Privacy Policy

Who we are and what this covers

FirstFa is a market-analysis tool: charts, AI analysis of public market data, strategy backtests and research notes. It does not place trades, hold funds, or connect to your exchange accounts.

This policy covers the FirstFa website, the app and its admin console. Questions about your data go to admin@supersolution.io.

What we keep

Only what the product needs to work for you:

• Your account: email address, display name if you give one, whether the address is verified, your role, and when the account was created. Your password is kept only as an Argon2id hash.
• Sign-in methods: if you sign in with Google, Apple or X, that provider's account id for you and the email it gave us.
• Two-step sign-in, if you turn it on: the authenticator secret, encrypted, and your recovery codes, stored only as hashes.
• Sessions: for each signed-in browser, a hash of its session token, its IP address and browser name, and when it was last used.
• Conversations: your questions, the AI's answers and the market data it looked up to answer, with each conversation's title.
• Usage: for each AI answer, the reply tier, the number of tokens used and its cost to us, and when. You see this only as a percentage of your allowance.
• What you make: reports and their earlier versions, strategies and their backtest results, playbooks and their share links, stars and follows.
• Your plan, if you have a paid one: which plan, its status and renewal date, and the Stripe customer and subscription ids. No card number is kept here.
• Preferences: favourite and recent tickers, dashboard layouts, chart and chat settings and the language you chose, so they follow you to another browser.
• Security records: sign-ins, password and email changes, and similar events, with the IP address they came from; and short-lived counters keyed by IP address or email address that limit repeated attempts.

We do not use advertising or analytics trackers, and we do not sell personal data.

Why we use it

• To run your account and keep it secure: signing you in, limiting password guessing, telling you about changes to your account.
• To answer your questions: your conversation is sent to an AI model to produce each answer.
• To keep the service affordable and fair: per-account and platform-wide spending limits are computed from usage records.
• To support you and to stop abuse: authorized staff can look at an account's details and conversations when investigating a support request, a security problem or abuse. Every such view is recorded.

We rely on providing the service you asked for, and on our legitimate interest in keeping it secure and preventing abuse.

Who else sees it

We use these service providers. Each gets only what its job needs:

• AI model providers: the content of your conversation (your question, earlier messages in it, and the market data the AI looked up) is sent through our AI gateway to the model provider that answers. It is not sent with your name or email address.
• Google Cloud: hosts our servers and database (region asia-east1, Taiwan). Everything listed above is stored there.
• Cloudflare: sits in front of our servers; it handles every request to them, including your IP address.
• Vercel: hosts the website and the app; it handles your requests to them, including your IP address.
• Resend, once email is switched on: your email address and the emails we send you (verification, password reset, account notices).
• Stripe, if you buy a paid plan: your card details go to Stripe directly and we never see them. We send Stripe your account email address and an internal account id, so the subscription is tied to your account and Stripe can email receipts; we receive the outcome: which plan, its status and when the current period ends.
• Google, Apple or X, only if you choose to sign in with them.
• Brandfetch: to display company logos, your browser loads images directly from Brandfetch (cdn.brandfetch.io), which may receive your IP address and browser information.

Market-data sources (such as OKX and SEC EDGAR) receive no personal data from us.

Some things you make are public by design. Strategies you publish, their results, the leaderboards, and the name and handle you publish them under are readable by anyone, signed in or not, and search engines may index them. A playbook you make is private until you share it: a share link lets anyone who has the link read that playbook, with no name or account shown, until you stop sharing it.

How long we keep it

• Your account and what you made: until you delete it, or delete the account.
• A conversation you delete: its content is removed at once. We keep only a record that a conversation with that id existed, when it was deleted and how many messages it had.
• A report you delete: restorable for 30 days, then removed. Of a report's earlier versions, the newest 20 are kept.
• Sessions: removed 30 days after they end (sign-out, expiry, or a password change).
• Counters that limit repeated attempts: about a day.
• Usage records: kept for billing and accounting. When you delete your account they are kept without any link to you.
• Security records: kept to investigate abuse. When you delete your account they no longer name your email address, but they keep its account id and the IP address they came from. A fixed period after which they are removed is still to be set.
• Stripe event records (an event's id, type and what it did, no card or contact details): 90 days.
• Backups taken before maintenance can hold deleted data until they are removed. A fixed backup retention period is still to be set.

Deleting your account

Settings → Delete account removes your account at once: conversations, reports, private playbooks, strategies you never published, preferences, sessions and sign-in methods.

Strategies you published stay published, because their results are a public record, but they are shown under "Deleted account" with no name, bio or link to you. Usage records stay without any link to you.

Your choices and rights

• See and change your email address, password and two-step sign-in in Settings.
• Delete any conversation, report, playbook or draft, or your whole account, yourself.
• Ask us for a copy of your data, to correct it, or anything else about it, at admin@supersolution.io. We answer within 30 days.
• Depending on where you live, you may also have the right to object to some uses or to complain to your data protection authority.

Cookies and browser storage

We use only what signing in and remembering your settings need:

• A session cookie (HttpOnly, not readable by scripts) that keeps you signed in, for up to 30 days; the admin console has its own, for up to 12 hours.
• Short-lived cookies during a sign-in: one that ties a Google, Apple or X sign-in to your browser (10 minutes), one that holds a sign-in waiting for its two-step code (5 minutes).
• A language cookie that remembers whether you read the site and the app in English or Traditional Chinese, for up to a year. It holds only that choice.
• Your browser's local storage: a copy of your preferences, panel layout and light or dark theme.

There are no advertising or cross-site tracking cookies.

Security

Connections are encrypted (HTTPS). Passwords are hashed with Argon2id; session tokens, recovery codes and emailed links are stored only as hashes; sign-in secrets we must read back are encrypted at rest. Repeated password and code guesses are limited and locked out.

Children

FirstFa is not meant for anyone under 18, and we do not knowingly keep data about them.

Changes to this policy

If we change what we keep or who we share it with, we update this page and its date first, and tell signed-in users about any important change before it takes effect.