Privacy Policy
This policy describes what personal data Zortix collects, why, who else processes it, how long it is kept, and how to get it deleted. It covers the website, the web app and the mobile app.
The short version
- You can read every public page without an account and without giving us anything.
- We never sell personal data, and we do not run advertising or advertising trackers.
- Analytics are pseudonymous and carry no personal data in their properties — never your email address.
- You can delete your account yourself, in the app, and it genuinely erases your data. What survives, and why, is listed below.
What we collect
If you only browse the site
No account is required to read ticker pages, weekly editions or ideas. We record pseudonymous product analytics: pages viewed, the referring site, any campaign tags in the link you followed, coarse device and browser type, and an approximate location derived from your IP address. These events are keyed to a random identifier, not to you. If your browser sends a Do Not Track signal, we do not capture them at all.
We also record application errors — the error message, the page it happened on, and technical context — so faults can be fixed.
If you give us your email for the watchlist digest
We store your email address, the tickers you selected, which page you signed up from, confirmation and unsubscribe tokens, and the relevant timestamps. Signup is double opt-in: the address receives nothing until you confirm it. Every digest carries a one-click unsubscribe link, and that link is deliberately not click-tracked.
If you create an account
| Data | Why |
|---|---|
| Email address; a password hash, or an identifier from Apple or Google if you use those to sign in | To create and secure the account |
| Subscription tier, status, renewal and trial dates | To give you what you have paid for |
| Digest preferences: whether it is on, the delivery time and time zone, alert settings, interested asset classes, onboarding state | To send what you asked for, when you asked for it |
| Followed podcasts and tickers, portfolio holdings you enter, saved ideas | To personalise what you see and what we send |
| Questions you ask Ask Zortix and the answers returned | To answer, and to review answer quality |
| Connector keys you create for an assistant (Muse, Grok, or another agent): a hash of the key, the name you gave it, its scopes, when it was created and last used, and a count of calls | To let the assistant act for your account until you revoke it |
| Feedback you submit, including free text | To read and act on it |
| Push notification tokens, app version and platform | To deliver notifications you enabled |
| Sign-in and refresh tokens, and for sign-in links the requesting IP address and browser user-agent | To keep you signed in and to detect abuse of sign-in links |
| Email delivery records, and whether a message was opened or a link clicked | To keep email deliverable and to see whether the digest is worth sending |
| Clicks on brokerage links | To attribute referral revenue |
We do not connect to your brokerage and we do not collect financial account credentials. Portfolio holdings are only what you type in yourself.
If you connect an assistant
You can give an AI assistant you already use (Muse, Grok, a Grokbot routine, Claude, or any client that speaks MCP or reads an OpenAPI document) a connector key from Settings → Connectors. With it the assistant acts for your account and can read what you can: your daily digest, search results, the full ideas it opens, your followed shows and tickers, your saved ideas, and the answers to the questions it sends to Ask Zortix. It can follow, unfollow, save and unsave on your behalf, and send Ask Zortix questions, which are stored like the ones you ask yourself. It never sees your email address, your billing, your portfolio holdings, or the key itself after creation, and it cannot create or revoke keys.
The assistant is a third party you chose, not a provider acting on our instructions: what it does with what it reads is governed by its own terms and privacy policy. We record each call it makes (the tool, the outcome, how long it took, a hashed account id) to run the service and to see how the connector is used; we never record the key, the question or the answer in those logs. Revoke a key in Settings and it stops on the next request; erase your Ask history there or under Account → Data & privacy; deleting your account deletes every key. The full flow is drawn out at connectors → data flow.
Why we are allowed to use it
- To perform our contract with you — running your account, delivering the product you signed up for, and handling subscriptions.
- Your consent — the email digest, and push notifications. You can withdraw either at any time without losing access to anything else.
- Our legitimate interests — pseudonymous product analytics, keeping email deliverable, diagnosing errors, and preventing abuse. We use the least identifying data that answers the question.
- Legal obligations — tax and accounting records where they apply.
Who else processes it
We use the following providers. They act on our instructions and may not use your data for their own purposes. Where a provider is outside the European Economic Area, transfers rely on the European Commission’s Standard Contractual Clauses.
| Provider | What it handles |
|---|---|
| Railway | Application hosting and the database — all stored data |
| Vercel | Hosting for this website and the web app |
| Resend | Sending sign-in links, digests and notifications; delivery and bounce events |
| PostHog | Pseudonymous product analytics, hosted in the EU |
| Sentry | Error monitoring |
| Expo | Delivering push notifications to your device |
| Apple, Google | Sign-in, and app store billing, if you use them |
| Google (Gemini) | Generating Ask Zortix answers. Your question and the podcast passages it draws on are sent to the model to produce the answer. |
Speech-to-text and idea extraction providers process podcast audio and transcripts, which are third-party published content rather than your personal data. They receive nothing about you.
An assistant you connect with a connector key is not on this list: it is your choice, it acts for you, and it is not our processor. See “If you connect an assistant” above.
Cookies and tracking
There is no advertising, no advertising cookies and no cross-site tracking, which is why you are not asked to dismiss a cookie banner. We set a session cookie when you sign in, which your browser cannot read from scripts, and a small non-sensitive flag recording only whether someone is signed in, so that anonymous visitors are not slowed down. Analytics respect Do Not Track.
How long we keep it, and what deletion actually does
You can delete your account yourself — in the mobile app under Profile, or on the web under Account → Data & privacy. You will be asked to retype your email address to confirm. Deletion runs immediately and is not reversible. If you can no longer sign in, request deletion here.
| Data | On deletion |
|---|---|
| Account, follows, portfolio holdings, saved ideas | Deleted |
| Connector keys and their usage counts | Deleted (a key is also revocable at any time before that, and stops immediately) |
| Sign-in links, refresh tokens, push tokens, notification history | Deleted, including sign-in links issued before you had an account |
| Email delivery records and their open/click events | Deleted |
| Feedback you wrote | Deleted |
| Brokerage link clicks | Kept but anonymised — the link to you is removed. They carry no other personal data, and the aggregate is needed for revenue records. |
| Records of actions you took on someone else’s account, if you were an administrator | Kept with your identifier removed — the record belongs to the other person |
| Bounce and complaint suppression entries | Kept. These exist so a mail server that rejected your address is never mailed again; deleting them would undo that protection. They contain only the address. |
| Analytics events | Retained in pseudonymous form. They are keyed to a random identifier and deleting your account removes the link between that identifier and you. Ask us if you want the analytics profile erased too, and we will do it. |
If you only subscribed to the digest and never created an account, the unsubscribe link in any message removes you. Ask us and we will delete the record entirely.
Your rights
If you are in the EEA or the UK you may request access to your data, correction of it, erasure, a portable copy, restriction of processing, and you may object to processing based on legitimate interests. Where processing rests on consent you can withdraw it at any time. Write to hello@zortix.app and we will respond within one month.
If you are unhappy with how we handled it, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Children
Zortix is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it.
Changes
If this policy changes materially we will update the date at the top of this page and, where the change affects you directly, tell account holders by email.
Who operates Zortix
Zortix is operated by Westloop B.V. Contact us at hello@zortix.app.