Privacy Policy
We collect what
we need. Nothing more.
Last updated: June 1, 2026. This policy describes what StarCalls collects, why, and how you can remove it.
What we collect
- —Your email address, submitted when you sign up via the /subscribe page.
- —A one-time 6-digit verification code, which expires in 10 minutes and is deleted once used.
- —A session record linking your email to a random token, stored in our database for up to 30 days.
- —Two cookies set in your browser: auth-token (admin sessions, 7-day expiry) and user-session (subscriber sessions, 30-day expiry). Both are HttpOnly and Secure — inaccessible to JavaScript and transmitted only over HTTPS.
What we do not collect
- —No passwords. Authentication is email-only via one-time codes.
- —No payment information. The service is free.
- —No analytics tracking scripts (Google Analytics, Mixpanel, etc.).
- —No advertising identifiers or third-party tracking pixels.
- —No device fingerprinting.
How we use your email
- —To send you a verification code when you sign up or log in.
- —To deliver the StarCalls Daily Brief — a morning newsletter containing trade signals. We send one email per trading day, only when the engine produces a report.
- —We do not sell, share, or license your email address to any third party.
- —We do not send promotional emails, sponsored content, or affiliate offers.
Data processors
- —Resend (resend.com) — our email delivery provider. All outbound emails pass through Resend's infrastructure. Resend acts as a data processor under our direction and does not use your data for its own purposes. See resend.com/privacy for their policy.
- —Our server — all subscriber data (email, session tokens, OTP codes) is stored in a SQLite database on our own infrastructure. No cloud database providers are used.
Unsubscribe & data deletion
- —Every newsletter email contains an unsubscribe link. Clicking it immediately marks your address as unsubscribed — you will receive no further emails.
- —To request full deletion of your data (email, session records, OTP history), email admin@starcalls.in with the subject "Data Deletion Request." We will process it within 30 days.
- —You can also unsubscribe by logging in and contacting us directly.
Cookies
- —user-session: A random UUID identifying your subscriber session. HttpOnly, Secure, SameSite=Lax. Expires after 30 days or on logout.
- —auth-token: Used only for administrator access. HttpOnly, Secure, SameSite=Lax. Expires after 7 days or on logout.
- —No analytics cookies. No advertising cookies. No persistent tracking cookies.
Changes to this policy
- —We may update this policy if our practices change. If we make material changes affecting how your email is used, we will notify active subscribers via email before the change takes effect.
- —The date below reflects when this policy was last revised.
Questions about this policy?
admin@starcalls.in