Privacy Policy

Effective & last updated: October 10, 2026 (the markdown library now loads only when you open an investigation — see Section 3)

Alpha Desk (www.oxenberg.dev) is a public, read-only quantitative research dashboard, operated by an individual based in Israel. It publishes automated analysis of publicly traded companies for informational purposes; it is not investment advice. Reading the dashboard requires no account and collects no personal data from you beyond what your browser and our hosting provider exchange to serve the page. Since October 2, 2026 the site also offers an optional account ("My Desk") for keeping a personal watchlist. Only if you choose to sign in do we hold anything about you: your email address, your watchlist and any tickers you ask us to cover (Section 6). You can delete the account, and all of that with it, at any time from the account menu.

1. Who this policy covers, and which laws apply

Because Alpha Desk is operated from Israel, is published on the public internet, and can be read by visitors anywhere, more than one privacy regime is potentially relevant. We address the three most likely to matter directly, rather than making a vague global claim of compliance.

Israeli Privacy Protection Law, 5741-1981 (incl. Amendment 13) Primary — applies

This is the governing law, because the operator is an individual based in Israel and Israeli law does not require a "database" to be domestic-only to apply to its owner. Amendment 13 (in force since August 2025) strengthened the Privacy Protection Authority's enforcement powers, introduced mandatory data-breach notification, tightened the rules on database registration, and expanded individual rights (including a clearer deletion right and stronger limits on transferring data for direct-marketing purposes). For readers who do not sign in, Alpha Desk keeps no record of any kind. For account holders, it holds a small set of personal information — email address, watchlist and ticker requests, described in full in Section 6 — and the rights in Section 5 apply to it, including deletion, which you can carry out yourself from the account menu.

GDPR (EU General Data Protection Regulation) Applies to account holders in the EU

GDPR applies extraterritorially where a site processes personal data of people in the EU in connection with offering them goods/services, or with monitoring their behaviour (Article 3(2)). Alpha Desk does not run analytics, does not build visitor profiles, and does not target marketing at EU residents specifically — so the "monitoring" and "offering services" hooks that would pull the site fully under GDPR are not presently engaged. The one place GDPR-relevant processing genuinely happens today is ordinary web hosting: our CDN/hosting provider (Vercel) necessarily sees an EU visitor's IP address as a function of serving any web page, the same as any site on the internet, and so does the script CDN we load two libraries from (Cloudflare's cdnjs) when you open an investigation or export a stock card. We do not access, store, or compile those infrastructure logs ourselves. If you are in the EU, see Section 5 for exactly what that means and links to those providers' own privacy policies. If you are in the EU and create an account, we process your account data (Section 6) to provide the service you asked for — the lawful basis is performance of that service (Article 6(1)(b)) — and you hold the GDPR rights listed in Section 5.

CCPA / CPRA (California Consumer Privacy Act) Not currently applicable

CCPA/CPRA applies to a "business" that does business in California and crosses one of its own thresholds (roughly: over $25M in annual revenue, or buying/selling/sharing personal information of 100,000+ California consumers or households per year, or deriving 50%+ of revenue from selling/sharing personal information). Alpha Desk is a non-commercial individual research project with no revenue tied to personal data, no sale or sharing of information, and only optional accounts holding an email, a watchlist and ticker requests (Section 6) — it does not meet any CCPA/CPRA applicability threshold today, and honestly, may never need to. We address it here anyway, and commit to honoring the spirit of CCPA/CPRA rights (know, delete, correct, opt out of sale/sharing, non-discrimination) for California visitors as a matter of policy even though not legally required to, and we will formally re-assess applicability if the account feature (Section 6) or any paid feature (Section 6a) changes that calculus.

2. What we do not collect

This was verified directly against the site's source code, not assumed:

Nothing about readers who do not sign in. Signing in is optional; until you do, no form on the site submits anything to us and the sign-in code is not even loaded.
No passwords — sign-in is by an emailed one-time link or by Google, so there is no password for us to hold or leak.
No analytics or measurement scripts (e.g. Google Analytics, Vercel Analytics, Plausible) run on the site.
No advertising or retargeting pixels (e.g. Meta Pixel, Google Ads) run on the site.
No cookies of any kind are set by this site. A signed-in session is kept in your browser's localStorage instead (Section 6).
No cross-site tracking, fingerprinting, or third-party identifier syncing occurs.

See the Cookie Policy for the itemized, code-level audit behind this list.

3. What we collect from every reader

On-device display preferences (not sent to us)

The dashboard remembers two display choices — your card view mode and whether "daily mode" is on — using your browser's localStorage. These values live only on your device, are never transmitted to us or anyone else, and are not linked to your identity in any way. You can clear them at any time via your browser's site data settings.

Ordinary web server / CDN logs

Like effectively every website, when your browser requests this page, our hosting provider (Vercel) receives your IP address, browser user-agent, and the URL requested, as an unavoidable part of transmitting the page over the internet. The CDN we load two small JavaScript libraries from (Cloudflare, via cdnjs.cloudflare.com) receives the same only when you use what they are for: exporting a stock card as a PNG, or opening an investigation (markdown rendering). Neither loads with the page. We do not run our own analytics on top of this, do not receive a compiled report of it, and do not use it to build a profile of you. Vercel and Cloudflare act as independent infrastructure providers here; see Vercel's Privacy Policy and Cloudflare's Privacy Policy for how each of them separately handles that data.

