Privacy Policy
What we collect, what we do not, and who else sees it.
Version 1 Oct 2026 · information under Art. 13 GDPR
The short version
What we need to run your account — your e-mail address, your settings, your rules, your watchlist — is stored on our server in Germany. What goes to outside services (the news source, the AI model, the market-data provider) are stock tickers and public news, never who you are.
1. Who is responsible
Cerci Ventures GmbH, Marthashof 10, 10435 Berlin, Germany, represented by its managing director Irfan Cerci (see the imprint). Questions about this policy and about your data: support@tailwindtrader.com or the contact form (topic “Data protection”).
We have not appointed a data protection officer; a company of our size is not required to (§ 38 BDSG).
2. Visiting our pages, and where they are hosted
When you open a page, the server that delivers it records the request: IP address, date and time, the page requested, the response code, and usually the referring page and your browser version. We use this only to deliver the pages and to investigate faults and attacks. The legal basis is our legitimate interest in a working, secure service (Art. 6 (1) (f) GDPR).
| Where | Who hosts it | How long the access log is kept |
|---|---|---|
| The public website tailwindtrader.com, the service, the browser version and the account pages: api.tailwindtrader.com and app.tailwindtrader.com | Our own server, rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in Hetzner’s Nuremberg data centre | 14 days, then deleted automatically |
Our domain names and our mailbox are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Both hosts work for us as processors under Art. 28 GDPR on the basis of their data processing agreements; neither uses your data for any purpose of its own. Everything described on this page is stored inside the European Union unless a section says otherwise.
3. Cookies and storage in your browser
We store something in your browser only where the product cannot work without it. That is permitted without consent (§ 25 (2) no. 2 TDDDG), and it is why there is no cookie banner. We never use these entries for statistics, advertising or to recognise you across other sites.
| Name | Where | What it does | How long |
|---|---|---|---|
stn_session (cookie) |
app.tailwindtrader.com, once you sign in | Keeps you signed in to the browser version. It holds a random value and cannot be read by any script on the page. | Until you sign out, at most 90 days |
stn.token (local storage) |
The account pages (/account/, /trial/) |
Keeps you signed in on the account page after you register or sign in there | Until you sign out on that page |
stn_split (local storage) |
The browser version | Remembers where you placed the divider between list and detail view | Until you clear your browser data |
The public product pages (landing page, this policy, the terms) set nothing at all. The one interactive element on the landing page — the rule slider — runs entirely in your browser and sends nothing anywhere.
4. Contacting us
If you write to us by e-mail or through the contact form, we process your e-mail address, your name if you give it, and your message, in order to answer you (Art. 6 (1) (b) GDPR where it concerns a contract or a request before one, otherwise Art. 6 (1) (f) GDPR). Our mailbox is hosted by IONOS SE (see section 2) as our processor.
The form stores your message on our server before anything is sent, so that a mail server that happens to be down cannot lose it, and records the IP address the form was sent from, to stop the form being abused for mass mailing (Art. 6 (1) (f) GDPR). The IP address is deleted automatically after 30 days; the enquiry itself is kept as described below. You get a confirmation by e-mail immediately and an answer within one working day. Nothing you send is passed on for advertising.
We keep correspondence as long as the matter is open. Afterwards we keep what we must keep as business correspondence (six years, § 257 HGB, § 147 AO) and delete the rest; you can ask us to delete an enquiry at any time, as far as no such duty applies.
