PYTHIAPrivacy Policy
EFFECTIVE SEPTEMBER 26, 2026
Pythia ("we", "us", "our") operates the pythia.trade website, Pythia MCP (at mcp.pythia.trade), the daily Pythia brief email, and Pythia Desktop. This policy explains what information we collect, how we use it, and your rights.
1. Information we collect
| WHAT | WHEN | WHY |
|---|---|---|
| Request information, such as IP address and browser headers | When you visit pythia.trade | Serve and protect the website (handled by Cloudflare) |
| IP address | When you use Pythia MCP without an account | Rate limiting and abuse prevention |
| The searches and lookups you send | When you use Pythia MCP | Answer them |
| Email address and sign-in details | When you create or sign in to a Pythia account | Create and secure your account (sign-in is handled by Stytch) |
| Usage records: what was used, when, and its cost | When you use Pythia MCP with an account | Plan limits, credits and billing |
| Your analyst questions and Pythia's answers | When you ask Pythia's analyst a question | Generate the answer and keep your conversation |
| Payment information | When you buy a plan or credits | Billing (handled by Stripe; we never see or store your full card number) |
| Email address and link clicks | When you subscribe to the daily brief | Deliver the brief and measure which content is useful |
Pythia Desktop is software you install and run on your own computer. Your portfolio, broker connection and AI provider keys are stored on your computer, not on our servers. When the app uses Pythia's data or a Pythia plan, the requests it sends are covered by the rows above.
We do not use advertising cookies or cross-site tracking, and we do not sell your personal information. Anything you type into a question may itself contain personal information, so please avoid including sensitive details you do not want stored.
2. How we use it
- Running the services: answering your requests, keeping your account and conversations, and delivering the brief.
- Generating answers: analyst questions are processed by AI models, including the third-party providers below and models on hardware we operate.
- Billing: plans, credits and receipts, through Stripe.
- Security: rate limiting, abuse prevention and keeping the services running.
- Improving Pythia: aggregated, de-identified usage patterns may inform product decisions.
3. Service providers
We share only what each provider needs to do its job:
- Cloudflare: DNS, hosting of pythia.trade, security and traffic protection. Processes request information such as IP addresses.
- Railway: hosting for Pythia's servers and database.
- Stytch: sign-in for Pythia accounts.
- Stripe: payments, under its own privacy policy.
- OpenRouter and the AI model providers it routes to: generating answers and research. Where an opt-out is available to us, we do not allow them to train on your inputs.
- Resend: delivery of the daily brief email.
- Google Workspace: our company email, if you write to us.
4. How long we keep it
- Rate-limiting records: held in memory and cleared within minutes.
- Server logs, which can include IP addresses: kept for a limited period by our hosting provider for security and troubleshooting.
- Account information, usage records and conversations: kept while your account is active and deleted when you delete your account, except billing records we must keep for tax, accounting or legal reasons.
- Brief subscriptions: kept until you unsubscribe. After that your email is marked inactive and kept for 90 days to prevent accidental re-subscription, then deleted.
- Link-click data: kept for up to 12 months, then aggregated and anonymised.
5. Your rights
- Unsubscribe from the brief at any time with the link in any email.
- Access or export the data we hold about you.
- Delete your account and its data, including your conversations.
- Correct inaccurate information.
To make any of these requests, email graham@pythia.trade.
California residents (CCPA): you have the right to know what personal information we collect, to request its deletion, and to opt out of its sale. We do not sell personal information.
EU/EEA and UK residents (GDPR): we process your information to provide the services you ask for, with your consent where you subscribe to email, and for our legitimate interest in keeping the services secure. You may withdraw consent at any time, and you have the right to data portability and to complain to your local data protection authority.
6. Security
We use reasonable technical and organisational measures to protect your information, including encrypted connections for all data in transit, rate limiting, access controls on our infrastructure, and security review of our code. No system is completely secure, and we cannot guarantee absolute security.
7. Children
Pythia is not directed at anyone under 18, and we do not knowingly collect their information. If you believe we have, contact us and we will delete it.
8. Changes to this policy
We may update this policy. We will tell account holders and brief subscribers about material changes by email at least 7 days before they take effect. The effective date above shows the latest revision.
9. Contact
graham@pythia.trade
Pythia · Austin, Texas