Privacy Policy

This Privacy Policy describes how TVM Investments (“TVM,” “we,” “us,” or “our”) collects, uses, discloses, stores, and otherwise processes personal information when you visit tvminvest.com (including tvm-investments.vercel.app), create an account, subscribe, submit feedback, or otherwise use our research tools (the “Service”).

It is intended to be a complete notice at collection for users in the United States (including California), the European Economic Area, the United Kingdom, and other jurisdictions that grant privacy rights. If you do not agree with this Policy, do not use the Service.

Document version 2026-09-15. This Policy should be read together with our Terms of Service and Risk Disclaimer.

What changed in this revision. On September 15, 2026 we added an in-product cookie consent sheet after sign-in (including for existing accounts on their next signed-in visit), a cookie customization tool, and we stopped loading Google Analytics until you allow it. On August 26, 2026 we added Support as a Settings note type next to bug reports and feature requests. On August 25, 2026 we updated this Policy so it matches how the live Service actually works: research tools now require a signed-in account; we store daily request counts to enforce plan limits; Settings notes are saved in our database and emailed through Google’s mail servers; and we spell out each category of data, why we collect it, and where it is processed.

1. Who we are

TVM Investments is the controller of personal information described in this Policy. We operate a market-research website. We are not a bank, broker-dealer, registered investment adviser, commodity trading advisor, or other licensed financial intermediary. We do not custody client assets and we do not execute trades.

We are based in the United States. We do not currently publish a postal mailing address. For privacy questions or requests: investmentstvm@gmail.com

2. Scope

This Policy applies to personal information we process in connection with:

• the public website, including landing, about, and legal pages;
• account registration, authentication, and the signed-in dashboard;
• watchlists, portfolio entries you type in, and settings;
• paid subscriptions and checkout when payment processing is enabled;
• bug reports, feature requests, support notes, and ratings submitted in Settings;
• server, security, quota, and diagnostic logs created while operating the Service.

It does not apply to third-party websites or services that we do not control, including Yahoo Finance, news publishers, Google (Firebase, Analytics, Gemini, and Gmail), Vercel, or Stripe. Their policies govern their own processing.

3. Notice at collection — what, why, and where

This table is the short version required by California and similar laws. Details follow in the sections below. We collect only the categories listed here. If we start collecting a new category, we will update this Policy first.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use watchlist or portfolio data to give personalized investment advice or to trade against you.

4. Categories of information we collect

4.1 Information you provide

• Account identifiers: email address, first name, last name, display name, and a unique user ID issued by Firebase Authentication.
• Credentials: passwords are collected at sign-up or password reset. Firebase Authentication hashes and stores them. We do not write your password into Firestore, Settings notes, or analytics.
• Workspace data: ticker symbols on your watchlist; cash and positions you type into the portfolio tracker (shares, average cost, optional purchase date); and similar saved preferences. These are values you enter. They are not imported from a broker.
• Legal acceptance: the version of the Terms, Privacy Policy, and Risk Disclaimer you accepted, and the time of acceptance.
• Feedback: whether the note is a bug report, feature request, or support, a 1–5 star rating, the message (8 to 4,000 characters), your account email, your user ID, whether we succeeded in emailing a copy, and the time of submission.
• Support correspondence: emails or other messages you send to a published contact address, if one is listed on this page.

4.2 Information collected automatically

• Authentication tokens: after you sign in, the dashboard sends a Firebase ID token with research requests to our servers so we can confirm it is you. Unsigned requests to those research routes are rejected.
• Usage counters: each allowed market-data, research, or feedback call increments a daily counter for your user ID so we can apply Free and Pro limits and a short burst limit (to stop rapid abuse). The burst limit is held briefly in server memory; the daily counts are stored in Firestore.
• Technical and security data: IP address, device and browser type, approximate time of access, request URLs, and error traces that Vercel, Firebase, or our application may record to operate, secure, and debug the Service.
• Session data: authentication cookies or tokens needed to keep you signed in, plus local or session storage used for legal acceptance at sign-up, the virtual tour, What’s New, complimentary-plan notices, appearance, and interface state.
• Usage data (analytics): page views, referring URL, device and browser type, and approximate location, collected by Google Analytics 4 so we can measure traffic.