5. Your account
To use Tailwind Trader you create an account. For that account we store, on our server:
| What | Why |
|---|---|
| Your e-mail address | It is your sign-in name and the address we write to |
| A one-way hash of your password — never the password itself | To check your sign-in; a hash cannot be turned back into the password |
| When the account was created, your plan, the end of your trial, the date your access runs to, whether the account is blocked, and when it was last used | To know whether the Service may be used, and to find accounts nobody uses any more |
| Your account settings: language, alert switch and threshold, macro reminders, sort order | So the Windows app and the browser show the same product |
| Your event rules (the weights you set per event family) | They are what makes the scores yours, and they follow you to every installation |
| Your watchlist and the alerts raised for it, with the time each was shown | So the service can watch your tickers while no window is open and tell you what crossed your threshold |
| Sign-in tokens (random values that identify a signed-in app or browser), stored only as a fingerprint, with the kind of client, when they were issued and last used | So you stay signed in; signing out or a password change invalidates them |
| A password-reset token, if you ask for one — stored as a fingerprint, valid for one hour | To let you set a new password from the link we e-mail you |
| A confirmation token for your e-mail address — stored as a fingerprint, valid for 48 hours — and, once you used it, the fact and time that the address was confirmed | A trial can only be started with a confirmed address, so that one person cannot open trials with invented addresses |
The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR). An e-mail address and a password are required to create an account; without them we cannot provide the Service. We record failed sign-in attempts per address for a short time in memory, to slow down password guessing; that record is never written to disk.
We keep this data for as long as the account exists. 90 days after your access has ended without a renewal, the account and everything in the table above are deleted automatically — the service checks once a day. You can ask us to delete it earlier at any time. Records we must keep under commercial and tax law — invoices and the fact that a contract existed — are kept for the statutory periods (see section 10) and nothing longer.
6. Paying for a subscription
Payments are handled by the payment provider named on the checkout page. We never see or store your card or bank details. Which rules apply depends on the provider’s role, and the checkout tells you which one it is:
- If the provider sells to you as reseller (“merchant of record”) — for example Paddle.com Market Ltd, 30 Old Bailey, London EC4M 7AU, United Kingdom — your purchase contract and the payment are with that provider. It collects the price, adds the tax that applies in your country, issues the invoice and processes your payment and billing details as an independent controller under its own privacy policy. It tells us your e-mail address, your country, the plan, the state and the end date of the subscription, and the invoice reference — the values that set your access (Art. 6 (1) (b) GDPR).
- If we sell to you directly through a payment service, that service processes the payment details for us; we receive and keep your name, e-mail address, billing address and country, the plan and the invoices we issue (Art. 6 (1) (b) and (c) GDPR).
A payment provider may be based outside the European Union. For the United Kingdom the European Commission has found that the level of data protection is adequate (Art. 45 GDPR); for a provider in the United States the transfer is based on its certification under the EU-U.S. Data Privacy Framework or on the Commission’s standard contractual clauses (Art. 45, 46 GDPR). The checkout page links the provider’s privacy policy.
The trial and “one trial per person and card”. You start the trial at the payment provider with a payment method, which the provider keeps. From the provider we receive the type of your card, its last four digits and its expiry date — never the card number. Of these, and of your e-mail address, we keep only a one-way fingerprint (a hash that cannot be turned back), together with the dates and the outcome of the trial. We compare new trials against these fingerprints so that each person and each card gets one trial (Art. 6 (1) (b) and (f) GDPR; our legitimate interest is preventing repeated free trials). The fingerprints are kept for three years after the trial ended, also after your account has been deleted, and then deleted automatically.
Cancellations, withdrawals and renewal reminders. When you cancel or withdraw from a subscription online — with or without signing in — we store your name, your e-mail address, the contract, what you declared, when it arrived, what we then did and the confirmation we sent you. Before an annual subscription renews we send you a reminder and store it in the same way. We do this to carry out your declaration and to be able to prove it (Art. 6 (1) (b), (c) and (f) GDPR). These records are kept for six years after the end of the year they were made in (section 10), also after your account has been deleted.
7. The Windows application
The Windows application keeps the following on your own computer, under
%APPDATA%\TailwindTrader:
| What | Why |
|---|---|
| Your settings (language, hotkey, window position, alert threshold) and your access key, encrypted with Windows’ own protection | So the program stays signed in and behaves the same next time |
| The program’s working files, such as a cache of results already shown | So the program starts quickly and a ticker you already opened appears instantly |
| A list of listed stock symbols and company names | So the program can recognise a ticker in the window title of your charting platform |
| A log file of program runs | So a fault can be explained afterwards |
We do not receive any of this. It stays on your computer until you delete it; uninstalling asks
whether this folder should go too. An installation updated from the product’s earlier name
ScoreTheNews keeps its old folder %APPDATA%\ScoreTheNews as a backup; uninstalling
asks about both.
