This Privacy & Cookie Policy explains what personal information Diadem Edge collects, why, who receives it, how long it is kept, and the choices you have. Diadem Edge is a brand name, not a company. The service is operated by the individual developer who runs Diadem Edge, who is the controller of the information described here and can be reached at [email protected].
Accounts are optional. You can use the whole service without signing in or telling us who you are, and Diadem Edge takes no payments. If you choose to sign in with Google to save watchlists, we also hold the account information described below. The only personal information we hold is what this policy describes.
What We Collect
If you sign in with Google. When you choose to sign in, Google shares your Google account identifier, your email address and whether Google has verified it, and your name. We store these with the date your account was created and when you last signed in. We also store what you save: the names and order of your watchlists, the stocks on them with when you added each and its rating at that time, the members of Congress you follow, and when you last opened your Following page. We never receive your Google password, and we get no access to your Google account, contacts, Drive, or Gmail.
Feedback and error reports you send. If you use the feedback form or the "Report an error" form on the Congress Trades pages, we store the type of report, your message, the time it was sent, and your email address if you choose to give one. The email field is optional; we use it only to reply to you. Please do not put personal information in the message itself.
Emails you send us. If you email [email protected], we receive your email address and whatever you write.
Technical request data. Like any website, our servers receive your IP address, the address of the page or data you requested (which includes any search text you typed), the time, and your browser's user agent. We use your IP address to apply rate limits that stop abuse, and our hosting provider records requests in server logs.
Analytics, if it is on. When analytics is active (see Cookies below), we record which pages you visit, the buttons and links you click, the stocks and sectors you view, the text of stock searches you run along with how many results they returned, and basic timing data for requests. These events are tied to a random device identifier, not to your name or email. Our analytics provider also receives your IP address with each event and uses it to estimate your approximate location. If you sign in, analytics is not linked to your account: requests about your account and watchlists carry no analytics identifier, and your name and email address are not sent to our analytics provider.
Error reports. When a page or request fails, an error report is sent to our error-reporting provider, as described under Cookies below.
Apart from the name Google shares if you sign in, we do not collect names. We never collect passwords, payment details, or precise location, and we do not buy data about you from anyone.
How We Use Information and Why
We use feedback and emails to read and respond to what you sent and to correct errors in our data. The legal basis is our legitimate interest in running an accurate service, and your choice to contact us.
We use technical request data to deliver the service, keep it secure, and stop spam and abusive traffic. The legal basis is our legitimate interest in a working, secure service.
If you sign in, we use your account information to sign you in, keep you signed in, and store and show your watchlists and the members you follow. The legal basis is providing the service you asked for by signing in. We do not send you email, and we do not use account information for analytics or advertising.
We use analytics to understand which features are used and to improve the product. In the EU, EEA, and UK the legal basis is your consent, which you can withdraw at any time.
We do not use your information for advertising, we do not send marketing email, and we do not sell or share personal information for cross-context behavioural advertising.
Cookies and Similar Technologies
We do not use advertising, cross-site tracking, or social media cookies. We set one cookie of our own, and only if you sign in. The service uses the following cookies and browser storage.
Strictly necessary and preference storage. We record your cookie choice in your browser's local storage under the key de_analytics_consent, and your light or dark theme choice under de_theme. Each holds only that one setting, contains no identifier, and never leaves your browser. The first is needed to honour your choice on later visits; the second only exists if you switch themes.
Sign-in cookie. When you sign in, our API at api.diademedge.com sets a cookie named de_session. It holds a random token that keeps you signed in, of which we store only a one-way hash. Scripts on the page cannot read it, and it is sent only to our API. It lasts 30 days from the last time you use the service and is deleted when you sign out or delete your account. It is strictly necessary for being signed in, so it does not depend on your analytics choice.
Google sign-in. The sign-in button is provided by Google. Its script loads only when you open the sign-in prompt, never on page load. When it loads, Google receives your IP address and may set or read its own cookies, under Google's Privacy Policy.
Product analytics. We use PostHog, provided by PostHog, Inc. While analytics is active, PostHog sets a cookie and matching local storage entries whose names begin with ph_, holding a randomly generated device identifier and session information. The PostHog cookie has a maximum lifetime of 365 days. No analytics storage is written before consent where consent is required, and declining removes any PostHog storage that was previously set.
