1. About this policy
Windsock Market Alerts Pty Ltd, ACN 691 330 177, operates Project Windsock. This policy explains how we handle personal information when you visit our website, create an account, configure alerts, use enabled Alpaca paper-account features or contact us. Alpaca handles information in its own services under its own privacy policy.
For privacy questions or complaints, contact David Wu at david@vaccountants.com.au or write to C/- David Wu, Suite 1, Level 1, 167 Albert Street, Brisbane City QLD 4000, Australia. Account, access, correction and deletion requests can also be sent to support@projectwindsock.com.
2. Information we collect
Account information includes your name, email address, authentication records and, where supplied for notification features, telephone number. We also keep account activity records, watchlists, alert configurations and notification preferences. Alert-delivery records can include your internal user identifier, symbol, message, delivery channel and timestamp.
When you authorise an Alpaca connection, we receive an OAuth token and paper-account information, including account identifiers and status. We record connection activity and verification or disconnection times, and retrieve simulated balances and buying power for enabled account displays. Personal paper-order and trade records are linked to your Windsock account and may include symbols, directions, quantities, order identifiers, statuses, timestamps, fills, simulated gains or losses and failure reasons.
Our internal automated benchmark records market observations, signals, strategy settings and simulated orders and outcomes. It uses a separate benchmark paper account rather than a user's connected account. Administrative test actions can be associated with the administrator who initiated them.
We process support messages and operational records used to diagnose faults and protect the service. Production errors are logged in Sentry and Render. User-related errors can include an internal user ID and diagnostic details; these records are not treated as anonymous. Hosting, communications, monitoring and analytics providers may also process technical metadata associated with their services, such as request, device, browser, network or delivery information. Do not send passwords, access tokens or unnecessary financial documents to support.
3. How we collect and use information
Information comes from you, your use of the application, providers delivering requested communications and Alpaca after you authorise a connection. You authenticate directly with Alpaca; Windsock does not receive your Alpaca password through OAuth.
We use information to create and secure accounts, provide market monitoring and alerts, operate authorised paper-account features, respond to enquiries, diagnose faults, investigate misuse, meet applicable legal obligations and resolve disputes.
We send account and verification messages, service communications and the alerts you configure. Alerts use available email or SMS options; email may be used when the SMS allowance is exhausted. We do not currently send promotional material or newsletters. You can stop an alert by deleting its configuration.
We do not sell personal information or share it with advertisers or affiliate partners. We do not send user data to external AI services. Any future change to these practices would require updated disclosures and any necessary permissions before introduction.
5. Who receives information
Our Founder and CTO have Windsock administrator accounts and can access information needed to operate and support the service. Both monitor the support mailbox. Administrative access to our Netlify, Render and Neon services is held by our CTO through an individual GitHub-authenticated account protected by two-factor authentication.
Netlify hosts the static website and client through its content delivery network. Render hosts the API and processes application requests and runtime logs. Neon hosts the PostgreSQL database and its snapshots.
SendGrid delivers email and Twilio delivers SMS, processing recipient details, message content and delivery information. Google Analytics processes website usage information after consent. Sentry processes diagnostic events and sends error notifications for review. GitHub supports development and authentication to our hosting services. Alpaca receives authorised account and trading requests and the information needed to process them.
We may also disclose information where required by law or reasonably necessary to address unlawful activity or a security incident, subject to applicable law. We do not routinely disclose user information to other parties for their own marketing.
6. Overseas processing
Our application information is processed and stored outside Australia. The API is hosted on Render in Virginia, United States. The database is hosted on Neon in AWS US East 2, Ohio, United States. Our Sentry logs are stored in the United States.
Netlify uses a distributed content delivery network. Communications, analytics, support and other provider operations may involve additional processing locations. We do not represent that every provider-held copy is confined to Virginia or Ohio. Contact our privacy representative for information about the providers and arrangements relevant to your request. Our Australian company location does not mean that application information is stored in Australia.
7. Security
We use application access controls, individual hosting-service access and two-factor authentication for our CTO's GitHub account. Stored Alpaca access tokens are protected using ASP.NET Core Data Protection. Server secrets are held in server configuration rather than browser-delivered application configuration.
Windsock application accounts currently use username and password without multi-factor authentication, including administrator accounts. Our team reviews production error notifications and investigates reported security issues. No method of storage or transmission can be guaranteed completely secure. Contact us promptly if you suspect unauthorised account activity.
8. Retention and deletion
Account data, alerts and personal trade history are not automatically deleted after a fixed age. We handle account deletion on request. Separate technical records can have their own retention periods: benchmark research captures are currently retained for 7 days, Sentry logs for 30 days and Render runtime logs for 14 days. Communication-delivery and analytics retention depends on the provider and account settings; contact us for information relevant to your request.
Neon takes daily database snapshots at 05:00 UTC and retains them for a rolling 21-day window. Snapshot expiry is separate from deletion of active application records.
There is currently no self-service account-deletion workflow. Request closure and deletion at support@projectwindsock.com. We verify account ownership and may ask for additional verification, including SMS where appropriate. We handle requests manually and delete your Windsock account and associated data from active records within 7 days of the request, subject to identity verification and any required retention that we explain.
Information removed from active records may remain in earlier snapshots until they expire within the rolling 21-day window. Provider-held communications, logs and analytics records are subject to their separate retention and deletion processes; the active-account deletion period is not a promise that every provider copy disappears within 7 days. We will explain relevant limits when handling your request.
Disconnecting Alpaca deactivates the connection and clears its stored token from the active record. It does not itself delete account metadata, historical activity or backups. You may also manage application permissions through Alpaca's own controls.
9. Your choices, access and correction
You can choose not to provide optional information, decline analytics or leave Alpaca disconnected, although related features may then be unavailable. You can delete configured alerts to stop them; this does not itself delete historical records or your account.
You can request access to or correction of your personal information through support@projectwindsock.com. Requests are handled manually and may require proportionate identity verification. We aim to respond within 7 days. This is a response target, not a guarantee that every request will be completed within that period.
Additional rights may apply depending on your location and the law that applies. Contact us to exercise those rights. If we cannot fulfil a request, we will explain the reason, any lawful basis for refusal and available review options.
10. Complaints and policy changes
Send privacy complaints to david@vaccountants.com.au. We aim to acknowledge complaints within 7 days and provide a response within 14 days, or explain any delay. If unresolved, you may contact the relevant privacy regulator where it has jurisdiction, including the Office of the Australian Information Commissioner.
We will publish updates with a revised effective date. For significant changes, we will notify existing users by email and through an in-app notification linking to the updated policy. This policy does not claim a certification or determine whether the operator is covered by a particular privacy law.