Privacy Notice

PRIVACY NOTICE Effective September 8th, 2026 · Version 2.1 1. Who we are Smoke Signal is operated by the Entity (as defined in Section 12), which is responsible for the personal information described here. Contact support@smokesignalflow.com with any question about this notice. Smoke Signal is offered from and intended for use in the United States. 2. What we collect You give us: name, email, password (stored hashed, never in readable form), your confirmation that you are 18 or older, and any positions, watchlists, notes, or preferences you enter. Payment information goes to our payment processor, not to us. We receive only a customer identifier, subscription status, and the last four digits and brand of your card. We never see or store full card numbers. Collected automatically: IP address, browser and device type, operating system, pages viewed, features used, timestamps, referring URL, and diagnostic logs. From third parties: if you sign in with Google, we receive your email address, name, and profile identifier from Google under their terms. If you arrive from one of our ads, the advertising platform may tell us which campaign referred you. We do not collect: brokerage credentials, account numbers, balances, holdings, transaction history, Social Security numbers, or government identification. We have no connection to any brokerage. 3. How we use it To provide the service and deliver the tier you purchased; to authenticate you and secure accounts; to process payments and manage subscriptions; to send service messages about your account, billing, and material changes; to respond to support requests; to understand feature usage and improve the product; to measure the performance of our advertising; to detect fraud, credential sharing, and prohibited use; and to comply with legal obligations. Marketing email. When you create an account you can choose whether to receive marketing email from us. Every marketing message includes an unsubscribe link and our postal address, and we honor unsubscribe requests promptly. Service and billing messages — receipts, renewal notices, security alerts, and notices of material changes — are not marketing and cannot be opted out of while you hold an account. 4. Who we share with Service providers acting on our instructions under contract: hosting and database infrastructure, authentication, payment processing, email delivery, error monitoring, and analytics. Advertising platforms. We may advertise Smoke Signal on Meta, Google, X, and other similar platforms. As described in section 7, those platforms receive limited identifiers and activity data from our public pages so they can measure whether their advertising led to a signup and show our advertising to people who have visited. Under California law this is treated as "sharing" personal information for cross-context behavioral advertising, and may be treated as a "sale." We do not receive money for it. We never provide advertising platforms with your positions, watchlists, notes, or any screening output. Advertising and analytics technologies operate only on our public marketing pages, never on pages behind the login. Legal and safety: where required by law, valid legal process, or to protect rights, safety, or property. Business transfer: in a merger, acquisition, or asset sale, subject to this notice. 5. How long we keep it We keep account information for as long as your account is active and for 12 months after it closes, so that a returning subscriber's record is intact. Payment and tax records are kept as long as the law requires, generally seven years. Diagnostic and access logs are kept for 12 months. Deletion requests are honored within 30 days except where retention is legally required, principally payment records. Backups are purged on our normal rotation cycle, within 90 days. 6. Your rights Depending on where you live, you may have the right to access the information we hold, correct inaccuracies, request deletion, receive a portable copy, opt out of the sharing described in sections 4 and 7, and not be discriminated against for exercising these rights. California residents (CCPA/CPRA). You have the rights above, plus the right to know the categories of personal information we collect, the sources, the purposes, and the recipients. Because we share personal information with advertising platforms for cross-context behavioral advertising, you have the right to opt out. Use the "Do Not Sell or Share My Personal Information" link in our footer. We also honor the Global Privacy Control and other recognized opt-out preference signals automatically, without requiring you to submit a request. Residents of other states with privacy laws — including Colorado, Connecticut, Virginia, Texas, Oregon, and others — have comparable rights, including the right to opt out of targeted advertising. The same footer link and the same opt-out preference signals apply. Exercise any right at support@smokesignalflow.com. We verify identity before acting, and respond within 45 days. 7. Cookies and similar technologies Essential. These keep you signed in, secure your session, and provide CSRF protection. They cannot be disabled while you use the service. Analytics. We use Google Analytics to understand which features are used and how the product performs. Advertising and measurement. We may advertise Smoke Signal on Meta, Google, X, and other similar platforms. Those platforms place cookies and similar technologies on our public pages to measure whether their advertising led to a signup and to show our advertising to people who have visited. Under California law this is treated as "sharing" personal information for cross-context behavioral advertising, and may be treated as a "sale." Your choices. Analytics and advertising technologies run until you opt out. Use the "Do Not Sell or Share My Personal Information" link in our footer to opt out at any time, or set the Global Privacy Control in your browser — we detect and honor it automatically. Opting out does not affect essential cookies, and it does not change what you can see or do in the product. 8. Security We encrypt personal information in transit using TLS and at rest using industry-standard encryption. Passwords are stored using a one-way hash and are never retrievable in readable form. We also use access controls, audit logging, and regular encrypted backups. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any required regulator within applicable deadlines. 9. If you are outside the United States Smoke Signal is offered from and intended for use in the United States. We are based in the United States and process all information there. We do not target the service to residents of the United Kingdom, the European Economic Area, or other regions with data transfer restrictions. If you access the service from outside the United States, you understand your information will be transferred to and processed in the United States, where privacy laws differ from those in your country. Rights described in this notice are provided under United States federal and state law. 10. Children The service is not directed to anyone under 18. We ask every user to confirm they are 18 or older before creating an account, and we do not knowingly collect information from minors. If we learn we have, we will delete it. Contact support@smokesignalflow.com if you believe a minor has provided us information. 11. Changes We may update this notice. Material changes will be notified by email or in-product before taking effect. Each version carries a version number and effective date. 12. Contact Smoke Signal is operated by SLATE SP LLC (the "Entity"). 17328 Ventura Blvd, Encino, CA 91316 support@smokesignalflow.com Legal, privacy, account, and billing questions: support@smokesignalflow.com.