Who we are
This policy covers quant.stonkbuilder.com, the SuperQuant Telegram bot (@StonkBuilderQuant_bot) and the Mini App. They are run by the StonkBuilder team. Contact: support@stonkbuilder.com. We do not sell personal data.
What stays in your browser
Strategies, backtests, paper trades, replays and your Diary are saved in your browser’s storage by default and are not sent to us. Optional encrypted backups are encrypted in your browser with your passphrase (AES-256-GCM) before upload, so the server stores ciphertext only. We cannot read them or recover a lost passphrase. Deleting your account does not clear your browser; clear site data to remove the local copy.
Account data
- Sign-up: your email address and a password stored only as an argon2 hash. If you turn on two-step sign-in, its secret is stored too.
- Email links: verification links (valid 24 hours) and reset links (valid 1 hour) are stored as hashes, together with the IP address of the request that sent the email.
- Preferences: your language and notification settings.
- Sign-up source: the campaign tags in the link you arrived from and the referring website’s host name, so we know which channels bring people in.
Telegram
When you link Telegram we store your chat ID (encrypted), your Telegram username and a keyed hash of your Telegram user ID. The bot processes your commands and messages to answer them. We never ask for your phone number.
AI chat works only after you agree in the bot. Your message, recent messages and research summaries are then sent to our AI provider (see below); your Diary is never sent. Chat memory lasts 30 minutes and is not saved to the database; research context for follow-up questions is kept for 7 days. The optional beta programme keeps encrypted conversations for up to 90 days so the team can review them; /beta erase deletes them.
Wallets
To check access after the trial we store your public Solana wallet address, the wallet name, the token balances we read and the result of the check. You prove ownership by signing a short message, or with Ledger a memo-only transaction that is never sent; no funds move and we do not keep the signature. We never ask for a seed phrase, a transaction approval or exchange keys. To read balances, your public address is sent to Solana data providers (RPC services).
Trial protection
To keep the free trial to one per person, we record a keyed hash of the network address you first sign in from (the exact IPv4 address, or the /64 block for IPv6) and a hash of your Telegram user ID, each with the trial start time. These records are not linked to your account. They are kept after account deletion so a deleted account cannot start a new trial, and are deleted 24 months after the trial started (or when your account is deleted, if that is later).
Cookies and analytics
| Cookie | Purpose | Lifetime |
|---|---|---|
sq_public_session | Keeps you signed in | Until the browser closes; the server ends it after 30 minutes idle or 12 hours |
sq_locale | Your language choice | 1 year |
sq_analytics | Your analytics choice | 180 days |
sq_visitor | Random ID for product analytics, set only when analytics is allowed | 180 days |
Product analytics (which features are used) is on by default. Turn it off in Account & privacy; doing so deletes the events already recorded for that visitor. It is never collected when your browser sends Do Not Track or Global Privacy Control. Raw events are kept for 90 days.
Visit counters need no cookie: they count views per day by page section, country and traffic source. Daily unique visitors are counted with a keyed hash of the IP address and browser that changes every day and is deleted after 2 days. The country and your language are worked out in memory from the IP address with the DB-IP Lite database; the IP address is not stored for analytics. Daily totals are kept for 13 months.
Who processes your data
- Hosting: our cloud server provider stores the account database and runs the service.
- Email delivery: our email provider sends verification, reset and notification emails.
- Telegram: carries bot messages between you and SuperQuant.
- AI provider: only after you agree to AI chat, messages go to Ollama Cloud (DeepSeek model), with the DeepSeek API as a fallback.
- Solana data providers: receive your public wallet address to read balances.
Feedback and bug reports you send are stored with your account and forwarded to the team on Telegram.
Deleting your data
Delete your account at any time in Account & privacy. This deletes or detaches everything linked to your account, including your Telegram link, wallet link, alerts, feedback and backups. We keep a deletion record, usage and budget totals with the account link removed, and the trial-protection records described above. Service metrics are kept for 30 days.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it by writing to support@stonkbuilder.com. Depending on where you live, data protection law may give you further rights, such as objecting to or restricting some processing, or complaining to your local data protection authority. Write to the same address to use them. SuperQuant is not meant for anyone under 18.
Changes
We will update this page when SuperQuant starts collecting something new or uses data differently. The date at the top shows the latest version.