Privacy Policy

Last updated 11 August 2026 · INSIDER SCANNER is operated by the team behind the site. Questions about this document: admin@insiderscanner.net

1. Who is responsible for your data

INSIDER SCANNER is operated by the person behind this site, who is the data controller for the information described here. There is no company, no staff and no third-party marketing operation behind it. Contact: admin@insiderscanner.net.

2. What we collect

If you only read the site

You can browse every public page — signals, company pages, the screener, performance pages — without an account and without giving us any personal information.

Our hosting provider records standard server logs for every request, which include your IP address, the page requested, the time, your browser's user-agent string, and the response status. These are ordinary technical logs used to keep the site running and to investigate abuse.

If you create an account

We store only what an account needs to function:

• Username and email address, as you supply them.
• A one-way password hash. Your password is processed through a slow, salted hashing algorithm and stored only in that form. We cannot read it, recover it, or tell you what it is — and neither can anyone who obtained a copy of the database.
• Account status — whether the account is active, and which access tier it holds.
• Security timestamps — when the account was created, when it last signed in, the count of consecutive failed sign-in attempts, and any temporary lock expiry.

If you use the optional portfolio tracker

The portfolio tracker is off by default and only holds what you type into it: a ticker, a share count and an average cost per share, for each position you choose to log. This is manual, self-reported data — we have no way to connect to a brokerage, so nothing is verified against or pulled from any real account. It is visible only to you, is used only to compute cost basis and, where a price is available, market value and gain/loss on the portfolio page, and is never sold or shared. You can remove any entry at any time, which deletes it immediately.

Security and abuse prevention

We apply rate limits to sign-in and registration, keyed on the requesting IP address, to make automated password-guessing impractical. This processing is transient and is not used to profile you.

3. What we deliberately do not collect

This list is as important as the one above:

• No brokerage access. We never ask for, and have no way to receive, your brokerage login, real account balance, or verified trading history. Do not send them to us. This is different from the optional portfolio tracker, which only ever stores the ticker, share count and cost you deliberately type in yourself — see Section 2.
• No payment data. The Service is free and has no payment system. We hold no card numbers.
• No identity documents, date of birth, address or phone number.
• No advertising or analytics trackers. There is no Google Analytics, no advertising pixel, no cross-site tracking cookie and no data broker relationship.
• No sale of data. We do not sell, rent or trade personal information, and we have no commercial arrangement under which anyone receives it.

4. Why we process it, and on what legal basis

For readers in the United Kingdom or European Economic Area, the legal bases under the UK GDPR and EU GDPR are:

• Performance of a contract (Art. 6(1)(b)) — creating and operating your account, authenticating you, and keeping you signed in.
• Legitimate interests (Art. 6(1)(f)) — keeping the Service available, secure and free from abuse, through server logs, rate limiting and sign-in lockouts. We consider this proportionate because the data involved is minimal, retained briefly, and not used to profile anyone.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with a binding legal requirement.

We do not rely on consent for any of the above, because none of it is optional to the operation of an account. If we later introduce advertising or non-essential cookies, we will ask for consent first.

5. Cookies

We set one cookie, and only after you sign in:

• aiinsider_session — a signed session cookie that keeps you logged in. It is marked HttpOnly (unreadable by JavaScript), SameSite=Lax (not sent from other sites), and Secure in production (sent only over HTTPS). It expires after twelve hours, and is deleted when you sign out.

Your browser may also store a small preference recording whether you chose the light or dark theme. That stays on your device and is never transmitted to us.

We set no advertising, analytics or cross-site tracking cookies.

6. Third parties your browser contacts

Some page content is served by third parties. When your browser loads it, it connects to them directly, and they will see your IP address and standard request headers. That connection is governed by their privacy policies, not ours.

• TradingView — supplies the interactive market chart embedded on the market pages.
• Google Fonts — serves the typefaces the site is set in.

We do not send either of them any information about you. We have no data-sharing arrangement with either.

7. Where your data is stored

The Service and its database are hosted with Render in a data centre in Oregon, United States. Account data is stored in a managed PostgreSQL database in that same region.

For readers in the United Kingdom or European Economic Area, this means your account data is stored outside the UK and EEA. The United States is not the subject of a general European Commission adequacy decision, and transfers rely on our legitimate interest in operating the Service together with the safeguards our hosting provider applies. The data involved is deliberately minimal — a username, an email address, an unreadable password hash, and any holdings you choose to type into the portfolio tracker — and we will implement a formal transfer mechanism if the scope of processing grows.

The operator accesses the Service from Kuwait, which is likewise outside the EEA and not the subject of an adequacy decision. That access is limited to what is necessary to operate and support the Service.

8. How long we keep it

• Account data — for as long as your account exists. If you ask us to delete it, we remove it within 30 days.
• Server logs — retained by our hosting provider on their standard rolling schedule, typically a short window measured in days, then discarded.
• Rate-limit counters — transient, held only for the duration of the limit window.

We do not keep backups of deleted accounts for marketing or re-activation purposes.

9. How we protect it

• All traffic is served over HTTPS.
• Passwords are stored only as slow, salted, one-way hashes — never in readable form, and never recoverable.
• Session cookies are HttpOnly, SameSite=Lax and Secure, and expire after twelve hours.
• Sign-in and registration are rate limited, and an account locks temporarily after repeated failed attempts.
• Forms are protected against cross-site request forgery.
• Sign-in responses are deliberately identical whether or not an account exists, so the site cannot be used to discover who has registered.

No system is perfectly secure. We give no absolute guarantee, and you should use a password unique to this site. If we become aware of a breach affecting your personal data, we will notify you and any competent supervisory authority where the law requires it.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Rectify data that is inaccurate or incomplete;
• Erase your data (“right to be forgotten”);
• Restrict or object to processing carried out on the basis of legitimate interests;
• Port your data to another service in a machine-readable form;
• Withdraw consent where processing was based on it; and
• Complain to your local data-protection supervisory authority.

To exercise any of these, email admin@insiderscanner.net from the address registered to your account. We respond within 30 days. There is no charge, and we will not penalise you for asking.

Because we hold so little, an access request will generally return your username, your email address, your account status and your security timestamps — and nothing more.

11. Children

The Service is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

12. Advertising and paid features

There is currently no advertising on the Service and no paid tier. If either is introduced, third-party advertising or payment providers may set their own cookies and receive their own data, and this policy will be updated in advance to name those providers and describe what they receive. Where consent is required for non-essential cookies, we will ask before setting them.

13. Changes to this policy

We may update this policy as the Service changes. The “last updated” date at the top records when it last changed. Material changes affecting how we handle your personal data will be signalled on the Service, and where the law requires it, we will seek your consent before applying them to data already collected.

14. Contact

Questions, requests or complaints about privacy: admin@insiderscanner.net.