Privacy Policy

Thelyx operates this beta web application. This policy explains what data we collect, why, who processes it on our behalf, and the choices you have. If you have questions, contact us at privacy@thelyx.com.

Thelyx is informational only. It can connect to supported brokerage accounts in read-only mode, but it does not hold or move money and cannot place trades. You may also use a sample portfolio or self-reported positions.

We keep the data set small and tied to your account. Today that is:

• Your email address, used to sign you in with a magic link and to email you your brief.
• Your profile: the handle you choose, an optional short bio, and your message-privacy setting.
• Your portfolio and watchlist. A new account starts with sample data, which you may replace by importing a screenshot or linking a supported brokerage.
• Your daily AI briefs, generated from your portfolio, public company news, filings, public posts, and transcript-backed podcast results.
• Your Thelyx Analyst questions and answers, kept as a history for your account.
• Waitlist entries: which coming-soon features you asked to be notified about.
• Notes you write. They are private to your account, are never shown to other users, and are not sent to any AI model or used to train one.
• Basic technical data needed to run the service, such as a session cookie and a short-lived rate-limit counter keyed to your account id.

We do not store your brokerage username or password, government identifiers, or payment information.

• To authenticate you and keep you signed in.
• To show your sample book, watchlist, and market data.
• To generate your daily brief and answer your Thelyx Analyst questions.
• To email your brief to you.
• To protect the service, for example by rate-limiting requests.

We do not sell your personal information. We do not share, license, or sell your data to third parties for their own use. Any anonymized data-sharing or licensing described in marketing is not live and is not part of this product today.

We use a small number of processors to run the service. They handle data only to provide their service to us:

• Supabase: authentication and our hosted database, where your account and the data above are stored.
• OpenAI: writes the editorial portions of your brief from relevant portfolio context, sourced headlines, and bounded podcast transcript excerpts. We instruct the model to treat third-party text as data, remain informational, and never invent facts.
• Google (Gemini API): generates Thelyx Analyst answers and supports other research features. Morning Brief writing does not use Gemini.
• Finnhub: market quotes and public company news. We send ticker symbols, not your identity.
• Taddy: finds transcript-backed podcast episodes. We send company search terms derived from your portfolio, not your identity.
• X: provides public posts from a shared curated source list. Thelyx does not send your identity or portfolio to X.
• Resend: sends your brief email. It processes your email address and the message.
• Upstash: stores a short-lived rate-limit counter keyed to your account id.
• Vercel: hosts and serves the application.

These providers may process data in the United States or other regions. We share only what each provider needs for its function.

We use a session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

Every table enforces row-level security so you can only read and write your own rows. API keys and secrets are held server-side and are never exposed to your browser. No system is perfectly secure, and this is a beta, so please do not treat it as a system of record.

We keep your data while your account is active. You can permanently delete your account at any time from the account page. Deletion removes your profile, sample portfolio, watchlist, briefs, Ask history, notes, and waitlist entries, and removes your login. This action cannot be undone. Backups held by our providers may persist for a limited period under their own retention schedules.

You can edit your handle and settings in the app, delete individual watchlist entries, and delete your whole account. Depending on where you live, you may have additional rights over your personal data. To make a request, contact us at privacy@thelyx.com.

Thelyx is not directed to anyone under 18. Do not use the product if you are under that age.

We may update this policy as the product changes. We will update the effective date above and, for material changes, take reasonable steps to let you know.

Thelyx, privacy@thelyx.com. This document is a draft and should be reviewed by a qualified lawyer before any public launch.