Privacy Policy

Last updated: August 23, 2026

Our tools respect your browsing privacy. Independently verified:

1. Information we collect

We collect only what we need to run the Site, to answer beta access requests, and to send you anything you explicitly ask for:

• Calculator inputs. The calculators on this Site compute in your browser. Salary, share counts, strike prices, grant dates, and the other figures you enter are not transmitted to us. Three things are exceptions, and each one is an action you take deliberately. Picking a ticker sends that ticker symbol, and nothing else, to our data service so it can return option pricing. Asking us to email you a scenario sends that scenario, as described below. The interactive API playground on our For Agents page posts whatever text you put in its input box to our public API. Separately, note that your inputs are written into the page address so a scenario can be bookmarked, reopened, or shared: anyone you send that link to can read those figures from it. They are placed in the part of the address after the # mark, which browsers do not transmit when requesting pages, so the figures stay out of server and network logs and travel only when you share the link yourself.
• Beta signup form. Your email address (required). Optionally your name, a question or comment limited to 280 characters, and three qualification answers: which equity types you hold, an approximate band for the value of your equity position, and your company’s stage. We also record attribution values: which version of the page you arrived from (first and most recent), the referring site, the page you landed on, any campaign tags in the link you followed, and, if you arrived from an AI assistant using our MCP server, an identifier for that session so the signup can be connected to it. These tell us which pages and channels generate interest. When you sign up, we send a confirmation email to the address you entered to verify it is really yours; we store a one-way hash of the confirmation link’s token and whether and when the address was confirmed. When we reply by email, your email address is used as the “reply-to” on our internal notification, so a direct response from us reaches your inbox.
• Scenario email. If you ask us to email you a scenario you have just run, we collect your email address, the link to that scenario, which tool it came from, whether you opted into the beta list, the exact consent wording you saw, and the same attribution values described under the signup form. We also store a one-way hash of a normalized form of your address (lowercased, with mailbox aliases such as plus-tags folded together), used only to rate limit repeated requests. Because your inputs are encoded in the link, the record we keep contains those figures next to your email address. We store it so we can send the message and so we can act on a later deletion request. We do not use it to build a profile of you and we do not market to you on the basis of it.
• Product telemetry. When you complete a calculation, we record which tool it was, which company page you were on if it was a per-company calculator, a random identifier for your browser tab, and the referral source. When you click a link that leaves the Site, we record only which link it was and which page it was on. These records carry no financial values: page addresses are recorded without their query string, so the figures you entered cannot reach them.
• Network and security data. Our hosting provider (Cloudflare) processes standard request metadata at the network edge, including IP address, user-agent, and request time, for the purpose of routing traffic, mitigating abuse, and serving the Site. When you submit the signup form, we additionally store in our own database your user-agent, the country Cloudflare reports for the request, and the referring address if your browser sends one (the Site sets a no-referrer policy, so current browsers do not). When you submit the signup form or request a scenario email, we store a truncated one-way hash of your IP address; the hash lets us rate limit abusive traffic without keeping the address itself. We do not otherwise retain raw request logs; Cloudflare’s own retention is governed by its policies.
• Analytics. When enabled, we use Cloudflare Web Analytics, which is cookie-free and, per Cloudflare’s product documentation, does not build cross-site profiles. It reports aggregate page-load and Core Web Vitals metrics. If analytics are not enabled in our environment, no analytics calls are made from your browser.

2. How we use this information

• To respond to your request for beta access and to send beta-related communications.
• To send you a scenario when you ask us to email you one.
• To understand which pages and referral sources drive interest in the product.
• To detect, prevent, and respond to abuse of the Site or the beta program.
• To comply with applicable law.

We do not use your information for advertising or to build advertising profiles. We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA).

3. Service providers we use

We share information with the providers we rely on to run the Site. The current list includes:

• Cloudflare — hosting (Cloudflare Pages), serverless backend (Cloudflare Pages Functions), the database in which signups, scenario email requests, and product telemetry are stored (Cloudflare D1), bot mitigation on our forms (Cloudflare Turnstile), and privacy-friendly analytics (Cloudflare Web Analytics).
• Resend — transactional email delivery for beta signup notifications.
• Zoho Mail — hosts the inbox at beta@alphalatitude.com where signup notifications are delivered.
• Railway and Supabase — host the OptionsAhoy application and its database. When we review beta requests, signup information is read by the application’s admin screen, and when we approve a request, the email address is added to the beta allowlist stored in Supabase.

We may update this list from time to time as our infrastructure changes. We may also disclose information when required by law, to enforce our terms, or to protect the rights, safety, or property of AlphaLatitude or others.

4. Cookies and browser storage

The Site does not set advertising or tracking cookies. Cloudflare may set a small number of operational cookies for security and bot mitigation; these are not used for advertising. Cloudflare Web Analytics, when enabled, does not use cookies.

