Privacy Policy
Last updated: October 5, 2026
This policy explains what personal information WhaleHerald ("we", "us") collects when you use whaleherald.com, why, who we share it with, and the choices you have.
What we collect
- Account details: your name and email address. If you sign up with email and a password, we store only a salted, hashed version of the password (PBKDF2) — never the password itself. If you use "Continue with Google", our sign-in provider (Clerk) receives your Google name, email address and profile picture.
- What you do in WhaleHerald: lessons watched, quiz and exercise results, XP and streaks, your answers to the set-up questions (experience level, goals, which broker app you use, how you like things explained), your watchlist and followed X accounts, your paper-trading account (simulated positions and orders, including any paper money you add), alerts you set, and your Ask the Whale conversations.
- Technical data: like any website, our hosting provider processes your IP address, browser type and request logs to deliver and protect the Service. We use privacy-friendly, cookie-free analytics (Cloudflare Web Analytics) to count visits and page views.
We don't ask for — and you shouldn't enter — bank or brokerage details, government ID numbers or other sensitive information. WhaleHerald never has access to your real brokerage account.
How we use it
To run your account and keep you signed in; save your progress, chats, watchlist, alerts and paper account; personalise lessons and Ask the Whale (for example, recommending your next lesson); send you alerts or account emails you've asked for (such as password-reset codes); prevent abuse and enforce usage limits; and improve the Service. We don't sell your personal information and we don't use it for third-party advertising.
Who processes your data
We use trusted service providers who process data on our behalf:
- Cloudflare (USA, global network) — hosting, storage of your account data, security, analytics, and some AI features.
- Clerk (USA) — sign-in with Google and password-reset emails.
- Google — only if you choose "Continue with Google".
- DeepSeek — the AI model behind Ask the Whale. When you ask a question, your message, recent messages in that chat, and the context needed to answer it (such as your first name, watchlist, paper-account positions and practice history, learning progress, your answers to the set-up questions, and what's on your screen when you ask — for example the chart or option you're looking at) are sent to DeepSeek to generate the answer. DeepSeek is operated from the People's Republic of China, so this information is processed there. If DeepSeek is unavailable, Cloudflare Workers AI answers instead.
- PayPal (USA/Europe) — payments, once paid plans launch. PayPal handles your payment details; we never see them. We send PayPal only a random account reference, not your name or email.
Market data providers (such as Yahoo Finance, Nasdaq, FINRA and Cboe) receive no personal information from you — our servers fetch public market data.
Cookies and local storage
We use a small number of essential cookies: wh_sess keeps you signed in (30 days), and Clerk sets its own cookies (such as __session and __client_uat) when you use Google sign-in. Your browser's local storage remembers preferences like light/dark theme, chart settings and dismissed messages. We don't use advertising or tracking cookies.
How long we keep it
Your account data stays until you delete your account. Ask the Whale keeps the most recent 60 messages per chat. Sign-in sessions expire after 30 days. Server logs are kept for a limited time by our hosting provider.
Your choices and rights
- Download your data — account menu → "Your data" → Download.
- Delete your account — account menu → "Your data" → Delete account. This permanently removes your account, progress, chats, watchlist, alerts and paper account from WhaleHerald, and your linked sign-in record at Clerk, and cancels any WhaleHerald subscription.
- Correct your details or ask a privacy question — contact us (below).
Depending on where you live (for example under the GDPR or US state privacy laws), you may also have rights to access, correct, delete, restrict or object to processing, and to complain to a data-protection authority.
Security
Everything is sent over HTTPS, passwords are hashed, and access to stored data is restricted. No system is perfectly secure, so please use a strong, unique password.
Children
WhaleHerald is for adults (18+) and isn't directed at children. If you think a child has created an account, contact us and we'll delete it.
Changes
We'll update this page when our practices change and show the date at the top. If changes are significant, we'll let you know on the site or by email.
Contact
We're setting up a dedicated contact address — it will be published here shortly.