1. About This Policy
SkewFlow LLC (“SkewFlow,” “we,” “us,” or “our”) provides subscription-based options-market analytics software. This Privacy Policy describes the personal information we collect and use in connection with our service, how we may disclose it, and how we retain it.
For privacy-related questions or requests, contact legal@skewflow.com.
2. Information We Collect
Account and subscription information. We maintain information associated with user accounts, including email addresses and subscription status.
Market-data subscriber information. Where required for licensed market-data access, we collect a subscriber’s name, address, professional or non-professional classification, and records of applicable subscriber-agreement acceptance and compliance.
Security and audit information. Our application audit log records IP address, browser identification string (user-agent), timestamp, email address, account or action, event details, a request reference, and whether the action succeeded or failed.
Operational information. Server logs contain partial IP addresses and performance records use masked IP addresses.
Payment and billing information. Stripe processes subscription payments. We maintain the information needed to administer subscriptions and payment status. Payment information processed by Stripe is subject to its applicable privacy practices.
3. How We Use Information
We use the information described above to provide and administer accounts and subscriptions; authenticate access; protect the service and investigate misuse; operate, troubleshoot, and improve service reliability; respond to customer requests; and comply with applicable market-data, contractual, and legal obligations.
4. Cookies and Browser Storage
SkewFlow uses first-party cookies necessary for authentication, maintaining signed-in sessions, and protecting the service against unauthorized requests.
These cookies include:
- skewflow_at: Supports authenticated sessions and expires after 15 minutes.
- skewflow_rt: Maintains signed-in sessions and expires after 30 days.
- skewflow_csrf: Helps protect against cross-site request forgery and expires after 30 days.
SkewFlow also uses browser storage to remember interface preferences selected by users, including navigation-menu and 0DTE symbol-card display settings. These preferences remain in the browser until cleared.
Temporary session storage remembers the table row from which a user navigated so the application can restore and highlight that row when the user returns. This information is cleared when the browser tab’s session ends.
These browser-storage preferences do not contain account identifiers and are not transmitted to SkewFlow’s servers or third parties.
SkewFlow does not use analytics cookies, advertising cookies, or cross-site tracking technologies.
5. OPRA Subscriber Compliance
SkewFlow may disclose relevant subscriber information and compliance records to the Options Price Reporting Authority (OPRA) when required by applicable market-data agreements, compliance obligations, or law.
SkewFlow does not routinely transmit subscriber registration information to its upstream market-data supplier as part of ordinary market-data ingestion. This policy does not identify upstream market-data sources.
6. Other Service Providers and Disclosures
We use Stripe to support subscription billing and payment processing. We may also disclose information when necessary to comply with law, respond to lawful requests, enforce our agreements, protect users and the service, or address security incidents.
7. Data Retention
Application Audit Logs
SkewFlow retains application audit logs for up to 365 days under normal circumstances. These logs may include IP addresses, email addresses, browser identification strings, timestamps, account actions, event details, request references, and action outcomes.
Relevant records may be retained longer when reasonably necessary for security investigations, dispute resolution, legal obligations, or legal holds.
Subscription and payment events. Retained for at least three years after the relevant subscription or payment event, or longer where legal, tax, accounting, contractual, or dispute-related obligations require.
Server logs. Retained for 30 days; logs contain partial IP addresses.
Performance records. Retained for 90 days; IP addresses are masked.
Database backups. Retained for 14 days under the standard backup schedule.
OPRA subscriber records. Retained throughout the subscriber relationship and for three years afterward, subject to any longer applicable legal, contractual, or legal-hold requirement. These records are maintained separately in tables that cannot currently be edited or deleted through the system.
Account information. Cancelling a paid subscription returns the account to the Free plan without deleting associated information. Deactivating an account blocks sign-in but retains associated information. Other account-data deletion rules have not yet been defined.
8. Account Cancellation, Deactivation, and Privacy Requests
Cancelling a paid subscription does not delete the account or its information. Account deactivation prevents sign-in but does not automatically erase account information.
You may contact legal@skewflow.com to make a privacy-related request. We review requests under applicable law and our contractual obligations. Certain information may need to be retained for market-data compliance, security, dispute resolution, or other lawful reasons. SkewFlow does not currently offer an automated account-data deletion feature.
9. Changes to This Policy
We may update this Privacy Policy as our service and practices change. The published version should identify its effective date and be updated when material practices change.
Current service providers, cookies and browser storage
This is the current list of the service providers that process personal information to operate the Service, and of the cookies and browser storage the Service uses. It describes how the Service works today and is updated when that changes.
Service providers
STRIPE — PAYMENTS
Receives your email address and an identifier for your account, and holds your payment details directly. Card numbers are entered on Stripe’s systems and never reach ours.
SENDGRID — EMAIL DELIVERY
Receives your email address and the contents of the messages we send you: account mail such as address verification and payment notices, and the alert and digest mail you have asked for.
MICROSOFT AZURE — HOSTING
Runs the application and the databases. Your information is stored on Azure infrastructure.
ERROR MONITORING — OPTIONAL
If error monitoring is enabled, crash reports are sent to Sentry and Microsoft Application Insights. They are configured to send no email address and no IP address — only an opaque account identifier, so a fault can be traced to a session without identifying a person. Authorization headers, cookies and query strings are stripped before a report leaves our servers.
Cookies
SkewFlow sets three cookies, all first-party and all strictly necessary: they sign you in and keep the session safe. It sets no analytics, advertising or other non-essential cookie, and the Service loads no third-party script that sets one.
skewflow_at
Keeps you signed in. Expires after 15 minutes and is renewed automatically.
skewflow_rt
Renews the cookie above so you are not signed out every 15 minutes. Expires after 30 days, and is destroyed when you sign out.
skewflow_csrf
Protects against cross-site request forgery — it stops another website from performing actions on your account while you are signed in. Expires with the cookie above, after 30 days, and is cleared when you sign out.
Signing in also creates a short-lived server-side session record, held for 24 hours or until you sign out. Only one device can be signed in at a time: a new sign-in ends the previous one, and that displacement is recorded.
Browser storage
Besides the cookies above, SkewFlow keeps a few small values in your browser's own storage. They are not sent to us or to anyone else.
skewflow.nav.collapsed
Whether you folded the side navigation. A display preference only.
skewflow.0dte.symbolCards.open
Whether you folded the per-symbol cards on the 0DTE page. A display preference only.
skewflow.cameFrom.*
On the interval drill-down, which row you opened, so going back highlights it. Kept for the browser tab only and gone when the tab is closed.
Retention of subscriber records
Market-data agreements require us to retain subscriber records for the duration of your membership and for three years after it ends (see Data Retention above). Closing a SkewFlow account therefore deactivates it rather than erasing those records: the account stops working, billing stops and mail stops, and the account and subscription record is kept for that period.