Privacy Policy

This Privacy Policy explains what personal data Allocait collects when you use the Allocait website, waitlist and application (the "Service"), why we use it, who receives it, how long we keep it, and the rights you have. Allocait is a product of Kangaroo Labs LLC, an Arizona limited liability company doing business as RidgeXAI. In this policy, "we," "us" and "our" mean Kangaroo Labs LLC. We are the controller of your personal data: we decide why and how it is used. Our contact details are in section 10.

In short:

• We collect what you give us and what the Service needs to run it. Section 1 lists every kind.
• We do not sell your personal data, we do not share it for advertising, and we do not use it to train AI models.
• Allocait does arithmetic on the numbers and rules you enter. It does not decide anything about you, and it does not give investment advice.
• You can export and delete your data in Settings, or write to privacy@allocait.app. Your rights are in section 6.

1. Information we collect

Each item below says where the data comes from. You must give an email address and a password to create an account, and an email address to join the waitlist. Without them we cannot provide those parts of the Service. Everything else is optional or created by using the Service. Please do not enter account numbers, government ID numbers, or sign-in details for other services in names, notes, descriptions or feedback. Allocait needs none of them.

• Account information. Your email address, your password (stored by Supabase, our authentication provider, only in hashed form), when you signed up and last signed in, and the version of the Terms and this policy you accepted when you signed up, with the time and your confirmation that you are 18 or older. That record holds no IP address and no browser details. For each browser you are signed in on, Supabase keeps its IP address and browser details until that session ends; Settings shows the browser details. Supabase also keeps its own sign-in and security event records, including the IP address, for a period Supabase sets. Source: you, and your browser.
• Portfolio and rules data. The positions, allocation rules, scenarios, watchlists, inputs, monitors, notes and actions you enter by hand, import by CSV, or add through a connected agent, so the Service can check your holdings against your own rules. When you apply a setup file, we keep a record of what it added or changed, with the earlier name and settings of anything it changed, so you can undo it; we keep the newest three records for each file and the 20 newest in all, always keeping the latest record of each file, delete a record when you undo the import, and never store the file itself. Source: you, or an app you connect.
• Billing information. Your plan, its status and dates, and the customer id our payment provider, Polar, assigns you. When you start checkout, Allocait sends Polar your account email, IP address and an account identifier, which Polar uses to set your billing country, currency and tax and to match its records to your account. Allocait does not see or store your card number or other payment credentials. Allocait does keep a record that you started a checkout: the plan, the billing interval, whether a trial was offered, which page it started from, Polar's reference for the checkout, and the time. If you delete your account, we remove the link to your account, replace Polar's reference with a random value, and keep the rest of that record. It then names no one, and Polar cannot match it to its own records. Polar keeps its own billing records. Source: you, and Polar.
• Support requests, problem reports and feedback. What you write to us in a support request, plus the page you were on, the app version and your browser details. If you press Send report after the app stops responding, we also store the type of error, where in the code it happened and the name of the part of the app that failed, and the message you add, if you add one. We do not store the error message or anything from your portfolio. Feedback that a connected agent sends us about Allocait's tools is stored the same way. Email you send to us stays in our mailbox. Source: you, your browser, or your agent.
• When we look at your account. When you contact support, we can see your plan, your billing status, and your recent requests and billing events. We open the contents of your portfolio only when you ask us to. We read it without changing it, for a short time, through a support tool that logs each time. The log holds your account id and the reason until you delete your account, which removes them from it; the rest of the log stays. Direct queries we run on our database do not write to it. Source: our own records.
• Agent, API and webhook settings. The names, permissions and last use of your API keys (the keys themselves are stored only as hashes), the AI apps you connect, the webhook endpoints you add, and a log of what we sent to them. Source: you, and the apps you connect.
• Technical data and logs. Like any website, our hosting providers receive your IP address, browser details and the pages you request, and our server logs can hold your account id and email address when something runs for your account. Uptime monitors fetch public pages, and our scheduled jobs send Better Stack a short heartbeat message: the job name, counts, and the start of an error text if the job failed. Source: your browser, and our servers.

Error reporting is switched off at the time of this update, so no error report from the app or our servers is sent anywhere. If we switch it on, a report to Better Stack would hold the error message and stack trace, the page path (without its query string or fragment) or the server function involved, your browser and operating system, the app version, and the IP address of the sender. A server report could include an account or subscription id, with email addresses and keys removed. We would update this policy when we switch it on.

