Privacy Policy

Stocklore (the “Service”) takes your personal information seriously and complies with applicable laws, including the Personal Information Protection Act (PIPA) of Korea. This policy explains what information the Service collects, for what purposes it is used, and how it is protected. · Effective date: June 8, 2026

This English text is a reference translation provided for your convenience. The Korean version is the official text and prevails in the event of any discrepancy.

1. Personal Information We Collect

The Service collects the following personal information:

At sign-up (required): your email address. Passwords are stored encrypted by the authentication processor (Supabase); the Service does not keep plain-text passwords.
Social login: the email address and profile identifier of your Google account.
Generated during use: watchlists, tags, filter presets, alert conditions, and portfolio holdings that you save and configure yourself, and the content of any feedback you send.
Collected automatically: visit records for usage statistics (a session identifier, a random visitor identifier used only to tell whether a visit is a return visit, the page paths you visit, and, if logged in, your member identifier). The visitor identifier is a random value stored in your browser and does not identify you personally. We do not collect your IP address, device fingerprint, or detailed browser information.
Abuse and automated sign-up protection: Sign-up and sign-in requests are handled through our own server, which uses your IP address temporarily for rate limiting (it is not stored separately). Cloudflare security rules in front of the service also block abnormal requests.

2. Purposes of Collection and Use

Member identification and authentication (login, email verification)
Storing user data such as watchlists and portfolios and syncing it across devices
Analyzing visit statistics to improve service quality
Security, including blocking fraudulent sign-ups and automated attacks
Responding to inquiries and feedback
Sending important notices and (where you have opted in) alert emails

3. Retention and Use Period

As a rule, your personal information is retained until you withdraw your membership and is destroyed without delay upon withdrawal. However, where applicable law requires retention for a certain period, it is kept for that period. Visit statistics used to improve the Service may be retained in a form that does not identify individuals.

4. Outsourcing of Processing and Cross-Border Transfer

For its operation, the Service entrusts the processing of personal information to the businesses below, whose servers are located in the United States, so personal information is transferred to and stored abroad. The transfer occurs at the time of use or sign-up, and the items transferred are the same as the collected items in Section 1 above.

Supabase Inc. (USA) — member authentication and database (storage of email and user data)
Vercel Inc. (USA) — service hosting
Cloudflare, Inc. (USA) — content delivery (CDN), bot protection, email routing
Resend (USA) — sending of verification and alert emails (email address)

We do not transmit your personal information to the price/financial data providers (Polygon/Massive) or to the AI used for Korean translation, summarization, and comparison (Anthropic, USA); only non-personal information such as stock tickers, financial metrics, or public filing text is processed. User data itself, such as watchlists and portfolios, is not sent to the AI, and inputs sent to the AI are not used to train the model.

In addition, when paid subscription billing is introduced, processing of payment-related information is entrusted to the payment gateway PortOne Inc. and the respective payment processors (KG Inicis, KakaoPay, Toss Payments, etc.). These are domestic (Korean) businesses; card numbers and other payment-method details are handled by each processor and are not stored by the Service (only payment tokens, transaction numbers, and subscription status are retained).

5. Provision to Third Parties

The Service does not provide personal information to third parties without your consent. It may do so only where based on law or in response to a lawful request from an investigative authority.

6. Cookies and Local Storage

We use authentication cookies to keep you logged in. For convenience, we also store the display theme, recent searches, and portfolio inputs — and, for usage statistics, a random visitor identifier — in your browser (local storage). These values are stored only on your device and can be deleted in your browser settings. If you delete them, a new visitor identifier is created and is not linked to earlier records.

7. Your Rights and How to Exercise Them

You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information. Items such as watchlists and tags can be edited or deleted directly within the Service, and if you request account deletion, the associated data is deleted along with it. To exercise your rights, please contact us at the address below.

8. Destruction of Personal Information

Personal information whose retention period has passed or whose purpose has been achieved is destroyed without delay. Electronic files are deleted in an unrecoverable manner.

9. Children Under 14

The Service restricts membership sign-up by children under the age of 14. This is because, under Article 22-2 of the Personal Information Protection Act, processing the personal information of a child under 14 requires the consent of a legal guardian, and the Service does not operate a separate legal-guardian consent procedure.

Accordingly, at sign-up there is a step to confirm that the user is 14 or older (the “14 or older” confirmation in the consent step), and we do not intentionally collect the personal information of children under 14. If it is found that a child under 14 has signed up, that account and its personal information are destroyed without delay.

10. Personal Information Protection Officer

For inquiries, complaints, or remedies regarding the processing of personal information, please contact us below.

Personal Information Protection Officer: Lee Seungjae (operator)
Contact: [email protected]

If you need further consultation regarding a personal-information infringement, you may contact relevant agencies such as the Korea Personal Information Infringement Report Center (privacy.kr, dial 118 without an area code).

11. Duty of Notice

If this Privacy Policy is changed, we will announce the changes through in-service notices. The effective date of this policy is the date shown above.

This document is standard guidance drafted based on the Service’s actual data-processing practices and does not guarantee legal effect. Review by a professional is recommended at the formal-operation and monetization stages.