only if you choose Continue with Google | Global | |
| Cloudflare | Turnstile spam check on the request form, only if switched on | Global |
We share personal data with no one else, except where the law requires it (for example a valid request from a court or a tax authority).
How long we keep it
The periods below are our proposal and will be confirmed before launch. To be completed: owner to confirm each period
- Server logs: up to 30 days.
- Access requests: until we have replied, and at most 12 months after your last message.
- Account data and what you enter: for as long as your account exists. When you delete your account, or ask us to, we delete it within 30 days, apart from backups that expire on their own schedule.
- Analytics: up to 12 months, then deleted or kept only in aggregate.
- Invoices and payment records: for the period tax and accounting law requires.
Cookies and local storage
The site itself sets no cookies. It keeps your cookie banner choice in your browser's local storage, so that we do not ask again on every visit. Everything else depends on what you do:
| Name | What it does | When |
|---|---|---|
| alpha.consent.v1 | Remembers whether you accepted or declined analytics (local storage) | After you choose; kept until you change it or clear your browser |
| ph_*_posthog | PostHog's random visitor identifier (cookie and local storage) | Only after you accept analytics; removed when you decline |
| Supabase session | Keeps you signed in to the terminal (local storage) | Only in the terminal, after you sign in; strictly necessary |
| Terminal preferences | Remembers settings such as your active watchlist (local storage) | Only in the terminal; strictly necessary |
Your rights
Under the EU and UK GDPR you have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- restrict or object to how we use it;
- receive the data you gave us in a portable format;
- withdraw your consent to analytics at any time, without affecting what happened before.
Write to To be completed: privacy contact email and we will answer within one month. You also have the right to complain to a data protection authority, in particular in the country where you live or work. Our lead authority is the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
Security
The site is served only over HTTPS. Database access is limited by row-level security, so each account can read and change only its own data, and server-side keys never reach your browser. No system is perfectly secure; if a breach affecting your data occurs, we will tell you and the authorities as the law requires.
Children
ALPHA is for adults. It is not meant for anyone under 18, and we do not knowingly collect their data.
Changes to this policy
When we change this policy we will update the date at the top. If a change matters, we will tell account holders by email before it takes effect.
Contact
Questions about this policy or your data: To be completed: privacy contact email, or by post to To be completed: professional address in Portugal. See also our terms and conditions.