4.3 Information from service providers

• Authentication: Firebase Authentication confirms that a sign-in is valid and provides the user ID we use to isolate your records. Google may also retain standard authentication metadata (such as last sign-in time).
• Payments: if checkout is enabled and you purchase a paid plan, Stripe receives payment details directly. We may receive a customer identifier, subscription status, plan, billing interval, and limited payment-method metadata (for example, last four digits and brand). We do not receive or store full payment card numbers or CVV codes.
• Market data: quotes, charts, fundamentals, and headlines are requested from third-party market-data sources using ticker symbols, not your name. Those providers may log the technical request from our servers.
• Language models: Google Gemini (and, if configured, OpenAI) may receive ticker symbols, numeric path statistics, and public headlines so we can classify news or draft a short research note. We do not send them your name, email, password, watchlist as a personal profile, or payment card number.

5. Information we do not collect

We do not ask you to provide, and you should not enter into any field:

• Social Security numbers, tax IDs, or government ID images;
• bank account, routing, or brokerage account numbers;
• brokerage usernames, passwords, or API keys;
• full payment card numbers (those go to the payment processor only);
• biometric identifiers;
• precise GPS location;
• health, race, religion, union membership, or sexual orientation.

Portfolio figures on the Service are values you type or that we derive from public market prices. They are not a live feed from your broker unless we later offer a separately disclosed integration, which this Policy would then describe.

6. How we use information

We use personal information to:

• create and authenticate accounts and keep you signed in;
• save and display your watchlist, portfolio, and related workspace data;
• apply Free or Pro plan limits, including daily request caps;
• generate, cache, and show research snapshots, charts, screens, and reports;
• receive, store, email, investigate, and respond to Settings notes;
• let operators review Settings notes and manage complimentary plans;
• maintain security, prevent abuse, debug outages, and keep logs;
• comply with law, enforce our Terms, and protect our rights;
• send transactional messages about the account or Service (for example, password reset or material legal updates);
• improve the Service based on aggregated or de-identified usage patterns.

We do not currently send marketing newsletters. If that changes, we will update this Policy and, where required, ask for consent.

6.1 Legal bases (EEA / UK / similar laws)

Where a “legal basis” is required, we rely on:

• Contract: to provide the account and Service you requested, including authentication, saved workspace data, plan limits, and paid features you purchase.
• Legitimate interests: to secure the Service, prevent fraud and abuse, keep essential logs and usage counters, understand product reliability, review Settings notes, and defend legal claims, in each case where those interests are not overridden by your rights.
• Consent: where we ask for it, including acceptance of this Policy at sign-up and optional analytics cookies after sign-in. You may withdraw analytics consent in Settings → Cookie preferences, or withdraw consent more broadly by closing the account, subject to information we must keep for legal reasons.
• Legal obligation: when we must retain or disclose information to comply with law, regulation, or valid legal process.

7. Cookies and similar technologies

We use cookies, local storage, and similar technologies that are:

• Strictly necessary: Firebase Authentication session cookies or tokens so the dashboard can recognize you; security and load-balancing cookies from Vercel. These stay on because the Service cannot operate without them.
• Functional: local or session storage for legal acceptance version, tour/release acknowledgements, appearance, and interface state (for example, a collapsed menu). You can turn this category off in the cookie tool; the desk still works, but those on-device reminders may repeat.
• Analytics: Google Analytics 4 (via Google Tag) to count visits and which pages are used. Advertising signals and ads personalization are turned off. We do not load Analytics until you allow it in the cookie tool (or a prior allow on this browser for signed-out pages). Google’s own privacy notice applies to that processing.

After you sign in, including on existing accounts, we present a cookie policy and customization tool until you save a choice for the current consent version. You can reopen it in Settings. We do not use third-party advertising cookies, cross-site behavioral advertising pixels, or a marketing tag manager. If that changes, we will update this Policy and, where required, request consent.

You can also block cookies in your browser. If you block necessary cookies, sign-in and account features may not work. Blocking Analytics cookies does not stop the account database from storing the workspace you save.

8. Signed-in research requests and usage limits

Public pages (including this Policy) can be read without an account. Quotes, charts, news, screens, forecasts, calculators, snapshots, and the Settings note form are served through our own API on Vercel. Those routes require a valid Firebase ID token in the request header. We verify the token with Google’s Firebase Admin SDK, then apply a short burst limit and a daily quota that depends on your plan.

