Privacy policy
What Pika Pika Arsh keeps about you, why, who else handles it, and how to get it or delete it.
What we collect
- Your account. Your email address. If you sign in with Google or Discord, the name and profile picture they share with us. Which sign-in methods you’ve linked. If you set a password, we keep only a one-way hash of it. If you add a passkey, we keep its public key; your fingerprint or face never leaves your device.
- Where you’re signed in. For each signed-in device, its IP address, browser and when it was last active. You can see these on your account page.
- Email preferences. Whether you asked for Arsh’s market notes. If you did, your address is on our mailing list.
- How the site is used. Pages visited, clicks, the device and browser, and recordings of how pages are used, with what you type into fields hidden. Also errors, so we can fix them.
- Your watchlist and portfolios: the slabs you watch, and the cards, slabs and sealed product you add, with what you paid, when, any certificate numbers and notes you give.
- Pro billing. Payments go through Stripe, on pages Stripe hosts; we never see or store your card number. We keep your Stripe customer number, your plan and its status, when it renews or ends, and when you agreed to the renewal terms. Stripe keeps your payment details, billing address and receipts under its own privacy policy.
Why
- To run your account and keep it secure.
- To keep your watchlist and portfolios, and value them each day.
- To take payment for Pro, and to know who has it.
- To send the emails you ask for or need: sign-in codes, the email when Pro starts, and market notes if you opted in.
- To understand how the site is used, and to find and fix what breaks.
We don’t sell your data, and we don’t show ads.
Who else handles it
- Stripe takes payments for Pro and keeps the billing records.
- Resend sends our emails and holds the mailing list.
- PostHog receives usage analytics, recordings and errors.
- Google and Discord, if you sign in with them.
- Cloudflare stores our encrypted database backups.
- The company that hosts our server.
How long we keep it
- Your account, watchlist and portfolios, until you delete them.
- Billing records: Stripe keeps invoices and payments for as long as tax and accounting law requires, even after an account is deleted.
- A signed-in session, 30 days after you last use it.
- A sign-in code, 15 minutes.
- Backups, for a limited time before they’re replaced. A deleted account leaves our backups as they age out.
Your choices
- Download your data or delete your account from your account page. Deleting removes your account and everything tied to it at once, and ends any Pro subscription first so you’re never charged again. If you’re on Arsh’s mailing list, you choose whether to leave it too.
- Turn Arsh’s market notes off on your account page, or with the unsubscribe link in any of them.
- Anything else, including a copy of what we hold or a correction: support@pikapikaarsh.com.
Cookies and storage
A sign-in cookie keeps you signed in; the site can’t work without it. Analytics uses cookies and your browser’s storage to tell visits apart.
Children
You need to be 13 or older to have an account. We don’t knowingly keep data about anyone younger; if you think we do, write to us and we’ll delete it.
Changes
When this policy changes, the date at the top changes. If a change affects what we collect or who we share it with, we’ll email account holders first.
Questions about this page: support@pikapikaarsh.com. Privacy · Terms · Refunds · Disclaimer · About · Contact