Effective October 17, 2026 · Last updated October 17, 2026
The short version
We never sell your data to anyone, for any reason
We never connect to your broker and never store your account balance or trades
We store only what the product needs: email, your tickers and share counts, and the decisions you make through the Service
If you upload a statement, we read only tickers and share counts from it; the file is discarded after extraction (details in Section 3)
Your data is encrypted at rest and hosted in the United States
You can export your Record at any time, and request deletion when you cancel
No tracking cookies, ad networks, or third-party analytics that identify you personally
1Who this applies to
This Privacy Policy describes how Income Engine (operated by Joe Cabe, Summerland, California) collects, uses, and protects personal information from users of myincomeengine.com and related software (the "Service"). It applies to everyone who visits the site, uses the free Analyzer, or creates an Engine account.
By using the Service, you agree to the practices described here. If you do not agree, do not use the Service.
2What we collect
Information you give us directly
Account information: email address and a password (stored only as a one-way PBKDF2-HMAC-SHA256 hash — we never store your actual password)
Portfolio data: stock tickers, share counts, and cost basis that you type in, paste, or upload via a brokerage statement. If you upload a statement, our system extracts only tickers and share counts and discards the original file
Decisions you make: what the Service suggested, what you decided to do, and (optionally) the actual premium you received. This becomes your Record
Phone number (optional): if you opt in to SMS alerts
Feedback and support messages: anything you send to us at joe@myincomeengine.com
Information collected automatically
Session information: a signed session cookie (same-origin only) to keep you logged in
Technical logs: IP address, browser/device user-agent, request paths and timestamps. Used for security, debugging, and anti-abuse
Aggregated analytics: page views and referrers via Plausible (privacy-friendly, no cookies, no personal identifiers)
Error reports: if the Service crashes, we capture the stack trace via Sentry. Personal data in these reports is scrubbed before transmission
3What we do NOT collect or store
Clear, because it matters in financial services:
Social Security Numbers. We never ask for them and have no reason to collect them.
Brokerage account numbers. We never connect to your broker. You place trades yourself; we have no view into your account.
Account balances or buying power. We don't know how much money you have in your brokerage account.
Trade history inside your broker. Only the decisions you log through our Service.
Government ID numbers of any kind. We have no need to verify identity beyond an email address.
Health, biometric, or demographic data. None of this is relevant to the Service.
About uploaded brokerage statements
If you upload a brokerage statement (PDF or image), the file is passed to our vision-extraction vendor (Anthropic) to read the ticker symbols and share counts off the document. The statement may contain account numbers, balances, or other personal information visible on the page — our extractor is instructed to read only tickers and share counts. We store only those two fields; the original file is discarded immediately after extraction, and nothing from it is retained in our database. Anthropic's handling of the file during processing is governed by its own data policies; see Anthropic's data use terms for the Claude API.
About future paid-tier payments
Income Engine is free during the private beta and we do not collect payment information. When a paid tier launches, payments will be handled by a dedicated payment processor (e.g., Stripe); we will never see or store your full card number, and we will update this policy to name the processor and its role before any payment is collected.
4How we use your data
To operate the Service: run the analyzer, generate recommendations, track your Record, send notifications you've opted into
To improve the Service: aggregated, anonymized patterns help us understand where users get stuck or what features matter. We never use your individual positions or Record for marketing
To communicate with you: product updates, security notices, and support responses. You can unsubscribe from product updates at any time; security notices are mandatory while you have an active account
To prevent abuse: detect brute-force login attempts, scraping, and other misuse
To comply with law: respond to valid legal process (court orders, subpoenas) when we are legally required to do so. We will notify you unless prohibited
We do not use your data to train AI models, build advertising profiles, or share with data brokers.
5Third-party services we use
We use the following third-party vendors to operate the Service. Each receives only the data it needs to perform its function. Their handling of that data is governed by their own privacy policies.
Supabase
Database (PostgreSQL). Stores your account, positions, and Record. US region, encrypted at rest.
Render
Application hosting. Receives all requests to the Service and routes them to our backend.
Tradier
Market data. We send tickers to look up quotes and options prices. No PII is sent.