Daily counts are stored in Firestore under your user ID (market, research, and feedback buckets) and reset at midnight Eastern Time. We keep the current day’s counts so the limit can be enforced. We do not sell these counters, and other users cannot read them.

9. Settings notes (feedback and ratings)

If you submit a bug report, feature request, or support note, we store the content, your rating, your account email, your user ID, whether an email copy was sent, and the time of submission in Firestore. Operators of the Service can read those records from an admin view in Settings. We also email a copy through Google’s Gmail SMTP service to our operations inbox. The inbox address is kept on our servers only; it is not shown in the public website or in the browser.

Feedback is not anonymous. Do not include passwords, payment card numbers, or other sensitive data in a note. We may delete submissions that contain them.

If mail delivery fails, the note may still be stored in Firestore so we can still see it. If both save and email fail, the form will tell you to try again.

10. Payments

Paid plans, when checkout is enabled, are processed by Stripe, Inc. and its affiliates (“Stripe”), or another processor identified at checkout. Stripe’s processing is described in Stripe’s own privacy notice. Card data is submitted to Stripe, not to our servers. We store only what we need to recognize your subscription and provide the plan you paid for.

Complimentary Pro may be granted by an operator. That grant is stored in your entitlements record (plan and a “complimentary” source flag), not as a card charge.

If you use a payment method that supports additional identity checks (for example, Link by Stripe), that provider’s terms and privacy notice also apply.

11. Automated processing and models

The Service uses quantitative rules and, in some cases, third-party language models (currently Google Gemini, with OpenAI as a possible fallback if configured) to classify headlines or draft short write-ups and forecast notes. Prompts include the ticker and public headlines or numeric path statistics. Those outputs are not credit, employment, insurance, or housing decisions. You can choose not to rely on them. Model providers process the text we send under their terms.

12. How we share information

We share personal information only as follows:

• Google LLC (Firebase Authentication and Cloud Firestore): account credentials, profile, watchlist, portfolio, entitlements, usage counters, and Settings notes. Processed in the United States on Google Cloud. Used to run the account and database.
• Google LLC (Google Analytics 4): page-view and device data as described above. Used to measure traffic.
• Google LLC (Gemini / Generative AI API): ticker, headlines, and numeric research context. Used to classify news or draft notes. Not used to identify you by name.
• Google LLC (Gmail SMTP): Settings notes, including your account email and message, so a copy reaches our operations inbox.
• Vercel Inc.: hosts the website and serverless functions (typically U.S. East). Receives HTTPS requests, may log IP address, user agent, URL, and errors, and holds server environment configuration. Used to deliver the Service.
• Yahoo (Yahoo Finance and related market-data endpoints): ticker symbols and request metadata from our servers, to retrieve quotes, charts, fundamentals, or news.
• OpenAI (only if we configure it as a fallback model provider): same class of research text as Gemini.
• Stripe: payment details when checkout is enabled, to charge for a paid plan.
• Resend or a similar email API (only if we configure it): would receive the same Settings-note content as Gmail SMTP.
• Legal and safety: if required by law, regulation, subpoena, court order, or to protect users, the public, or TVM from harm, fraud, or security threats.
• Business transfer: if we merge, are acquired, or sell assets, personal information may transfer to the successor, who must honor this Policy or provide notice of changes.
• With your direction: if you ask us to send information to someone else.

Other customers cannot read your account, watchlist, portfolio, usage counters, or Settings notes. Application access controls are designed so each signed-in user can access only their own documents. Operators of the Service (a small set of administrators) can read account emails, display names, plan status, and Settings notes in order to run and support the Service.

13. International transfers

We are based in the United States. If you access the Service from another country, your information is processed in the United States and possibly other countries where our processors operate. Those countries may have different data-protection laws than your own.

Where required (including transfers from the EEA or UK), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or our processors’ certified transfer mechanisms (for example, Google’s and Vercel’s published transfer terms).

