Privacy policy
Last updated: October 21, 2026
Steel Hands (steelhands.xyz) helps you review portfolio activity, challenge investment decisions, and keep a decision journal using information you provide and connected services. This policy describes the personal data processed by the website and its ChatGPT app, why it is processed, and the service providers involved.
Data we collect
We process account and sign-in data (including email address and authentication identifiers, plus a profile timezone detected from your browser that you can change in Profile settings); portfolio, holding, trade, and currency data retrieved from Parqet; Telegram bot connection details and messages needed to deliver requested coaching; strategies, decision notes, trade challenges, and review history you submit; and technical request, security, error, and product-usage data. ChatGPT app users may submit ticker symbols, proposed trades, answers, currency, and an anonymous continuity identifier; review records are stored in Steel Hands. Strategy builder conversations (your answers, the rules derived from them, and scoring results) are kept as a resumable session while you work and as your strategy once saved. We use this information to provide and secure the requested features, maintain accounts, troubleshoot faults, and understand product use. We do not sell personal data.
Why we process data
We process account, connected-service, and journal information to provide the features you request and perform our agreement with you (GDPR Article 6(1)(b)). We process security and diagnostic information to protect the service, prevent abuse, and fix faults based on our legitimate interests (Article 6(1)(f)); you may object where the law gives you that right. We process information where needed to meet legal obligations (Article 6(1)(c)). Optional product analytics and session replay run only when enabled through the applicable consent or account preference controls. Stable feature assignment is used to deliver product functionality and is separate from analytics event collection; its legal basis is under review before production use.
Error monitoring (Sentry)
We use Sentry for browser and server error diagnostics in the web app and Telegram gateway so we can find and fix faults. Reports may include error details, stack traces, request paths, and deployment data. When product analytics is enabled, reports may also include your Supabase user ID and a link to your PostHog person profile. When session replay is enabled, browser error reports may include a link to the related PostHog replay. Without the relevant choice, reports omit the account identity or PostHog link. We configure Sentry not to send default PII and scrub authorization headers, cookies, and token-shaped fields. Sentry does not record session replays and does not send exception events back to PostHog. Browser error reporting remains active regardless of optional analytics and replay choices.
Product analytics (PostHog)
We use PostHog for product feature assignment, optional product analytics, and optional session replay. Feature assignment determines which product version or feature is available and remains active regardless of analytics preferences. For anonymous visitors, a random pseudonymous assignment ID is stored in a signed, HttpOnly cookie for seven days so the assigned product version remains stable across visits. Feature assignment requests do not send analytics exposure events. Optional analytics events and session replay are off until allowed by the applicable consent or account preference. Where the consent banner is shown, you can accept or reject optional tracking; signed-in users can change analytics and replay separately in Profile settings. Session replay runs only when its separate preference is enabled, and text and form fields are masked. We use explicit event instrumentation; autocapture and automatic pageviews are disabled. After sign-in, optional PostHog processing uses your Supabase user ID only when allowed by your saved account preference. With analytics enabled, Sentry error reports may link to your PostHog person profile; with replay enabled, browser error reports may link to the related replay. Sentry exceptions are not sent back to PostHog. Product analytics help us understand feature use and improve Steel Hands.
AI-assisted strategy builder and suggestions (OpenRouter and LangSmith)
When you use the strategy builder, your answers, free-text additions, corrections to a restated rule, notes on your investor identity, and constraints are sent through OpenRouter to the model provider selected by the strategy-builder preset for generated text and contradiction checks. Axis scoring and rule categorization use OpenRouter’s Decisions API with GPT-6 Luna Decisions, which returns bounded scores and categories rather than generated text. When you ask for a suggested rule or a suggested thesis, the assistant receives the numbers and rules of your saved strategy, the rules you have already dismissed together with any reason you gave, and for a thesis the stock's ticker and name and your draft. Thesis suggestions also use OpenRouter web search. See OpenRouter's web search page for details of how the search service works. The search query and information used to formulate it, together with results returned to the model, may be processed by OpenRouter, the search service it uses, and the model provider; each service's own privacy notice and terms apply. Before anything is sent, Steel Hands removes email addresses, phone numbers, account-number-like strings, and long digit sequences. It cannot reliably remove names, so please do not enter names of people. Steel Hands also keeps a copy of each model request and reply, with the same data removed, in LangSmith so that we can check the assistant's quality and improve it. Staff review these records, and a reviewed selection may be kept as test cases or examples. Because names cannot be removed reliably, such a record could still contain a name you typed. If you start from a synced portfolio, the assistant may also receive up to your 200 most recent buy and sell trades of that portfolio (asset name or ISIN, date, quantity, and price) so your statements can be checked against them; account identifiers and your email address are not sent. OpenRouter and the selected model provider process these requests under their respective terms, which may include retention for security and abuse monitoring. Review the relevant providers' data handling terms before using the feature. The assistant does not make investment decisions, and Steel Hands validates its output before anything is stored. We process this data to provide the feature you request (Article 6(1)(b) GDPR). Answering is optional; without answers the builder cannot produce a strategy. When writing-style personalization is enabled in Profile → Privacy, Steel Hands also derives a short style profile from your saved theses, rules, conditions, and journal notes. The derived profile is stored in a private server-only file and may be included in relevant suggestion requests sent through a separate OpenRouter preset and in configured LangSmith traces; raw source entries are not added to those suggestion requests for style matching. Disabling personalization pauses profile generation and use but retains the file; enabling it again rebuilds the profile from current saved entries. Account deletion removes it.
