Privacy policy
Effective date
This policy takes effect on 2026-10-26 . If language versions differ, the English version governs.
Service provider
Axiocairn is operated by Doing Nothing, LLC
Jurisdiction: Delaware.
Information we collect
Account: your email address, and your Google or GitHub account ID if you sign in with them. Subscription: plan, status, billing period, and your Stripe customer and subscription IDs. Usage: when you or a connected AI agent open a Stock Model Assessment or a research report on the website or through MCP, we record the ticker and trading day, or the report, and when it was counted. We use these records for plan limits and fair use. We do not record which MCP tool was called or what the AI agent replied. Support and feedback: the messages you send us, and your email address if you include it. Do not submit account passwords, payment-card details or sensitive personal information through a research query.
How we use it
We use this information to sign you in, provide the reports in your plan, apply plan limits and fair use, handle billing, answer support requests and protect the service from abuse. Personal information is not passed on for money or used for advertising.
Signing in with Google or GitHub
If you sign in with Google, we request only the openid and email scopes and receive your Google account ID and your verified email address. If you sign in with GitHub, we request the read:user and user:email scopes. From GitHub’s replies we keep only your numeric GitHub account ID and your primary verified email address. We use this data only to sign you in, link several sign-in methods to one account, connect your subscription or a redeemed access code, show your account page and find your account when you ask for support. We store your email address, the provider account ID and sign-in session records in our account database. The provider’s access token is used only during sign-in and is not stored. A sign-in session lasts 7 days. The rest is kept until you delete your account on the account page. If your account has never been linked to a Stripe customer record, deleting it removes your account record, sign-in methods and sign-in sessions at once. An account is linked once you complete a paid subscription checkout, and stays linked after the subscription ends. For a linked account, deleting it stops access at once, signs you out and revokes connected clients, but does not cancel billing on its own. We finish the rest of the deletion by hand, including cancelling any active billing and deleting your Stripe data. To ask about a deletion, email contact@axiocairn.com. If you start a checkout before we have a Stripe customer ID for you, your email address is sent to Stripe, our payment processor. Once we have that ID, checkout uses it instead of your email address. We share this data only with Stripe and with Cloudflare, which hosts the service and its database. We do not request access to your contacts, files or repositories.
Signing in with an email code
If you sign in with a code sent to your email address, we store the address and a salted, keyed hash of the code. The 8-digit code works for 10 minutes and allows up to 5 tries. After a successful sign-in we keep a keyed hash of your email address and network for 30 days to apply sign-in limits. Codes are sent from noreply@axiocairn.com through Cloudflare. We send no marketing email.
Network addresses
We do not store your IP address or browser user agent in our database. To limit abuse of sign-in codes, access codes and AI agent pairing, we store only a hashed or keyed form of your network address. Cloudflare, which hosts the service, processes network data such as IP addresses to deliver and protect the site.
Cookies and browser storage
We set three first-party cookies, all marked HttpOnly and Secure: a sign-in session cookie that lasts 7 days, and two cookies for the Google or GitHub sign-in step and the email-code step that last 10 minutes each. They are needed for sign-in. We use no advertising or analytics cookies and load no third-party tracking scripts. The site also keeps your language choice in your browser’s storage. You can clear all of these in your browser settings. You will then need to sign in again.
Connected AI agent
A connected AI agent may receive the query and report content you request; review that provider’s terms before connecting. For each connection we store the agent’s name, when it was linked and a hashed credential. The credential has no fixed expiry and stays valid until it is revoked. To revoke a connection, email contact@axiocairn.com. Deleting your account revokes all connections.
Payments
Stripe processes payments and keeps your card and billing details under its own privacy policy. We keep your Stripe customer ID, your subscription status and a record of each Stripe event we receive: its ID, its type, a hash of its content and the processing result. For a refund, the result includes the charge ID and the refunded amount. We do not keep the full event content.
Third parties
We share personal information only with these providers, for these purposes: Cloudflare for hosting, the database, sign-in code emails and protecting the site; Stripe for payments and invoices; Google and GitHub for sign-in, only if you choose them. An AI agent you connect receives the content you request through it.
How long we keep data
Sign-in sessions end after 7 days. Sign-in codes and sign-in steps are deleted after they expire. Earlier days of the ticker request log are removed the next time you make a request. Access-code attempt records are cleared after 24 hours. Other rate-limit records contain only a hashed network address and have no automatic deletion date. Stripe event records also have no automatic deletion date. Account, sign-in, subscription and usage records are kept until you delete your account. Stripe keeps payment records under its own policies.
Deleting your data
You can delete your account on the account page. The section on Google and GitHub sign-in above explains what happens in each case. Some records are not removed automatically when you delete the account: counts of research reports used, and access codes issued to your email address. To have them removed, email contact@axiocairn.com. To ask about a deletion or about the data we keep about you, email contact@axiocairn.com.
Method Audit data
Begin with a short description only. Do not send credentials, account statements or personal identifiers. Transfer, access and confidentiality arrangements are agreed before we accept a dataset. Supplied data is used only within the agreed review scope. It is not placed in a public repository or used to train models. We delete supplied data 30 days after delivery unless the data arrangement agreed before transfer sets a different period. Questions about scope or data handling: contact@axiocairn.com.
Contact
Privacy questions: contact@axiocairn.com.