Privacy Policy
What data SigmaGEX handles, what it doesn't, and who it's shared with.
TL;DR — SigmaGEX stores what you'd expect for a self-hosted
analytics app to work: your account credentials, your settings, and
request logs. It does not sell data, does not run third-party ad
trackers, and does not share account data with anyone other than the
services required to make the app function (our licensed market-data provider, the
optional AI provider you configure, Discord for the bot integration).
1. What we collect
When you use the SigmaGEX web app:
- Account: email, username, hashed password, timezone preference.
- Settings: chosen theme, ticker watchlist, alert rules, chart
preferences.
- Session cookies (HttpOnly, SameSite=Lax) so we can keep you signed
in across page loads.
- Request logs: URL, timestamp, response code, and IP for the last
~14 days for troubleshooting and abuse protection.
When you use the SigmaBot Discord bot:
- Your Discord user ID and the guild ID + channel ID where a command
was issued — required by Discord's API so the bot can reply.
- The command you issued (e.g.,
/sigma gex chart SPX) and the ticker
argument. We keep aggregated usage counts (per-ticker request totals)
to prioritize which commands to improve.
2. What we don't collect
- We don't ingest your brokerage account holdings, trades, or
positions. SigmaGEX pulls option-chain market data via our licensed market-data provider;
it never sees your account activity.
- We don't set third-party analytics or advertising trackers.
- We don't read your Discord messages that aren't SigmaBot commands.
The bot needs the "Message Content Intent" to see
!-prefixed
commands; any other message content is discarded on receipt.
3. Data storage
All persistent data lives in databases on the operator's own
machine, separated as follows:
- Market data — a cache of option chains, price
candles and historical snapshots. No account data.
- Account data — accounts, settings, alert rules and
bot request logs.
Backups may be zipped and archived to a local backup folder on that
same machine. Nothing is sent to third-party cloud storage.
4. Who we share with
- Our market-data provider — outbound requests to their market-data
API. Only the queries we send (symbols, expirations); no account
information.
- Your configured AI provider — if you enable AI analysis
(Anthropic, OpenRouter, or another), the chart image + a text prompt
describing current market state are sent to that provider under
your API key. We do not include your account credentials.
- Discord — the bot's gateway connection and any messages
it sends into channels you invited it to.
We do not sell, rent, or trade personal data.
5. Cookies
The only cookie set by this site is the session cookie
(gex_session_v2). It carries a signed reference to your
authenticated session so you don't have to log in on every request. No
tracking cookies are set.
6. Your rights
You can request deletion of your account data, or export a copy, by
contacting the operator (via the SigmaBot Discord server or project
repository). Because this is a personal operation and data lives on
one machine, requests are handled manually.
7. Retention
- Account records: kept while your account is active. Purged on
deletion request.
- Request logs: ~14 days rolling.
- Market data cache: 30-day rolling for equities; indefinite for
indices and futures (small footprint, useful for historical scrubbing).
8. Security
Passwords are hashed with a per-user salt. Session cookies are signed
with a persistent Flask secret. HTTPS is used when the operator has
provisioned a certificate; local-only deployments (127.0.0.1)
run over plain HTTP by design.
9. Children
SigmaGEX is not directed at children under 13 and does not knowingly
collect data from them. Options trading is not appropriate for minors.
10. Changes
This policy may be updated. The "Last updated" date at the bottom of
this page reflects the current version.