Privacy policy
This policy explains what Pholon Solutions LLC ("we", "us") collects when you visit blindspotsandsignals.com or use the Blind Spots & Signals member site, and how we use it.
What we collect
- Account details: your email address, a display name you choose, and your password. The password is stored only as a bcrypt hash — never the password itself, and it is never written to a log or returned by any part of the site. We also record when the account was created and when it last signed in.
- Subscription details: which products you hold and when they started. We hold no card details and there is no field anywhere in the system that could store a card number, expiry or security code; Stripe collects those on its own hosted page and tells us only the result.
- Sign-in and device information: the browser and device you sign in from, the time you last used it, and the IP address. You can see and end each session from your account page.
- Activity on your account: things your account did, such as tickers you looked up, with the IP address they came from. This log is visible to you on your account page, and entries are deleted automatically after 180 days.
- Messages you send us: feedback and bug reports sent from inside the member site, and anything you send through the contact form on our public pages. A contact message stores the name, email address, reason and text you type, together with your IP address and browser, so we can reply and so the form can be protected from abuse.
Cookies
The member site sets one cookie, bman_session, which keeps you signed in. It is necessary for the service to work, it cannot be read by scripts in your browser, it is marked Secure so your browser will not send it over an unencrypted connection, and it expires after 14 days. We use no analytics, advertising or tracking cookies of any kind, and no third-party tracking scripts run on any page.
Our public pages load fonts from Google Fonts, which means your browser contacts Google when you visit. That request is not something we control or receive.
How we use it
- To run your account, show the desks you subscribe to, and keep your sign-in secure.
- To reply to you when you write to us.
- To fix problems and improve the product.
Who we share it with
We share data with the services that help us run the site. Today those are: DigitalOcean, which hosts it; Stripe, which takes payment — it is given your email address when you subscribe, and your card details go to it directly on its own page, never to us; and Resend, which delivers our email — it is given your email address and the contents of the message whenever we send a password reset, an invite or a reply. Market data and news come from third-party providers, but we send them nothing about you — we ask about companies, never about members. We may disclose information if the law requires it.
Security
Connections to the site use HTTPS. Your password is stored only as a bcrypt hash, and the token behind your session is stored only as a SHA-256 hash, so read access to our database would not let someone sign in as you. You can see every device holding a session, end any one of them, or sign out everywhere at once; changing your password also signs out every other device. No system is perfectly secure.
How long we keep it
Activity entries are deleted after 180 days. A session expires 14 days after it was last used. Database backups are taken nightly and kept for 14 days, with one backup a week kept for eight weeks. The member database is also dumped every six hours, and those dumps are kept for seven days. So anything deleted can still be present in a backup for up to eight weeks.
Your account details and subscription history are kept while the account exists. Subscription records are not deleted when you cancel — they are what answers a billing question later.
Your choices
You can ask to see, correct or delete your information through our contact form. Your account page already shows you your own activity, your sign-in history and the tickers you have looked up.
Children
The service is not for anyone under 18.
Changes
If we change this policy, we'll update the date above.
Contact
Questions about this policy: use our contact form. See also our terms.