Error reporting. We use Sentry, provided by Functional Software, Inc., to be told when a page or request fails. A report is sent only when something breaks, and contains the error message and technical details of the failure such as the browser version and the page address. It contains no cookie, no browser storage, no advertising or device identifier, and no request headers or form contents, and we have configured Sentry not to collect your IP address. Because it sets no storage on your device and is used only to keep the service working, it runs on our legitimate interest in a functioning product rather than on your analytics choice; you can object to that processing using the contact details below.
Visitors whose browser time zone places them in the EU, EEA, UK, or Switzerland, or whose location we cannot tell, are asked before any analytics storage is created. Elsewhere analytics is enabled by default. In either case you can change your decision at any time by opening , and withdrawing is as straightforward as granting.
You can also block or delete cookies and site data through your browser settings. Blocking our cookie stops you staying signed in, but everything that does not need an account keeps working. Clearing site data also resets the choices stored in your browser.
Who Receives Your Information
We use the following service providers to run Diadem Edge. Each processes information on our behalf and only for the purpose listed.
- Cloudflare, Inc. serves the website. It receives your IP address and the pages you request.
- Railway Corporation hosts our application server and the in-memory store that holds rate-limit counters. It receives every request to our API, including your IP address and any search text, and keeps server logs.
- Supabase, Inc. hosts our database, which stores feedback and error reports including any email you gave and, if you sign in, your account information, watchlists, and followed members.
- GitHub, Inc. stores our encrypted weekly database backups, which include feedback, error reports, and account information.
- Google LLC provides sign-in. If you open the sign-in prompt, your browser loads Google's script, and if you sign in, Google tells us your account identifier, email address, and name. Your Google account itself is governed by Google's own privacy policy.
- PostHog, Inc. receives analytics events when analytics is active.
- Functional Software, Inc. (Sentry) receives error reports.
Market data, news, and filing providers receive requests from our servers, not from you, and receive none of your information. We may also disclose information when required by law, to protect rights or safety, or as part of transferring the service to a new operator, in which case this policy would continue to apply to information collected under it.
How Long We Keep It
- Account information, watchlists, and followed members: kept until you delete your account. Deleting it removes them from our database at once; they remain in encrypted backups for up to 90 days, after which each backup is deleted automatically.
- Sign-in sessions: a session stops working 30 days after it was last used. It is deleted when you sign out; expired sessions are deleted the next time you sign in, and all of them when you delete your account.
- Feedback, error reports, and emails you send: kept until you ask us to delete them, so that we can follow up on corrections. Once deleted, they remain in encrypted backups for up to 90 days, after which each backup is deleted automatically.
- Rate-limit counters: your IP address is held in memory for no more than two hours and then expires automatically.
- Server logs: kept by Railway for the log retention period of our hosting plan and then deleted.
- Analytics events: kept by PostHog for up to one year.
- Error reports: kept by Sentry for up to 90 days.
- Browser storage: the sign-in cookie lasts 30 days from last use; the PostHog cookie lasts up to 365 days; the consent and theme settings stay until you clear your browser's site data.
Your Choices and Rights
Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, to receive a copy of it, to restrict or object to how we use it, and to withdraw consent where we rely on consent. You can switch analytics off at any time with .
If you have an account, your account page shows your name, email address, watchlists, and the members you follow, and you can delete the account there at any time. Deleting it removes your account information, watchlists, followed members, and every sign-in session at once. Feedback you sent was never linked to your account, so it is not deleted with it; ask us and we will delete that too.
To make a request, email [email protected]. For feedback you sent, telling us the email address you used or roughly when and what you wrote is usually enough for us to find and delete it. Because analytics is tied only to a random device identifier, we generally cannot link it to you unless you give us that identifier. We respond within one month.
If you are in the EU, EEA, or UK, you also have the right to complain to your local data protection authority. We would appreciate the chance to address your concern first.
Children's Privacy
The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us and we will delete it.
International Data Transfers
The providers listed above are based in the United States and may process information there or in other countries where they operate. If you use the service from the EU, EEA, or UK, your information is therefore transferred outside those areas. The United States has not received a general adequacy decision covering all transfers, so we rely on the safeguards in our providers' data processing agreements, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and on the EU-U.S. Data Privacy Framework where a provider is certified under it. You can avoid the analytics transfer entirely by declining analytics.
Security
We use reasonable technical and organisational safeguards to protect personal information, including encrypted connections, encrypted backups, storing only a one-way hash of each sign-in token, and restricting access to feedback and account information to the operator. No system is completely secure, and we cannot guarantee absolute security.
Changes and Contact
We may update this policy from time to time, and the date at the top of this page shows when it last changed. If we start collecting new kinds of personal information, we will update this policy before doing so. Questions and privacy requests can be sent to [email protected].