This Privacy Policy describes how 5Royals Investments LLC ("EverNorthstar," "we," "us") collects, uses, and shares information when you use evernorthstar.app and related services (the "Service").
1. What we collect
Account information
- Your email address (used as your login).
- A bcrypt hash of your password — we never store the password in plaintext.
- Your subscription tier and Stripe customer ID (for billing).
- Account preferences (daily-digest opt-in, alert rules you create).
Brokerage data (if you connect via Plaid)
- The institution name (e.g., "Fidelity"), an opaque Plaid item ID, and an encrypted access token.
- Position snapshots — ticker, name, quantity, price, value, cost basis, currency. Refreshed once daily.
- We do not see or store your brokerage username, password, or two-factor codes. Plaid handles authentication directly with your bank and only hands us a read-only access token.
Usage and technical data
- IP address and approximate location (from your IP) for security + abuse prevention.
- User-agent string and timestamps of requests for rate limiting and debugging.
- Pages you visit and features you use, in aggregated form (no third-party trackers as of the effective date).
Payment information
Payments are processed by Stripe. We do not store full card numbers — Stripe handles all card data and is PCI DSS Level 1 compliant. We retain a Stripe customer ID and a redacted summary (brand, last four digits) for receipt display.
2. How we use it
- To deliver the Service: serve your dashboard, sync your brokerage holdings, send your daily digest, fire your alerts.
- To bill you and prevent fraud.
- To respond to support requests at support@evernorthstar.app.
- To send transactional emails (account confirmation, billing receipts, alerts you opted into).
- To improve the Service in aggregate — for example, debugging slow queries.
We do not sell your personal information to third parties. We do not show third-party ads and do not run behavioral profiling on you.
3. Subprocessors
We rely on the following service providers ("subprocessors") to operate the Service:
- Stripe — payment processing and customer billing.
- Plaid — read-only brokerage account access (only if you opt in by connecting an account).
- Fly.io — application hosting and database storage (US-based region: Ashburn, VA).
- Vercel — frontend hosting and CDN.
- Cloudflare — DNS management for evernorthstar.app.
- Resend — outbound transactional email (daily digest, alerts, billing receipts).
- Anthropic — AI summarization for the Ask Why button, Daily Digest, and Earnings Recap features. Anthropic receives anonymized public market data and our prompt — never your account email, billing details, or brokerage holdings.
- Financial Modeling Prep (FMP) — fundamentals and Congressional trade data.
- NOWPayments — optional crypto payment processing (only if you opt to pay with crypto).
Each subprocessor handles a narrow slice of data necessary for their function. We do not authorize them to sell or repurpose your data.
4. Data retention
- Account data: retained while your account is active and for up to 90 days after you delete it (for billing reconciliation and abuse investigation).
- Brokerage holdings snapshots: retained as long as the connection is active. Deleted when you disconnect.
- Payment records: retained for 7 years as required by US tax law.
- Logs: retained for up to 30 days.
5. Your rights
Depending on where you live (e.g., California, EU, UK), you may have additional rights:
- Access — request a copy of your personal data.
- Correction — update inaccurate data.
- Deletion — request we delete your account and associated data.
- Portability — receive your data in a machine-readable format.
- Opt-out — unsubscribe from non-transactional emails at any time.
To exercise any of these, email support@evernorthstar.app. We respond within 30 days.
California residents: we do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).
6. Security
- All traffic to and from the Service is encrypted in transit via TLS 1.2+.
- Brokerage access tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256) with a key derived from a server-side secret never stored alongside the data.
- User passwords are hashed with bcrypt before storage.
- Admin access to production infrastructure is restricted to the founder and requires multi-factor authentication.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately so we can revoke sessions and investigate.
7. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.
8. Changes to this policy
We will post material changes to this Policy at least 14 days before they take effect, with a notice via email or in-product banner. The "Effective date" at the top of this page reflects the most recent revision.
9. Contact
Privacy questions or requests: email support@evernorthstar.app. For our mailing address, request it via email.