Anthropic
Vision-based extraction when you upload a brokerage statement. The image is sent to Anthropic for processing; we store only the extracted tickers and share counts, then discard the file.
Resend
Transactional email (notifications, password resets, product updates). Receives your email address and the message content.
Twilio
SMS alerts, if you opt in. Receives your phone number and the alert content.
Cloudflare
DNS and inbound email routing. Standard web traffic. Also used to forward joe@myincomeengine.com to our inbox.
Plausible
Privacy-friendly analytics. No cookies, no fingerprinting, no personal identifiers. Measures page views and referrers only.
Sentry
Error tracking. PII is scrubbed before any report is sent. Used to detect and fix software bugs.
Vendors may change as we improve the Service. Material changes (such as adding a new processor for sensitive data) will be announced through this page and, where appropriate, by email.
6Security measures
Encryption in transit: all traffic to and from the Service uses HTTPS (TLS)
Encryption at rest: your data in our Supabase database is encrypted on disk
Password hashing: passwords are stored only as PBKDF2-HMAC-SHA256 hashes with random salts. Even we cannot recover your password
Session security: session cookies are signed, scoped same-origin, and marked Secure under HTTPS
Row-level security: database policies enforce that users can only access their own data
Rate limiting: login attempts, password resets, and other sensitive endpoints are rate-limited to prevent brute force
Error logging: stack traces are scrubbed of personal information before being sent to our error tracker
No system is perfectly secure. If we discover a data breach that affects you, we will notify you promptly and in compliance with applicable law.
7Data retention
While your account is active, we retain the information described in Section 2. If you cancel, we may retain your account data for up to 90 days after cancellation to allow for reactivation and to meet legal obligations, after which it is permanently deleted (except for a minimal transaction log we may retain to comply with tax, accounting, or anti-fraud requirements).
You can export your Record as a CSV at any time while your account is active, and we recommend doing so before you cancel.
Technical logs (IP addresses, request paths) are retained for up to 30 days, then deleted. Error reports in Sentry follow Sentry's standard retention windows.
8Your rights
You have the right to:
Access the personal data we hold about you
Export your Record as a CSV, from the Record page
Correct inaccurate information in your account
Delete your account and associated data (contact us; we will act within 30 days unless law requires longer retention)
Opt out of non-essential communications
Object to specific processing of your data
To exercise any of these rights, email joe@myincomeengine.com from the address on your account.
9Cookies and tracking
We use one cookie only: a signed session cookie that keeps you logged in. It is first-party, scoped to our domain, and expires when your session does.
We do not use advertising cookies, retargeting pixels, Google Analytics, Facebook Pixel, or any third-party tracker that identifies individual users. Our analytics provider (Plausible) is cookieless.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we honor it where it is technically meaningful; because we don't do cross-site tracking in the first place, there isn't much to honor.
10Children's privacy
The Service is intended for adults (18 and older) who manage their own self-directed investments. We do not knowingly collect data from children under 13 (or under 16 in jurisdictions where that applies). If you believe we have collected data from a minor, email joe@myincomeengine.com and we will delete it.
11California residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
The right to know what personal information we collect, use, disclose, and sell
The right to delete personal information we have collected
The right to correct inaccurate personal information
The right to opt out of the sale or sharing of personal information
The right to limit use of sensitive personal information
The right to non-discrimination for exercising these rights
We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We have no "sale" or "sharing" to opt out of.
To exercise your rights, contact joe@myincomeengine.com. We will verify your identity by confirming you have access to the email on your account.
12EU and UK residents (GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR (or UK GDPR / Swiss FADP). The Service is primarily intended for U.S. residents, and we do not actively market to users outside the United States. If you choose to use the Service from outside the U.S.:
You consent to the transfer of your data to and processing in the United States
You retain the rights described in Section 8, plus the right to lodge a complaint with your local supervisory authority
The legal basis for our processing is: performance of a contract with you (operating the Service), our legitimate interests (security, product improvement), and your consent for optional features
13Changes to this policy
We may update this Privacy Policy periodically. Material changes will be posted on this page with a new "Last updated" date and, where appropriate, announced by email. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
14Contact
For privacy questions, requests, or complaints, contact us at: