Privacy notice

When you request access, Constraint Alpha stores your email address, the time and version of your consent, verification status, and newsletter export status. A one-way, keyed summary of your IP address is retained for up to 30 days solely to prevent abuse; the raw address is not stored by the application.

Purpose: Your email verifies free member access. The general newsletter is optional and personalized Monitor digests require a separate opt-in. Verified and consenting addresses may be transferred to Substack as the newsletter delivery provider. Supabase processes access records, Resend delivers verification emails, and Substack delivers newsletter messages.

Cookies and analytics: Constraint Alpha uses a strictly necessary first-party access cookie named __Host-ca_access to remember verified directory access on this device for up to 180 days. This cookie is HttpOnly, Secure, and SameSite=Lax, and is not used for advertising or cross-site tracking. Google Analytics may use first-party identifiers such as _ga to measure site usage. Vercel Web Analytics may collect aggregate site usage data without cookies.

X-Ray action counts: X-Ray records only daily totals for analyses, PNG downloads, completed shares, copied links, shared-link openings and Atlas clicks. No selected tickers, portfolio amounts, cookies or visitor identifiers are included. Counts represent actions, not unique people; repeated events are suppressed per page load. Do Not Track and Global Privacy Control disable these counts. Images are created locally. Share links contain selected tickers in their URL fragment, visible to recipients. Hosting providers may retain standard request logs.

Usage measurement: Google Analytics measures visits, free analysis views and the access steps (button clicks, link requests, successful verification and Atlas visits). Our funnel event parameters do not contain email addresses, verification tokens, search queries or private thesis text. Fixed public company identifiers may accompany company-follow events. Measurement URLs exclude query strings and fragments. Recognized campaign source, medium and campaign names are selected from fixed public allowlists; all other tags are discarded. External referrers are reduced to their origin, with paths, queries and fragments removed. The browser-local ca-analytics-excluded preference disables GA4 and funnel events during owner testing; it does not disable hosting logs or independently loaded Vercel analytics. Do Not Track and Global Privacy Control disable Google Analytics and our funnel events. X-Ray continues to use separate daily action totals without visitor identifiers. A first-party cookie named ca_verified_event lasts up to two minutes and is removed after the next page reports verification; it is not an access credential. Session storage limits the Atlas-open event to once per tab session. Analytics may use its own identifiers and can be blocked using browser controls.

Your choices: You can unsubscribe using the link in any newsletter. To request access to or deletion of your stored information, contact Constraint Alpha through the reply/contact channel shown in the newsletter. Access records are retained while the directory and newsletter operate, unless deletion is requested or retention is no longer necessary.

Last updated: October 29, 2026.