Privacy Notice

Who is responsible

625 Technologies Inc. operates MirrorTape and is responsible for the information handled through this service. MirrorTape is intended for adults in the United States. This notice describes the current research workspace, public site, and support flow. Use our contact page to reach us about privacy or submit a privacy request.

Information you provide

Account information includes your email address, sign-in method, password hash when you choose a password, and account verification state. We also record acceptance of the account Terms. We do not store your password as readable text.

Workspace information includes symbols you add, planning preferences, optional name and address details, research notes, saved drafts, and interface or activity-sharing choices. Forms with a save indicator can store partial input before you submit the form. Passwords are excluded from draft saving.

Support information includes the email address, message, category if selected, request reference, and handling status. Messages and draft text can contain personal information you choose to include. Do not submit credentials, full payment-card details, government identification numbers, or confidential financial documents through these forms.

Information from connected services

When an enabled social sign-in provider is used, we receive an account identifier and available email information needed to identify your account. We do not automatically merge different accounts solely because their email addresses match.

If you connect an available brokerage-viewing integration, we store the connection information and encrypted authorization token needed to retrieve the permitted account view. Paper and live connections are separate. If paid billing is enabled and you choose it, Stripe processes checkout details; MirrorTape stores billing identifiers and subscription state rather than your full card number. Optional address suggestions send the text needed for a search to the configured provider after you enable that interaction.

Technical information and browser storage

Our hosting and delivery services process IP addresses, request details, device or browser information available in network requests, and security diagnostics. The application uses an IP-derived identifier for rate limiting. Operational logs help diagnose errors and abuse. Cloudflare provides delivery and network security and may process network reports and challenge information.

MirrorTape uses session cookies and browser storage for sign-in, the requested demo, display choices, and dismissible interface guidance. The demo is stored in your browser tab rather than copied into a private account. The current site does not include advertising pixels or optional marketing analytics scripts.

Why we use this information

We use information to provide requested features, save and retrieve your work, authenticate accounts, manage provider connections, process requests, communicate about your account when delivery is available, protect the service, diagnose failures, and comply with applicable law. We do not use your private notes to present fictional trader performance or customer testimonials.

When information is shared

Information is processed by infrastructure providers that host, secure, and deliver the service. Enabled providers process the information necessary for the feature you choose, such as sign-in or checkout. We may disclose information when required by law, to protect rights and account security, or as part of a business transaction with appropriate protections.

We do not sell personal information or share it for cross-context behavioral advertising. We do not make your private watchlist or notes public. If you opt in to community activity sharing, an activity record may contribute to a short-lived rounded aggregate shown only above a minimum threshold; it does not publish your name, email, or research symbols. You can turn that choice off in your workspace.

Retention and deletion

Workspace and account data remain in the service while needed to provide your account or handle a request. There is no automatic promise that inactive accounts or support cases disappear after a fixed number of days. Ask us to review or delete information through the privacy request route.

Application sessions expire after seven days; short-lived social sign-in state expires after ten minutes. Rate-limit records are removed by maintenance after their cleanup interval. Infrastructure logs rotate by size, and backup copies may remain after data is removed from the active database. Backup and legal or security retention can delay removal from every copy. We will explain applicable limits when handling your request rather than promise immediate erasure everywhere.

Your choices and requests

You can update workspace fields, remove research symbols, change display preferences, stop optional activity sharing, and revoke external permissions. You can request access, correction, account closure, or deletion through Contact by choosing Privacy. You can use this route without being able to sign in. We verify identity and authority before disclosing account information or making sensitive changes.

Depending on your state of residence and whether a particular law applies, you may have additional rights to know, obtain a copy, correct, delete, opt out of certain processing, appeal a decision, or act through an authorized agent. We do not penalize people for exercising applicable privacy rights. Tell us your state and the request you want to make; avoid sending identity documents in the initial message. Because we do not sell information or use cross-context advertising, there is no such activity for a browser opt-out signal to disable in the current product.

Security and external services

We use encrypted transport, access checks, password hashing, restricted secret access, and encryption for stored provider authorization tokens. No system can promise absolute security. External providers and linked sites follow their own practices. Cloudflare and other providers may process information outside your state or the United States as part of operating their networks.

Children

MirrorTape accounts are for adults age 18 or older. We do not knowingly seek personal information from children under 13. If you believe a child supplied personal information, contact us through the privacy route so we can investigate and address it.

Updates and contact

We will update this notice when the service's practices change and identify the new effective date. Material changes will be communicated as required. Contact 625 Technologies Inc. through the privacy request form with questions about this notice or how your information is handled.