Next Stock Privacy Policy
Effective date: October 6, 2026
- Personal information controller: MacDeer ("we," "us," or "our")
- Contact email: support@macdeer.com
This Policy applies to the Next Stock application, our companion official website, and the related research services you actually use. It explains the information we process, its purposes, recipients, storage, and your choices and rights.
Your watchlist and recently viewed list are stored in your account and synchronized between the native application and the companion website when you sign in to the same account; each device and browser also keeps a local cache. Viewing companies or filings sends requests to our servers, and an entered or saved share price is sent to our servers for valuation calculations, but prices are stored only on your device.
1. Account and sign-in information
For email-code sign-in, we process your email address, code-verification requests, email-verification status, account identifier, and related timestamps to deliver codes, verify identity, and create or access an account. Codes are normally valid for ten minutes. The server stores the hash needed for verification rather than keeping a plaintext code as a long-term account detail.
For Sign in with Apple, we process the account identifier provided by Apple and any name or email address Apple actually supplies. You may use Apple's Hide My Email options. Availability of your name and email depends on your authorization and Apple's rules. We also process authorization codes or tokens needed to complete sign-in and maintain or revoke authorization. We do not receive your Apple ID password.
Account and session records may include a user ID, sign-in method, creation and update times, session identifiers, expiration times, IP addresses, and User-Agent information identifying the requesting software or browser. These support account access, session management, and security.
Next Stock accounts are managed separately for this application. Using the same email address does not automatically merge accounts in our other applications.
2. Research, refresh, and valuation requests
To return requested content, our servers process company or security symbols, company and filing identifiers, filters, pagination parameters, and necessary session information. Ordinary native-app directory searches can run against a downloaded local directory. Server-side lookups and requests to open companies or filings still reach our servers.
A price you enter is sent with the relevant company identifier to calculate metrics such as P/E and free-cash-flow yield. Reopening a page that uses a saved price may send it again. The valuation feature does not save your entered price as a long-term server-side valuation record. Network infrastructure may still process prices and other request parameters as part of request logs.
Company refreshes produce job status and company-level monitoring records. We also store daily refresh counts and dates associated with user IDs to enforce request limits and prevent abuse. These records are not brokerage holdings. Section 3 explains the watchlist and recently viewed list stored in your account.
The Service does not require connections to brokerage or bank accounts, read securities holdings, orders, payment-card details, or account balances, or require investment-asset or risk-tolerance information. Do not send such sensitive information in support requests or other places where it is unnecessary.
3. Watchlist and recently viewed list, local records, cookies, and preferences
Your watchlist and recently viewed list belong to your account. When you add or remove a watchlist item or open a company page, we store on our servers, linked to your user ID, the security symbol, exchange, company name, company identifier, security type, and the time of the action, so that every client signed in to the same account shows the same lists. A watchlist holds at most 200 items and the recently viewed list keeps only the latest 20; you can remove any item or clear the recently viewed list at any time, and both lists are deleted with your account. The native application and the companion website also keep a local cache of both lists so that they show while offline; the native application additionally keeps changes not yet delivered and sends them with their original time once you are back online.
The native application stores prices, display preferences such as price-movement colors, the versions of our user agreement and this Policy you have accepted, and the last-used sign-in method or email locally. Saved prices are separated by account and are not synchronized to our servers. Requests involving companies and prices are still processed as explained in Section 2.
Native session tokens are stored in the device's secure Keychain. Public securities directories and other non-account content may be cached locally to reduce repeated downloads.
The companion website uses cookies necessary to maintain sign-in and browser local storage for prices, display preferences, the versions of our user agreement and this Policy you have accepted, and a cache of your watchlist and recently viewed list (cleared when you sign out). Certain refresh-job identifiers and an Apple sign-in redirect marker are stored for the current browser session. These mechanisms support sign-in and features you use, rather than cross-site advertising tracking. You may clear cookies and site data through your browser, but may need to sign in again and may lose local prices or preferences.