The calculators do use your browser’s local storage, which is not a cookie. Each calculator saves the figures you entered on your own device so that closing the tab and returning later reopens your scenario where you left it; those saved figures stay on the device and are never sent to us. We also keep a small number of attribution values there (which page you first arrived from, the referring site, any campaign tags, and an identifier from an AI-assistant session if you arrived through one). Unlike the calculator figures, the attribution values are transmitted to us when you submit the signup form, request a scenario email, or complete a calculation, so that the signup or completion is credited to the page or campaign that brought you in. All of it persists on the device until you clear it. If you are using a shared or employer-managed computer and would rather it not persist, use the button below to erase everything the Site keeps in this browser; you can also clear site data for optionsahoy.com in your browser settings, or use a private window.

5. Retention

Beta signup submissions are written to our database (Cloudflare D1) and are also delivered to an inbox at beta@alphalatitude.com. The database row is the record we work from; the email is a notification on top of it. Both are retained while the beta program is active or for as long as needed to respond to your request, whichever is longer.

Scenario email requests are retained in the same database while the beta program is active, with one deliberate exception: the scenario link itself, which encodes the figures you entered, is deleted from the record seven days after the email is sent by an automated daily job. What remains after that is the fact of the send (your address, the tool, timestamps, and consent wording), kept so we can honor rate limits and deletion requests. Product telemetry (which tool was completed, which link was clicked) is retained for as long as it is useful for understanding how the Site is used.

You may request deletion of any of it at any time using the contact below, and we will delete it across all of these locations, including any copy in the beta allowlist. Provider-side retention (for example, Resend’s email logs or Cloudflare’s edge logs) follows each provider’s standard retention schedule.

6. Your rights — California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights with respect to your personal information, subject to the conditions and exceptions set out in those statutes:

• Right to know. You may ask us to disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties to whom we disclose it.
• Right to delete. You may ask us to delete personal information we have collected from you, subject to statutory exceptions (including for security, legal compliance, and the completion of transactions reasonably anticipated within our ongoing relationship).
• Right to correct. You may ask us to correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell or share your personal information, as those terms are defined under the CCPA.
• Right to limit use of sensitive personal information. If you ask us to email you a scenario, the link we store can contain figures you entered, such as an income assumption or the value of an equity position. That is personal information and we treat it as such, but it is not “sensitive personal information” as the CCPA defines that term, which covers categories such as government identifiers, financial account numbers, precise geolocation, and health data. We do not collect those, and we do not use any information to infer characteristics about you. If that changes, we will provide the required notice and a way to exercise this right.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at privacy@alphalatitude.com with the subject line “Privacy Rights Request.” You may use an authorized agent to submit a request on your behalf; we may require verification of the agent’s authority and your identity before responding.

7. Your rights — EEA, UK, and Switzerland residents

The Site is operated from the United States and is intended primarily for US residents. If you submit personal information to us from the European Economic Area, the United Kingdom, or Switzerland, the following applies:

• Controller. AlphaLatitude Inc. is the controller of your personal information for the purposes of the EU/UK General Data Protection Regulation (GDPR) and equivalent laws.
• Legal bases. We process your beta signup information on the basis of your consent (Art. 6(1)(a) GDPR) and, for security, abuse prevention, and analytics, our legitimate interests in operating and protecting the Site (Art. 6(1)(f) GDPR).
• International transfers. Our service providers (Cloudflare, Resend, Zoho) process data on infrastructure located in the United States and other jurisdictions. Where required, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent UK transfer mechanisms.
• Your rights. Subject to applicable law, you have the right to access, rectify, erase, restrict the processing of, and port your personal information; to object to processing based on legitimate interests; to withdraw consent at any time without affecting the lawfulness of prior processing; and to lodge a complaint with your local supervisory authority.
• Data Protection Officer. Given the scale of our processing, we are not required to appoint a DPO and have not done so. Contact privacy@alphalatitude.com for any data-protection questions.

8. The OptionsAhoy beta platform

If you are admitted to the OptionsAhoy beta and use the OptionsAhoy optimization platform (the “Platform”), additional data practices will apply. Use of the Platform is governed by the Beta Testing & Confidentiality Agreement signed at enrollment. Platform-specific data flows will be disclosed to you before access is granted.

9. Security

We use commercially reasonable technical and organizational measures to protect personal information. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

You do not have to take this page’s word for any of it. The badges at the top of this page each link to a scanner that will inspect the live Site on demand, in seconds, for free. The security-headers grade is drawn live from the scanner itself, so it shows the current result rather than a figure we typed in. Here is what each scanner checks:

• Blacklight (The Markup, a nonprofit newsroom) loads the Site in an instrumented browser and reports every ad tracker, third-party cookie, session recorder, keystroke logger, fingerprinting script, and advertising pixel it finds. Its August 2026 scan of this Site found zero in every category.
• Webbkoll (Dataskydd.net, a Swedish data-protection nonprofit) checks cookies, third-party requests, referrer leakage, and HTTPS configuration against General Data Protection Regulation (GDPR) expectations.
• HTTP Observatory (Mozilla) grades the Site’s security headers, including the content security policy that limits what code is allowed to run on these pages.

10. Children

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page indicates when changes were last made. We will communicate changes by posting an updated version on the Site.

12. Contact

Questions about this Privacy Policy or about how AlphaLatitude handles your information may be sent to:

AlphaLatitude Inc.
Sunnyvale, CA
Email: privacy@alphalatitude.com