Market data about companies (not about you)

The dashboard's content — prices, forensic scores, forecasts — is drawn from public and third-party financial data sources (e.g. Finnhub, SEC EDGAR, Yahoo Finance) at publish time. This is public information about companies, not personal data about site visitors, and has no bearing on your privacy.

4. Cookies

This site sets no cookies. If you sign in, your session is kept in localStorage on your device (Section 6). Full detail, including the exact localStorage keys in use and how the site's cookie-consent banner works, is in the dedicated Cookie Policy.

5. Your rights

Which of these applies to you depends on where you are and which law governs your data, per Section 1:

Under Israeli law: the right to inspect information a database controller holds about you, to request correction of inaccurate information, and (since Amendment 13) a clearer path to request deletion and to opt out of your data being used or transferred for direct marketing. You may also lodge a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות).
Under GDPR (if it applies to you): the rights of access, rectification, erasure, restriction of processing, data portability, and objection, plus the right to lodge a complaint with your local supervisory authority.
Under CCPA/CPRA (honored as policy, not currently a legal requirement for us): the right to know what personal information is collected, to request deletion, to correct inaccuracies, to opt out of sale or sharing (we do neither), and to not be discriminated against for exercising these rights.

If you have not created an account, we hold no personal data tied to you, so there is nothing to look up, correct or delete. If you have one, you can delete it — together with your email address, watchlist and ticker requests — yourself, at any time, from the account menu ("★ My Account" → "Delete my account"). For anything else, or to request a copy of your data, contact us using the details in Section 10.

6. Accounts ("My Desk") — what we hold if you sign in

Signing in is optional and only adds a personal watchlist on top of the public dashboard. Nothing in this section applies to you unless you sign in.

What we store

Data	Why	Kept until
Email address	To identify your account and send the sign-in links you request. We do not send marketing email.	You delete your account
Name and profile-picture link (Google sign-in only)	Google returns these with your email; our authentication provider stores them as part of the account record. We do not display or use them.	You delete your account
Your watchlist (ticker symbols and the date added)	To show you only the stocks you follow.	You remove the ticker or delete your account
Ticker requests (symbol, date, review status)	So a ticker the desk does not analyse yet can be checked and added automatically. An added ticker joins the public dashboard like any other; who asked for it is never shown. The operator can see how many people asked for a ticker.	You delete your account
Sign-in records (time, IP address, browser)	Kept by our authentication provider for security and abuse prevention.	The provider's log-retention period

Who processes it

Supabase — authentication and the database that holds the data above, on its cloud infrastructure, which may be located outside Israel. It also sends the sign-in emails. Supabase Privacy Policy.
Google — when you open the sign-in window, Google's sign-in button is loaded from Google, which sees your IP address and, if you are already signed in to Google in that browser, can recognise you in order to show the button. Nothing is shared with us unless you then choose "Continue with Google", after which Google knows you signed in to Alpha Desk and sends us your email, name and profile-picture link. Never loaded for ordinary reading. Google Privacy Policy.
jsDelivr — serves the sign-in library to your browser. It is loaded only when you open the sign-in window or already have a session, never for ordinary reading, and it sees your IP address the way any CDN does.

We do not sell, rent or share account data with anyone else, and do not use it for advertising or profiling. Account data is used only to run the account feature.

On your device

While you are signed in, your session token is stored in your browser's localStorage under sb-avcfcspcvvtrtpithycf-auth-token, and the "My Desk" view choice under ad_my_desk. Signing out removes the session.

Deleting your account

"★ My Account" → "Delete my account" permanently deletes your account record, email address, watchlist and ticker requests from the database at once. Copies may remain in the provider's routine backups for a limited period until those are overwritten.

6a. Planned — paid features

Planned — not yet active

If Alpha Desk introduces a paid tier, card and billing details would be collected and processed directly by a third-party, PCI-DSS-compliant payment processor (e.g. a provider such as Stripe) — full card numbers would not be stored on our own servers. We would receive only the minimum transaction metadata needed to grant access (such as a payment status and a processor reference id). None of this happens today, and this section will be rewritten before it does.

7. Data security

The site is served entirely over HTTPS, and so is every request to the account database. Access to account data is enforced inside the database itself (row-level security): a signed-in user can read and change only their own watchlist and requests, and cannot change a request's review status. There are no passwords to leak. Administrative access is limited to the operator. If a breach affecting personal data occurs, we will notify affected users and the competent authority as required by Israeli law (Amendment 13) and, where it applies, GDPR Article 33.

8. Children's privacy

Alpha Desk is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will address it.

9. Changes to this policy

We'll update the "last updated" date at the top of this page whenever this policy changes, and for material changes (such as the account feature added on October 2, 2026) we'll post a visible notice on the dashboard rather than relying on a silent date change.

10. Contact

For any privacy question, or to exercise a right described in Section 5, contact the operator at giladox10@gmail.com.