After you sign out, your watchlist and recently viewed list remain in your account; the native application keeps its local cache and prices, and the companion website clears its list cache from the browser. When account deletion completes in the current native application, the watchlist and recently viewed list on our servers are deleted with the account, and the account's cache, prices, and sign-in memory are cleared on that device. Clear local copies separately on other devices or browsers. The public directory cache may remain because it is not a private account record.
4. Technical records and information you provide
We and our infrastructure provider process necessary technical information, including IP addresses, User-Agent information, request times, paths, identifiers, status, and error information. We use it to deliver content, diagnose problems, maintain reliability, and prevent abuse. Request paths may include identifiers of the companies or filings requested.
When you contact us by email, we process your address, messages, and attachments you choose to provide to respond, correct data, and handle account or privacy requests. Provide only information needed to resolve the issue.
Account administration, security investigations, and permission changes may also generate necessary administrative audit records. We do not use these records to build personalized advertising profiles.
5. Permissions and processing we do not use
The current version does not integrate advertising-tracking or third-party behavioral analytics SDKs. We do not sell personal information or share it for cross-site or cross-app targeted advertising.
Current research features do not require access to contacts, the camera, microphone, photo library, or precise location. We do not collect advertising identifiers for tracking or use personal account information to train a built-in large language model. Filing organization and metric calculation use automated extraction and rule-based calculations.
The current application has no in-app purchase or auto-renewing subscription flow and does not collect payment-card information through such a flow. If new features change our practices, we will update disclosures and obtain authorization or consent required by applicable law.
6. Purposes and legal grounds
We use the information described here to provide sign-in and research features, calculate requested valuations, store and synchronize your watchlist and recently viewed list, maintain local preferences, enforce request limits, protect security, respond to support requests, and meet applicable legal obligations. We do not use it to make securities trading decisions for you or assess investment suitability based on your personal financial circumstances.
Where EEA, UK, or similar legal frameworks apply, our grounds include contractual necessity for services you request; legitimate interests in security, reliability, and support where these do not override your rights; legal obligations; and consent where applicable. You may withdraw consent-based permissions without affecting the lawfulness of prior processing.
In mainland China and other jurisdictions, we use grounds permitted by applicable local law. The reference to legitimate interests does not mean that this ground applies everywhere or replaces legally required consent. For nonessential processing, sensitive information, or activities requiring separate consent, we will provide the disclosures and obtain the consent required by applicable law.
7. Recipients and third-party services
For the purposes described in this Policy, we use the following services or provide necessary information in these circumstances:
| Recipient or circumstance | Information and purpose |
|---|---|
| Cloudflare | Cloud execution, databases, file storage, network security, and verification-email delivery. Relevant functions process account and session information, request data, necessary technical records, and recipient email addresses and verification-email content. See Cloudflare's Privacy Policy. |
| Apple, if you select Apple sign-in | Your Apple sign-in and authorization interactions, and authorized identifiers, names, or email addresses supplied to us. Apple's own practices are described in Sign in with Apple & Privacy. |
| Third-party clients or AI services you select | Inputs you submit and returned public research, source text, and calculations when using an integration. Their independent processing follows their own policies. |
| Legal requirements or necessary protection of rights | Information necessary to respond to lawful process, prevent serious abuse, or protect legal rights, to the extent permitted or required by applicable law. |
| Business transfers | If a merger, acquisition, or transfer changes the recipient of information, we will provide legally required notice and require continued protection. Changes to purposes or rules will follow required procedures. |
Service providers acting on our behalf must comply with applicable contractual, legal, and security requirements. Providing technical services does not itself authorize unrelated advertising uses. Disclosures or publication not explained here will receive separate notice and consent where required.
Our public research interfaces and MCP tools return public research and calculations. They do not provide functionality to read the watchlist or recently viewed list in your account. If you choose to send content to an external AI client, its provider determines conversation retention, model processing, and subsequent use under its policies. Its promises are not promises made by Next Stock.
Obtaining public SEC and Nasdaq materials does not require us to give those sources your sign-in email, verification code, or session credentials. If you open original files or third-party websites yourself, those sites may receive ordinary connection information and apply their own privacy policies.