14. Retention

• Account, watchlist, portfolio, entitlement, and related workspace data: for as long as the account remains open, then until we complete deletion after a verified request or after a period of inactivity we reasonably determine is abandonment.
• Legal acceptance records: for the life of the account and a reasonable period afterward to evidence agreement.
• Daily usage counters: overwritten as the Eastern calendar day changes; the document for your user ID remains while the account is open.
• Settings notes: for as long as needed to resolve the issue, operate the Service, and keep a support record, then as needed for our legitimate records or until a verified deletion request.
• Copies of Settings notes in our email inbox: until we delete that mail in the ordinary course, or sooner if you ask us to delete the underlying note and we can locate the copy.
• Research snapshots (market-wide, not tied to your name): retained on our systems for a limited archive window (currently on the order of sixty days unless we state otherwise) and then pruned.
• Security and server logs held by Vercel, Firebase, or Analytics: typically for a short operational period set by those providers, unless needed for an investigation or legal hold.
• Payment records: as required for tax, accounting, and dispute resolution, often several years, when checkout is used.

Backup copies held by processors may persist for a limited time after deletion from live systems.

15. Security

• In transit: connections to the Service use TLS/HTTPS.
• At rest: our processors encrypt stored data using industry-standard methods (Firebase/Google Cloud typically AES-256 at rest).
• Passwords: hashed by Firebase Authentication; not stored in our Firestore documents.
• Access control: Firestore security rules restrict a signed-in user to their own user, watchlist, portfolio, and related documents. Usage counters and Settings notes are written by our servers, not by other customers. Administrative access is limited to operators of the Service.
• Secrets: API keys, mail credentials, and similar secrets are stored in server environment configuration, not in the public website bundle.

This is not end-to-end encryption in which only you hold the key. Our processors must decrypt data to serve the application. No method of transmission or storage is 100% secure. You are responsible for choosing a strong password and keeping it confidential.

If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

16. Your choices and rights

You may:

• access and update watchlist and portfolio data in the dashboard;
• log out and stop using the Service;
• request access, correction, or deletion of personal information we hold, including your profile, workspace, usage counters, and Settings notes;
• request a portable copy of account data we can reasonably export;
• object to or request restriction of certain processing where the law provides that right;
• withdraw consent where processing is based on consent, without affecting prior lawful processing;
• opt out of marketing emails if we ever send them (transactional mail may still be sent).

To exercise rights, contact us: Privacy requests: investmentstvm@gmail.comWe may need to verify your identity (for example, by requiring you to send the request while signed in to the same account) before fulfilling it. We will not discriminate against you for exercising privacy rights. Where California law applies, we will respond within 45 days, or notify you if we need one permitted extension.

16.1 California (CCPA / CPRA)

California residents have the right to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined in California law. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA, because we do not collect such information in the ordinary operation of the Service.

Categories collected in the last 12 months, sources, purposes, and recipients are the ones listed in this Policy. We do not use your information to train a TVM advertising profile.

If we ever sell or share personal information, we will provide a “Do Not Sell or Share My Personal Information” method and honor browser opt-out preference signals as required.

You may use an authorized agent as permitted by California law. We may require proof of authorization and identity verification.

16.2 EEA, UK, and similar jurisdictions

You may lodge a complaint with your local supervisory authority. We encourage you to contact us first so we can try to resolve the issue. We do not currently maintain a separate EU or UK representative. Requests still go through the contact method on this page.

17. Children

The Service is for adults. It is not directed to children under 18, or under 13 where that is the relevant COPPA threshold. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

18. Do Not Track

Some browsers send a “Do Not Track” signal. There is no consistent industry standard for responding to it. We treat necessary cookies as described above and do not use advertising trackers. Google Analytics runs on production pages only after you allow analytics cookies.

19. Changes

We may update this Policy. The “Effective” date at the top will change. Material changes will be posted on this page and, where required, we will provide additional notice (for example in-product or by email). Continued use after the effective date constitutes acceptance of the updated Policy where the law allows. Where consent is required, we will ask for it.

This September 15, 2026 revision adds cookie consent after sign-in and holds Analytics until you allow it. This August 26, 2026 revision adds Support notes in Settings. The August 25, 2026 revision added usage counters, signed-in API tokens, Firestore copies of Settings notes, and mail delivery of those notes, and it names each processor and location we actually use.

20. Contact

Privacy and data-protection requests: investmentstvm@gmail.com

You can also submit the request from the signed-in Settings feedback form using the same account the request concerns, and say that it is a privacy request.