The application fetches the symbol list from our own service once every few days, like everything else it does; the application itself connects to no other server.
8. What leaves our server, and to whom
To describe the news of a stock, Tailwind Trader uses outside services. None of them receives your name, your e-mail address, your watchlist, your rules or any other personal data — they receive stock tickers, time windows and public news text, and the service asks them in its own name, not in yours. They do not learn which customer is interested in which stock.
| Service | What it receives | Why |
|---|---|---|
| finlight (news source), Bartsch und Büyükkakac GbR, Ludwigshafen, Germany | A stock ticker and a time window | To return the headlines published for that ticker |
| StockNewsAPI (news source), stocknewsapi.com, United States | A stock ticker and a time window | To return press releases and newsroom headlines for that ticker, above all for smaller companies that the first news source covers less completely |
| Google (Gemini AI model), Google Ireland Ltd / Google LLC | Published headlines and the short extracts supplied by the news source, the ticker, and for company profiles the public company description from SEC filings | To turn a pile of headlines into distinct described events, and to sort companies into sectors and themes. We use Google’s paid service, under which Google does not use the content to improve its products. |
| Alpaca (market data), AlpacaDB, Inc., United States | Stock tickers | To calculate relative strength, relative volume and sector strength; prices themselves are not shown |
| SEC EDGAR, U.S. Securities and Exchange Commission | Requests for public filings and company lists | For company profiles and filings |
| Press-release feeds of news wire services | Nothing — the service reads their public feeds | To notice company press releases early |
Some of these services are located outside the European Union. Because no personal data is sent to them, this involves no transfer of personal data to a third country.
Two things the service does on its own, without anyone asking: every morning it scores the news of the companies in the S&P 500 and Nasdaq-100 for the morning briefing, and during the day it fetches new headlines for the tickers on customers’ watchlists. Both involve only tickers and public news between us and the services above.
9. Automated processing
The scores Tailwind Trader shows are produced automatically, but they are not decisions about you: they describe publicly reported company news, weighted by rules you set. There is no automated decision-making that produces legal effects concerning you or similarly affects you (Art. 22 GDPR), and no profiling.
10. How long we keep things
| Data | Kept for |
|---|---|
| Access logs of our server, the public website included | 14 days (section 2) |
| IP address of a form enquiry | 30 days, then deleted automatically |
| Enquiries and correspondence | Until the matter is settled; business correspondence six years (§ 257 HGB, § 147 AO) |
| Account data | While the account exists and 90 days after access has ended (section 5) |
| Password-reset tokens | Until used, at most one hour |
| E-mail confirmation tokens | Until used, at most 48 hours; the confirmation itself as long as the account |
| Fingerprints of the e-mail address and the card of a trial (section 6) | Three years after the trial ended, then deleted automatically — also after the account itself has been deleted |
| Cancellations, withdrawals and renewal reminders, with the confirmation we sent (section 6) | Six years from the end of the calendar year (§ 257 HGB; Californian law asks for at least three), then deleted automatically — also after the account itself has been deleted |
| Invoices and booking records, if we sell to you directly | Eight years (§ 147 AO, § 257 HGB) |
| Scored public news | As public news, without any link to a person |
| What the Windows application keeps on your computer, and what your browser keeps | Under your control (sections 3 and 7) |
11. Your rights
You may ask us for access to your data (Art. 15 GDPR), correction (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and a copy in a portable format (Art. 20), and you may object at any time to processing based on our legitimate interests (Art. 21). Write to support@tailwindtrader.com.
You also have the right to complain to a supervisory authority, for example in the country where you live. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
12. Changes to this policy
We update this page when the product changes. The version date at the top tells you which text you are reading; if a change affects an existing account, we tell you by e-mail.