Privacy

This notice describes the information handled by the Secondaries Desk website and by the account system behind it. It covers the public pages, the published transaction index, and the signed-in workspace.

It does not describe the transactions in the database. Those describe funds, companies and firms, not the people who read about them.

The service handles what you provide when you create an account and the technical information produced when the site answers a request. We do not buy personal information from third parties.

An account requires an email address and a password. The address is used to confirm the account and to sign you in. Supabase handles password authentication and stores passwords as secure hashes; the application does not receive a readable password.

There is no profile to fill in. We do not ask for a name, a company, a job title or a phone number.

When you share information about a missing transaction field, we store your information, supporting context, the relevant transaction and field, the submission time, and the ID and email of your signed-in account. These details are available only in the private Secondaries Desk review inbox.

Share anonymously means your identity is not displayed to other users. Secondaries Desk can identify the contributor. Submissions are reviewed before any database update; they are not published automatically. You can contact us to request deletion of a contribution and its identifying details.

Serving a page may produce a server-side record that includes the address requested, the time, the response status, an IP address and the browser's user-agent string. These are technical logs of the hosting platform and are used to keep the service running and to investigate abuse or errors.

The site uses Vercel Web Analytics for page views and aggregate signup and activation events. Search terms, authentication codes, return URLs, email addresses and account identifiers are excluded from our event properties. A coarse acquisition category (for example Google or ChatGPT) and an internal-test flag are retained in session storage and carried through the confirmation link. This storage lasts for the browser session and contains no unique visitor identifier. Two confirmation flags expire after five minutes. The account retains the coarse signup acquisition category and the first source and complete-analysis consultation dates to avoid recounting activations. Vercel may process limited technical information to provide the measurement service.

Account information is used to create and secure your account, to confirm your address, and to keep you signed in. Technical information is used to operate the service, to keep it available, and to understand which pages are read.

None of it is used for advertising, for profiling, or for automated decisions about you. It is not sold, and it is not rented.

Authentication is handled by Supabase. When you sign in, Supabase stores session data in first-party cookies on this domain. In production they are marked Secure and use SameSite=Lax, which limits when they are sent in a cross-site context. The site's authentication code can access them when it needs to maintain or refresh the session.

These cookies exist to keep you signed in. They are not analytics or advertising identifiers. Signing out removes the session. Before you sign in, the public pages set no authentication cookie.

Vercel hosts the site, produces the request logs described above and provides Web Analytics. Supabase provides authentication, stores account records and hosts the dedicated database used by the product.

Cloudflare provides DNS and routes messages sent to the published contact address. Apple receives those messages in the destination mailbox.

These providers process information to supply those services under their applicable terms. This list will be updated if the service begins using another provider that handles personal information.

Account records are kept for as long as the account exists. If an account is deleted, its record is removed from the authentication system.

Technical logs and page-view measurements are retained according to the settings and retention periods of the relevant provider and account. The service does not build a separate long-term archive of those records.

Information is not sold or shared for advertising. It is made available to the providers named above only where needed to operate the service. There are no advertising networks, data brokers or social widgets integrated into the public site.

Information would only be disclosed further if we were legally required to do so, or where it is necessary to establish or defend a legal claim.

The site uses HTTPS and HSTS. A Content Security Policy restricts what the browser is allowed to load, framing is refused, and passwords are handled by the authentication provider. Access to the product database is separated from public browser access.

No system is perfect, and we do not claim otherwise. If you find a weakness, we would rather hear about it than not.

The providers named above operate infrastructure in more than one country, so information may be processed outside the country you are reading from. Where that happens, it happens under the transfer terms those providers make available to their customers.

Depending on where you live, you may have the right to ask what information we hold about you, to have it corrected, to have it deleted, to obtain a copy, to object to a particular use, or to complain to a supervisory authority.

The account system is intentionally limited, but technical records may also be held by the providers described above.

A request should come from the email address the account was created with, so that we can be reasonably confident of who is asking. We will answer without undue delay.

Send privacy and account-data requests to contact@secondariesdesk.com.

This notice will change as the service does. When it changes materially, the new version replaces this one on this page.