8. Storage, international processing, and security
Account, session, watchlist, recently viewed, and necessary operational records are processed and stored using Cloudflare cloud services. Local caches and other local records remain on your device or in your browser.
Actual processing or storage locations for the primary account database, relevant logs, and backups: [TO VERIFY AND COMPLETE: locations and any processing in other countries or regions].
Cloudflare, Apple, and other services you choose may process information outside your country or region, where protections may differ. Where transfer safeguards are required, we will follow applicable legal procedures. Where separate consent or additional recipient disclosures are required, we will provide the information and obtain necessary consent beforehand. This Policy does not replace those procedures or imply that all information stays in your region.
We use measures appropriate to the information and risk, including HTTPS transmission, account- and application-scoped access controls, session-credential protection, and restricted operational access. Internet transmission and device storage cannot be guaranteed absolutely secure. For incidents requiring notice, we will notify affected parties and respond as required by applicable law.
9. Retention and account deletion
Account details are normally kept while the account remains active, until a deletion request is completed or they are no longer needed. Verification codes are normally valid for ten minutes. Expired verification and session records are cleaned regularly. Native sessions normally use a rolling 90-day validity period; website sessions normally use a rolling 30-day period. Continued use may extend validity, while sign-out, deletion, or security measures may end it earlier.
Daily refresh-limit records are retained for approximately seven UTC days, with older records removed during cleanup. These can remain after account deletion until routine cleanup, so deletion does not mean all operational traces disappear immediately.
Retention rules and maximum periods for technical logs, support correspondence, administrative audits, and backups: [TO VERIFY AND COMPLETE: periods or clearly understandable retention criteria for each category, including final archive cleanup and backup deletion cycles]. We retain information only as necessary for its purpose or applicable legal obligations. Residual records subject to a legal processing restriction are used only for storage and necessary security protection.
You can request deletion through the native application's account-deletion feature in Settings or by contacting us. On completion, our servers delete this application's user record, linked sign-in records, sessions, and your watchlist and recently viewed list. For self-service deletion through the native application, our servers attempt to revoke available Apple authorizations before deletion. If you delete through another channel, you may need to revoke authorization separately in your Apple account settings. Accounts or independently retained information held by Apple or other providers must be managed under their rules. Section 3 explains the scope of local-data removal and the distinction between deletion channels.
Public company documents, financial metrics, and governance archives are not your private account records and are not deleted solely because you delete your account. Where particular personal records must be retained for security, disputes, or legal obligations, we restrict their scope and use, then delete or anonymize them when no longer needed.
10. Your choices and rights
You can manage your watchlist, recently viewed list, and local prices, choose a sign-in method, sign out, clear browser data, or request account deletion. Stopping use avoids new usage requests. Uninstalling alone does not request deletion of your server account.
Depending on applicable law, you may request information and explanations about processing, access or copies, correction, deletion, restriction, objection, withdrawal of consent, and transfer of information where conditions are met. You may complain to a competent regulator or seek other statutory remedies. We will not unlawfully disadvantage you for exercising your rights.
Send requests to our contact email. To prevent impersonation, we may require proportionate identity verification without unrelated additional information. We will respond within applicable legal deadlines. If we cannot fully fulfill a request, we will explain why and any available next steps.
11. Minors
The Service is not directed to children under 14. A higher minimum age under local law applies. Other minors must satisfy local legal requirements and have any required parent or guardian consent and supervision.
If you are a guardian and believe we have processed a child's information contrary to these requirements, contact us. We will investigate and delete it or take other measures required by applicable law. General use or statements in this Policy are not treated as valid parental consent.
12. Updates and contact details
This Policy is available in Simplified Chinese and English. We will update its effective date and communicate material changes through the application or another appropriate means. Where new purposes, information categories, or recipients require renewed or separate consent, we will obtain it as required. Continued use will not replace legally required valid consent.
For questions about this Policy, our practices, or rights requests, contact:
- Personal information controller: MacDeer
- Privacy contact email: support@macdeer.com