Privacy Policy

Last updated: October 7, 2026

This policy explains what personal information Yinly LLC ("Yinly", "we", "us") collects, why, and what control you have over it. It covers getyinly.com and our subscription service.

We have written it to describe what we actually do, not a generic template. If something below is not listed, we do not do it.

---

1. The short version

• We collect what a paid membership needs: your email address, your TradingView username, your account sign-in details, and the account, membership, purchase and billing records described in Section 2.
• Your card details go to Stripe, not to us. The payment form on our checkout page is Stripe's own embedded component; what you type into it is sent directly to Stripe. Yinly's systems never receive or store card numbers. We do receive limited billing information from Stripe (Section 2).
• We do not sell or share your personal information for advertising, and we set no advertising pixels. We use Cloudflare Web Analytics to understand website traffic and performance without analytics cookies.
• We do not ask about your finances, holdings, income, or investment goals — deliberately, because Yinly is an impersonal tool and does not give personal advice.
• Our service providers are Stripe, Supabase, Resend, Vercel, Cloudflare, Google Workspace, and TradingView (Section 5).

2. What we collect

You give us:

Created when you use the Service (account, membership, purchase and billing records):

• Account records: a Yinly account identifier, the date the account was created, and when your email was confirmed and your account activated.
• Membership records: your Stripe customer identifier and subscription identifier, subscription status, plan, current billing period end, whether a cancellation is scheduled, whether TradingView access has been granted, and any TradingView username change request you submit.
• Purchase records: for each checkout you start, an order record with the email address and TradingView username you entered and the plan you chose, together with the Stripe checkout session identifier. Once paid, it also holds the Stripe customer, subscription, invoice and price identifiers, the amount and currency, and timestamps. A purchase record is created before your account exists, because the account is created only after payment. Paid purchase records are part of our billing records.
• Payment history: the date, description, amount and status of your invoices, read from Stripe when you open your account page.
• Email delivery records: for each transactional email we send you — recipient address, type of message, timestamps, delivery status and the provider's message identifier. For activation emails we also keep an encrypted copy of the link so that a failed send can be retried without invalidating it.
• Payment notifications: the notifications Stripe sends us about your payments and subscription, kept so that they can be processed reliably.

Collected automatically:

Cloudflare Web Analytics does not use cookies or browser storage to track visitors across websites. Cloudflare states that it does not log URL query strings. We do not send account email addresses, TradingView usernames, passwords, or payment details as analytics events.

From Stripe: subscription status, plan, billing period, payment success or failure, and refund and dispute status. We use this to keep your access current. In Stripe's dashboard we can also see your billing name and address and the card brand and last four digits, which we use only for billing support.

3. What we do not collect

We want to be explicit, because policies copied from other companies routinely claim otherwise:

• Card numbers, CVV, or bank details on our systems. The payment form on our checkout page is Stripe's embedded component: card details go from your browser to Stripe, not through Yinly's servers. Yinly never receives, processes, or stores them. What we can see is the card brand and last four digits that Stripe shows us for billing support.
• Your brokerage accounts, holdings, positions, trades, or portfolio. We have no connection to any broker and no ability to see or place trades.
• Your income, net worth, risk tolerance, or investment objectives. We never ask. Yinly applies the same fixed rules to every chart for every subscriber; it is not tailored to anyone, and collecting this would misrepresent what the product is.
• Government identifiers, biometrics, precise geolocation, or health data.
• Advertising or cross-site behavioural-tracking data.
• Information from children. The Service is for adults 18 and over.

4. Why we use it (and, for GDPR, our legal basis)

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not profile you.

We also use aggregate website traffic and performance reports to understand how our website is used and where its performance can be improved.

5. Who we share it with

We share personal information only with the service providers that make the business run, and only what each needs to provide its service to us under contract. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Disclosures to the providers below are disclosures to service providers or processors, not sales and not sharing for advertising, as those terms are used in California and EU law.

We may also disclose information where required by law, valid legal process, or to protect our rights, safety, or property — and, if we ever sell or merge the business, to the acquirer, with notice to you.

Note on TradingView: because access is delivered on their platform, your TradingView username is visible to us and access grants are recorded there. Your use of TradingView itself is governed by TradingView's own privacy policy, which we do not control.

6. How long we keep it

• While you subscribe, plus 24 months afterwards, so we can handle billing questions, reinstatement, and disputes. This covers your account, membership, email-delivery and payment-notification records.
• Billing and tax records, including paid purchase records, for the period required by law — generally seven years in the United States.
• Checkout records that did not lead to a payment for no longer than the subscriber period above.
• Security logs for 30 days.
• Rate-limit records only as long as the limit they enforce.
• Support correspondence for 24 months.

After that we delete it or irreversibly anonymise it.

7. Your rights

Everyone. You can ask us to give you a copy of your data, correct it, delete it, or stop marketing to you. Email support@getyinly.com. We respond within 30 days. We will not discriminate against you for exercising these rights.

California (CCPA/CPRA). You have the right to know the categories and specific pieces of personal information we collect, the sources, the purpose, and who receives it; to delete it; to correct it; to opt out of sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of — but the right exists and you may exercise it. The only sensitive personal information we handle is your account password (held as a hash by Supabase Auth) and, through Stripe, your card details; we use them only to sign you in and take payment, never to infer anything about you, so the right to limit does not apply to that use. You may use an authorised agent.

EEA and UK (GDPR). You additionally have the right to restrict or object to processing, the right to data portability, the right to withdraw consent at any time, and the right to complain to your supervisory authority — in the UK, the Information Commissioner's Office.

International transfers. Yinly operates in the United States and our providers are largely US-based, so your data will be processed there. Where we transfer personal data out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the relevant provider.

8. Cookies and tracking

We use only the cookies needed to run the site. Cloudflare Web Analytics measures website traffic and performance without cookies or browser storage, and we set no advertising or tracking cookies.

These are strictly necessary, first-party, and never used for tracking. Stripe's embedded payment form on our checkout page, and Stripe's customer portal, set Stripe's own cookies for fraud prevention and session handling, governed by Stripe's privacy policy.

We do not run advertising, retargeting, or social media pixels, and we do not respond to Do Not Track signals because no common standard for them exists. We honour Global Privacy Control signals where required by law.

9. Security

We use encryption in transit, access controls, multi-factor authentication on administrative accounts, and providers who maintain recognised security standards. Passwords are stored only as hashes by Supabase Auth. Activation and password-reset links are single-use and expire. Sign-in, checkout and account endpoints are rate-limited using keyed hashes rather than raw addresses. Keeping card data entirely with Stripe is itself a deliberate security decision — data we never hold cannot be taken from us.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the relevant authorities as required by law, including California's breach notification statute and, where applicable, the GDPR's 72-hour rule.

10. Marketing email

We send service messages — activation links, receipts, renewal notices, access changes — as part of the contract; you cannot opt out of those while you subscribe.

Marketing email is separate and opt-in. Every marketing message has an unsubscribe link that works, and we honour it promptly.

11. Changes

If we change this policy materially we will email subscribers and update the date above before the change takes effect. The current version always lives at https://getyinly.com/privacy.

12. Contact

Questions, requests, or complaints:

support@getyinly.com

---

Read together with the Terms of Service, Risk Disclosure, and Billing and Cancellation Policy.