Telegram conversations (Temporal and OpenRouter)
When you message your Steel Hands bot, your message is checked for unsafe instructions and stripped of emails, phone numbers and similar identifiers before anything else happens. The cleaned text and the bot's replies are then kept as the state of your conversation in Temporal Cloud, encrypted with a key that only Steel Hands holds, so a conversation can continue after a restart and several conversations in one chat stay separate. Only the most recent messages and a short summary of earlier ones are kept per conversation. A conversation closes after two hours without a message from you, and it can be picked up again for up to seven days by replying to one of its messages. Cleaned text is also sent through OpenRouter to the selected model provider to write replies, and, with personal identifiers removed, copies may be stored in LangSmith to evaluate quality. Disconnecting your bot or deleting your account ends your conversations; Temporal then removes their state when its retention period ends. Message text is never written to our application logs or analytics events.
Other processors
Service providers process data for us to run requested features: Supabase provides authentication and database hosting; Railway hosts the application; Sentry provides browser and server error diagnostics; PostHog provides feature assignment and, when enabled, product analytics and session replay; Parqet supplies portfolio data when you connect it; Telegram delivers bot messages when you connect a bot; Temporal Cloud stores the encrypted state of your Telegram conversations so replies survive restarts (see the Telegram conversations section); Resend may deliver transactional email; OpenRouter routes prompts and responses for AI-assisted features, including the strategy builder, to the selected model provider, which processes that content under its terms, and provides web search for thesis suggestions (see the AI-assisted strategy builder section); LangSmith stores copies of model requests and replies with personal identifiers removed so we can evaluate and improve AI-assisted features; OpenAI processes requests made through the ChatGPT app; Frankfurter supplies exchange rates; Yahoo Finance may receive ISINs for yfinance price lookup; OpenFIGI may receive ISINs to map securities to tickers; and EODHD may receive instrument identifiers and market-data queries for price history when those integrations are configured. Brandfetch supplies ticker logos, which your browser may request directly using your IP address and the ticker symbol. MaxMind supplies the GeoLite2 country database used for local IP-country lookups; visitor IP addresses are checked against that locally stored database rather than sent to MaxMind for each lookup. Sign-in providers such as Google or Facebook may also process data when you choose their sign-in option. The c15t consent interface runs in the website and sends consent choices to Steel Hands; we do not use a c15t hosted consent service. Each provider may receive data needed for its function and may process it in locations outside your country. Their privacy notices and our provider agreements describe their processing and applicable transfer safeguards. Contact us for information about safeguards relevant to a specific provider.
Retention
We retain account, connection, portfolio, strategy, and review records while needed to provide the service and until you delete them or your account, subject to backup cycles and records we must keep for legal or security reasons. Unfinished strategy builder sessions expire after 30 days. Telegram conversations close after two hours without a message from you; their state is removed by Temporal when its retention period ends. Diagnostic and analytics records follow the retention settings of Sentry and PostHog. Provider-side processing and retention are also governed by the relevant provider's settings and agreements. You can delete your account from Account settings; this removes associated Steel Hands records according to the deletion process and backup schedule.
Contact form and support requests
When you send a message through the support form, we process your message, the category you choose, the email address you give us (or your account email if you are signed in), your account ID or an anonymous visitor ID, and any files you attach. We use this only to answer your request and to keep the service secure. Each request is delivered as an email to support@steelhands.xyz and as a private issue in our project tracker on GitHub; the issue contains your message and ID but not your email address. Attached files are stored privately with Supabase, linked from the issue with expiring links, and deleted after 30 days. The email and the issue are kept as long as needed to handle your request. The form uses Cloudflare Turnstile to block automated abuse; Cloudflare receives technical request data from your browser when the form loads. We process this data to respond to your request and to protect the service (GDPR Article 6(1)(b) and (f)).
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, object to processing, or withdraw consent where processing relies on consent. Where the consent banner is shown, you can reject optional tracking there. Signed-in users can change analytics and replay choices separately in Profile settings. Anonymous choices are stored for seven days; clearing the site's cookies also removes the saved choice and assignment ID. To make another privacy request, email support@steelhands.xyz and tell us the email address associated with your account and what you are requesting. We may ask for information needed to verify your identity. We will respond within the time required by applicable law. You can also delete your account in Account settings; contact support if you need help or want to request deletion of data that is not linked to an account. Where data portability applies, you may request a copy in a commonly used electronic format. You may complain to your local data-protection supervisory authority. California and other US state residents may have additional rights under applicable state privacy laws.
Contact
Privacy questions and personal-data requests: support@steelhands.xyz
Data controller
Steel Hands is the controller responsible for processing your personal data. For any privacy question or request, contact privacy@steelhands.xyz.