The design principle throughout: collect the minimum, keep it anonymous where possible, and let raw logs expire.
An email address, a password hash (or a Google sign-in reference), your watchlist rows, your alert definitions, and — if you connect it — a Telegram chat reference for alert delivery. That is the account.
Usage analytics use a random identifier that your own browser generates for itself. It is never derived from your account, never joined to it, and carries no IP address or device fingerprint. Raw event rows are deleted after ninety days; only aggregates remain. Search analytics likewise store the query text and result count — not who searched.
We do not sell personal data, do not run third-party ad trackers in our own code paths, and do not expose individual users' searches or activity to administrators — admin reporting is aggregate-only by design.
Local storage holds your session token when you sign in, interface preferences, and the random analytics identifier described above. No cross-site tracking cookies are set by our code.
Deleting your account removes the account row, watchlist and alerts. Anonymous analytics rows contain nothing that maps back to you, before or after deletion.