Privacy Policy

Last updated: 8 June 2026

This Privacy Policy describes how Oraculum Signals ("the Service"), operated by Marc Lloyd Adams trading as Development AI Tools (ABN 71 511 914 959), located in Australia ("we", "us", "our"), collects, uses, discloses, and protects your personal information.

1. Information We Collect

Account information

When you sign up, we collect your email address and name (if provided). If you sign in via GitHub OAuth, we receive your GitHub email and display name from GitHub.

Subscription and billing data

Payment processing is handled entirely by Stripe. We do not store, process, or have access to your credit card number, CVC, expiry date, or bank account details. Stripe provides us with your email address, subscription status, and plan tier only.

Usage data

We store your watchlist, notification preferences, and alert settings in our database to provide the Service. We log basic server access information (IP addresses via Cloudflare, request timestamps) for security and rate-limiting purposes.

Push notification data

If you enable push notifications, your browser provides a push subscription endpoint (a URL and encryption keys) which we store to deliver notifications to your device. You can disable and remove this at any time in your profile settings.

2. How We Use Your Information

To provide, operate, and maintain the Service
To manage your account and subscription billing
To send you signal alerts you have opted into (push notifications and/or email digests)
To protect the security of the Service (rate limiting, abuse prevention, fraud detection)
To respond to your enquiries or support requests

We do not sell, rent, trade, or share your personal information with third parties for their marketing purposes.

3. How We Disclose Your Information

We share your information only with the following categories of third-party service providers, solely for the purposes of operating the Service:

Supabase (US) — authentication and database hosting. Stores your account data, watchlist, and preferences.
Stripe (US) — payment processing. Receives your email to process subscriptions. See Stripe's Privacy Policy.
Cloudflare (US) — DNS, CDN, tunnel, and DDoS protection. Processes your IP address and request headers.
Resend (US) — email delivery. Receives your email address to send alert digests you have opted into.

We do not disclose your information to any other parties unless required by law or to protect our rights.

4. Cookies and Tracking

We use a single session cookie (oraculum_session) to keep you logged in. This cookie is:

HttpOnly — not accessible to JavaScript
Secure — only sent over HTTPS
SameSite=Lax — not sent with cross-site requests
7-day expiry — automatically expires after one week

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party tracking scripts. We do not use Google Analytics or similar services.

5. Data Security

We implement the following measures to protect your information:

All connections are encrypted via HTTPS (TLS) through Cloudflare
Session tokens are generated using cryptographically secure random values
Session lookups use constant-time comparison to prevent timing attacks
Authentication endpoints are rate-limited (10 attempts per 5 minutes per IP)
Stripe webhook signatures are verified with HMAC-SHA256 and timestamp validation
No API keys or secrets are exposed in client-facing code
Database access uses Supabase Row Level Security with service-key authentication

While we take reasonable steps to protect your data, no system is 100% secure. We cannot guarantee absolute security of your information.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account or request deletion, we will remove your personal data within 30 days, except where retention is required by Australian law or for legitimate business purposes (e.g., billing records required for tax compliance).

Server access logs (IP addresses) are retained for a maximum of 90 days for security purposes, then automatically deleted.

7. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data
Withdraw consent for push notifications or email alerts at any time via your profile settings
Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. International Data Transfers

Our third-party service providers (Supabase, Stripe, Cloudflare, Resend) are based in the United States. By using the Service, you consent to the transfer of your data to the US for processing by these providers, each of which maintains their own privacy and security standards.

9. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Service. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For questions or concerns about this Privacy Policy or your personal data:

Marc Lloyd Adams
Trading as Development AI Tools
ABN 71 511 914 959
Email: [email protected]
Website: oraculumtrader.com