We count visits ourselves, with no third-party analytics service. Our own server adds one to a daily total when someone opens the home page, one when someone opens the sample portfolio, one when someone first changes the sample, and, in earlier versions, one when someone first saw a result for numbers they typed into the sample. No cookie, account, or other identifier goes into those totals. To limit abuse, we keep a salted hash of the IP address for about an hour, then delete it. When you sign up, your account also records whether you started from the sample portfolio.

We count the first run the same way. Our own server adds one to a daily total when someone first opens the welcome screen, one for the answer someone presses on it (by hand, with AI, or by pasting ranges, and in earlier versions tracking by hand, following research or a plan, using a bot or agent, or building a process), one for the way someone picks to start (seeing an example or importing a rules file, and in earlier versions setting up their own portfolio or connecting an agent), one when someone first sees a check of their own positions, and one when someone first checks a change they typed. These totals record no account, email, or other identifier. They only say how many people reached each step.

Your answer on the first screen is counted, not stored, and is not used to choose any number. If you arrive through a link that names how you invest or where you found us, we keep that label with your sign-up details (the signup_for and signup_ref fields of your account). We read those labels in totals, for example how many people from each starting point began a trial.

Waitlist

If you join the waitlist, we keep your email address, when you joined and last joined, the page you joined from, and which version of this notice was in force. We use these only to tell you when Allocait opens, apart from the optional answers described next. Our legal basis is your consent, which you can withdraw at any time.

You can also tell us, all optional, how you would start (by hand or with AI), a short note on how you check your portfolio today, and whether you are open to a short chat. If you say yes to the chat, you can add an X username. We keep it only with that choice. We read how you would start and your note to understand how people work, so we can shape Allocait before launch. The chat answer and the username let us contact you about early access and research, and we use the username only to reach out to people who said yes. We never post, follow or tag from it, and we do not verify it. Our legal basis for each of these is your consent, which you can withdraw at any time by emailing privacy@allocait.app. We never show these answers to anyone else, and no API returns them.

To limit abuse, we also keep a salted hash of your IP address, a pseudonymous value, never the address itself. One copy is kept with your entry; a separate rate-limit record is deleted after one hour. To check that your email domain can receive mail, we look up the domain (not your address) through Cloudflare's DNS service.

We delete your entry, with the optional answers, 12 months after you last joined, or sooner if you ask. Deleting an Allocait account also removes the waitlist entry, with its answers, made with the same email.

Every email we send to the waitlist carries an unsubscribe link, in the message and in the headers that let a mail app unsubscribe in one step. Opening the link only shows a page; you withdraw when you confirm there, or when your mail app sends the one-step request. We then stop emailing the address and clear the optional answers you gave. We keep the email address with the time you withdrew, so we do not mail it again, until the 12 months pass or you ask us to delete it. If you join again, that is a new sign-up. You can also email privacy@allocait.app from the address you joined with.

Stored on your device

The Allocait website and app set no advertising or analytics cookies, and we do not use what they keep on your device to track you across other sites. They keep a few values in your browser's storage. Most exist so that a feature you used works. Two exist so that we can count steps and where sign-ups came from, and the list says which:

• your sign-in session, until you sign out;
• your theme (also saved to your account when you are signed in) and sidebar preferences;
• the last compliance results Home showed you for each portfolio, so it can show what changed (allocait.verdicts, cleared when you sign out);
• after you join the waitlist, your email and join date, so your pass shows when you come back. It expires 90 days after you join.
• the changes you made to the sample portfolio, for up to 24 hours, so they are still there after you sign up (allocait:carry:v1). They are written only when you press the sign-up button, and removed when you finish setting up;
• the billing period (monthly or annual) that was showing when you pressed a sign-up button, for up to 24 hours, so the plan page can open on it after you confirm your email (allocait:period-hint);
• the name and address of an app you are connecting, for up to 1 hour, while you approve it (allocait:oauth-pending:v1);
• for this tab only, in session storage: that you opened a setup link, so the setup dialog opens after sign-in (allocait.setup-intent, kept up to 6 hours), and the time of the last automatic reload after an update, so a reload cannot repeat in a loop (allocait:stale-deploy-reload-at);
• for this tab only, in session storage, used for counting: the label from a link that names how you invest or where you found us (allocait:persona-hint and allocait:ref), and a flag for each step above this tab has already counted (allocait:funnel:, then the step's name).

Apart from the sign-in session, which the app sends to authenticate your requests, your theme, and the label from a link, which goes to your account when you sign up, these values never leave your browser. You can clear them in your browser's site data settings. Clearing the sign-in session signs you out. Our documentation site at docs.allocait.app is run by Mintlify, which may set its own cookies; its privacy policy governs those.

2. How we use your information

We use your information for these purposes, each with the legal basis shown. Where the basis is "legitimate interests," we have weighed our interest against yours and written the weighing down. You can object to any use that rests on legitimate interests (section 6).

We do not sell your personal or portfolio data or share it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile you. A check in Allocait is arithmetic the Service runs on the numbers and rules you entered, and you decide what to do with the result. We do not use your data to train AI models.

4. Who we share your data with

Service providers

We use the service providers below to run Allocait. They process personal data for us, as processors under the GDPR or service providers under US state laws, to provide their service to us. We give each only what its job needs. Where a provider offers data protection terms to its customers, we rely on them.

• Supabase, our database, sign-in and server-function provider. It stores your account, portfolio and waitlist data.
• Vercel, which hosts the website. It receives every visitor's IP address and request details.
• Amazon Web Services, which runs our price service. That service works with ticker symbols and prices.
• Twelve Data, our market data provider. It receives ticker symbols only, never your account information, position sizes or other portfolio data.
• Resend, which sends account email such as sign-up confirmations and password resets, the one feedback email some people get, and any email we send to the waitlist. It receives your email address and the message, and it keeps no contact list of its own.
• Better Stack, which monitors that the Service is up and receives the job heartbeat messages described in section 1, and the error reports if we switch them on.
• Slack, which notifies us when a support request, problem report or feedback arrives. It receives only the id, the topic, the category and where it came from (the app or an agent), never what you wrote or your email.
• Cloudflare, which answers the waitlist's email-domain lookup described in section 1.
• Mintlify, which hosts our developer documentation at docs.allocait.app. It receives the IP address and request details of docs visitors.
• Our email provider, which holds the mailbox for privacy@allocait.app and support@allocait.app, and so the email you send us.

Providers that act for themselves

Polar is our billing provider and the merchant of record for paid plans. It receives your account email, IP address and an account identifier from Allocait at checkout, plus the billing details you enter there. For the payment, tax and invoice records it keeps, Polar decides why and how the data is used, so it is a separate controller and its own privacy policy applies. Allocait does not hold the card number.

Apps and endpoints you connect

When you connect an AI app or agent, such as Claude or ChatGPT, through Allocait's MCP connection or an API key, it can read and change your Allocait data within the permissions you grant. A read-only connection can read your portfolios, positions, rules, research and rule results. A connection with write permission can also change them. The app's provider, such as Anthropic or OpenAI, receives what the app reads, handles it under its own terms and privacy policy, and is a controller in its own right. When you add a webhook endpoint, we send it event details such as portfolio ids, symbols and rule results, and whoever runs the endpoint receives them.

You can revoke an app or key, or remove an endpoint, in Settings at any time. That stops further access. It does not reach copies the app's provider or the endpoint already holds, and deleting your Allocait account removes only Allocait's copy. For these connections we record when a key or connection was last used and how many requests an account made, to apply rate limits. Allocait does not send your data to an AI model provider itself.

Legal requests and business changes

We disclose personal data when the law requires it, to respond to a lawful request, or to protect our legal rights, safety and security. If Kangaroo Labs LLC is part of a merger, acquisition, financing, reorganization or sale of assets, or goes through insolvency, personal data may transfer to the successor. The successor must honor this policy for data already collected, or tell you and give you a choice before it uses the data in a materially different way. Apart from this section, we do not share, rent, or sell your personal or portfolio data.

International transfers

Kangaroo Labs LLC is a United States company, and our providers may process data in the United States and other countries outside your own. If you are in the EEA, the UK or Switzerland, using the Service sends your data to the United States, which may not have the same data protection laws as your country. Where a provider offers them, the safeguards for that transfer are the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or the European Commission's Standard Contractual Clauses, with the UK addendum and the Swiss adjustments. Where neither applies, the transfer is necessary to perform our contract with you. You can ask which safeguard covers a provider that holds your data by writing to privacy@allocait.app.

5. Data retention, export & deletion

How long we keep data

Where we have a period, it is stated. Where we do not, the reason we keep the data is the test: we keep it for as long as that reason lasts, and no longer.

• Account, portfolio, support and feedback data: until you delete your account, because the Service exists to keep your rules and records available. A subscription that ends does not delete it, so you can export it or subscribe again. We do not currently delete inactive accounts on a schedule; if you stop using Allocait, delete your account or ask us to.
• Sign-in sessions: until the session ends, because you sign out or end it in Settings, or until you delete your account.
• Agent keys and connected apps: until you revoke them or delete your account. An authorization nobody approved is removed a day after it expires, and a connecting app that never completed is removed after 7 days. Held monitor events waiting to be sent are kept up to 7 days. Request counts for rate limits are kept from one hour to two days.
• Webhook delivery log: 90 days.
• Support access log: the record of each time we opened a portfolio. It holds the staff member's name, the time, the basis and the action, never portfolio content. We keep it as a security record with no time limit. When you delete your account, we remove your account id, the link to any report of yours, the reason and the portfolio id from it, so no record of you remains. Before then, you can ask us to review it under section 6.
• Billing event records from Polar: reduced to ids, status and dates when they arrive, and deleted after 90 days, or after 30 days if never processed.
• Checkout record: kept with no time limit, so we can count how many checkouts were started and not finished. When you delete your account, its link to you and Polar's reference are removed, and it holds no name or email.
• Waitlist entries: up to 12 months after you last joined, as described in section 1. Rate-limit records: one hour.
• Privacy requests: we keep a log of each request and our answer, with how we checked who asked, as proof that we met the law, for as long as a regulator or court could ask about it.
• Email you send us: in our mailbox until we delete it, which we do when it is no longer needed to answer you or to keep a record.
• Error reports, server logs and backups: kept by Better Stack, our hosting providers and Supabase for the limited periods their services set, then deleted. Deleted data can remain in a backup until the backup expires. If we ever restore a backup, we delete again what you had asked us to delete.
• Values in your browser: for the periods listed in section 1.

Export

In Settings, you can download your data as one JSON file whenever you are signed in; no plan is needed. It covers your account details (email, and when you signed up, last signed in and confirmed your email, plus the sign-up labels and the record of the Terms version you accepted), portfolios, positions, rules, scenarios, watchlists, playbooks, inputs, monitors, actions, saved charts, the records of setup files you applied, your subscription, API key names and permissions (never the keys), connected apps, webhook endpoints and their delivery log, compliance snapshots, support requests and feedback.

Records only our servers can read, such as billing event records, checkout records, usage counters, our notes on your requests, the monitor delivery queue (kept up to 7 days) and your waitlist entry, are available on request at privacy@allocait.app.

Deletion

You can permanently delete your account in Settings, after confirming your password. This deletes your account, the records tied to it in our database, the waitlist entry made with the same email and the billing event records that name you. If you have a subscription, we cancel it at Polar first, then ask Polar to delete and anonymize your customer record. Deletion cannot be undone.

Some copies outlast it. The checkout record described in section 1 stays, with its link to your account and Polar's reference removed. Polar keeps the order, invoice and tax records it must keep as merchant of record. Backups, server logs and error reports remain until they expire as described above. The support access log described in section 1 stays, with you removed from it. Slack notifications hold only ids. Resend's email logs keep the address we wrote to, and email you sent us stays in our mailbox until we delete it. Copies held by apps you connected and endpoints you added are theirs. A waitlist pass in your browser stays until it expires or you remove it. If any step fails, we finish it by hand; you can also ask at privacy@allocait.app.

6. Your rights

Whoever you are and wherever you live, you can ask us to do any of the following, and we will act on it under the law that applies to you:

• Access: get a copy of your personal data and learn how we use it.
• Correction: fix data that is wrong or incomplete. Most data is editable in the app.
• Deletion: have your data deleted, subject to what section 5 says stays.
• Portability: receive your data in a structured, common, machine-readable format. The Settings export is one JSON file.
• Restriction: ask us to pause our use of your data while a dispute about it is settled.
• Objection: object to any use that rests on our legitimate interests, including the counts, logs and feedback email in section 2. We will stop unless we have a compelling reason that outweighs yours, or we need the data for a legal claim. You can object to direct marketing at any time, and we will stop.
• Withdrawing consent: withdraw any consent you gave, such as the waitlist consent, at any time. Earlier use stays lawful.
• Complaint: complain to a data protection authority, as described below.

How to make a request

Use Settings to export your data, change it, or delete your account. For anything else, email privacy@allocait.app. If you are on the waitlist only, email us from the address you joined with, or use the unsubscribe link in an email we sent you. Requests are free. If one is manifestly unfounded or excessive, the law may let us charge a reasonable fee or refuse it, and we will tell you why.

We act on a request when you make it signed in to your account or write from the email address on it. If we cannot tell it is you, we may ask you to confirm by a reply to that address, and we may need a little more information. We will not give data to an address that is not on the account. You can use an authorized agent: send us your written permission, signed by you, and we may confirm directly with you.

We answer within one month. If a request is complex or we have many, the GDPR lets us extend that by up to two more months, and we will tell you within the first month. Under US state laws we answer within 45 days and may extend once by up to another 45 days where the law allows, and we will tell you why.

EEA, UK and Switzerland

Where the GDPR, the UK GDPR or the Swiss FADP applies to us, the bases in section 2 are the lawful bases they require. You can complain to the data protection authority where you live or work or where you think a breach happened. In the UK that is the Information Commissioner's Office. In the EEA, the European Data Protection Board lists the authorities on its website. We would welcome the chance to address your concern first. No law requires you to give us personal data apart from what section 1 says you must give to create an account.

US state privacy rights

If you live in a US state with a consumer privacy law, you may have the right to know and access the personal data we hold, to correct it, to delete it, to receive it in a portable format, and not to be treated worse for using these rights. We do not charge a different price or give a different service because you use them. Over the past 12 months we collected and disclosed, for business purposes, these categories:

We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of anyone under 16. We do not show targeted ads. We do not collect sensitive personal information to infer anything about you. To the extent your account sign-in details count as sensitive under a state law, we use them only to run your account and keep it secure, so no right to limit that use applies. We have not disclosed personal information to third parties for their direct marketing, including under California's Shine the Light law, and we do not sell covered information under Nevada law.

Global Privacy Control: we do not sell or share your data, so a Global Privacy Control signal has nothing to switch off. We treat it as a valid request to opt out of sale and sharing, which already is how the Service works for everyone, and the Service does nothing different when your browser sends it. Do Not Track is the same: we do not track you across other sites.

If we decline your request, you can appeal by emailing privacy@allocait.app with "Appeal" in the subject line and your reply to our answer. We answer an appeal in writing within 60 days, or sooner where your state's law requires, and tell you why if we uphold the decision. If you are still not satisfied, you can contact your state attorney general.

7. Security and breaches

We rely on Supabase's infrastructure for encryption in transit and at rest. Passwords and API keys are stored only as hashes. Database rules limit each account to its own rows, and we limit each provider's and each of our own team's access to what it needs to do its job; opening a portfolio goes through a logged support tool. No method of transmission or storage is perfectly secure, so we cannot promise that your data will never be accessed without permission.

If a personal data breach affects you, we will tell the people and the authorities the law requires, within the deadlines the law sets. Where the GDPR applies and a breach is likely to put your rights at risk, we notify the supervisory authority within 72 hours of becoming aware of it where feasible. We tell the people affected without undue delay when the risk to them is high, by email to the address on the account. We keep a record of every breach.

8. Children's privacy

Allocait is for adults. You must be 18 or older to create an account, and we ask you to confirm that at sign-up. Allocait is not directed at children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has given us personal data, write to privacy@allocait.app and we will delete it.

9. Changes to this policy

We may update this Privacy Policy. When we make a material change, we will update the "Last updated" date above and tell account holders by email or in the app, at least 30 days before it takes effect, unless the law or a security issue needs it sooner. Where the change needs your consent, we will ask for it again. Waitlist members hear from us by email. Earlier versions are available on request at privacy@allocait.app.

10. Contact us

Kangaroo Labs LLC, doing business as RidgeXAI, is the controller of your personal data. Our postal address is:

If you have questions about this Privacy Policy or want to exercise a data right, contact us at privacy@allocait.app. For help with your account, email support@allocait.app.