Theta is an AI-powered assistant that helps US stock and options traders record trades,
review their portfolio, and generate dashboards through a chat interface. This policy explains
what data Theta handles and how it is protected.
1. Information we handle
Account & authentication — your sign-in identity (e.g. email) used to authenticate you.
Trading data you enter — trades, positions, and strategies you record in the app.
Your API keys (BYOK) — you supply your own Google Gemini API key (and optionally a Polygon.io key). These are encrypted on our server and are never returned to your browser or shared.
Google account connection (optional) — only if you choose to connect Google Sheets.
Billing & Payment details — when you subscribe to a paid plan, your billing details and payment card information are processed directly and securely by our payment processor, Stripe. We do not store your raw payment details or credit card numbers on our servers.
2. Google user data & Sheets access
Connecting Google Sheets is entirely optional. When you connect, Theta requests a single,
limited scope: https://www.googleapis.com/auth/drive.file.
This scope lets Theta create and update only the spreadsheets that Theta itself creates on your behalf (your exported portfolio).
Theta cannot see, read, or access any of your other Google Drive files or spreadsheets.
The OAuth refresh token returned by Google is encrypted (AES-256-GCM) and stored on our server. It is never exposed to the browser or any third party.
Theta's use of information received from Google APIs adheres to the
Google API Services User Data Policy,
including the Limited Use requirements.
3. How we use data
Data is used solely to provide the app's features to you: storing your trades, answering your
queries, and—when you ask—exporting your portfolio to your Google Sheet. We do not use your
trading data or Google data for advertising, and we do not sell it.
4. Sharing
We do not sell or share your personal data with third parties. Data is processed by the
infrastructure providers that run the service (e.g. Google Firebase) strictly to operate Theta,
by Stripe for secure payment processing, and by the AI provider tied to the API key you supply.
5. Data retention & deletion
Your data is retained while your account is active. You can disconnect Google Sheets at any time,
and you can request deletion of your stored data—including your encrypted tokens and API keys—by
contacting us at the address below.
6. Security
Sensitive credentials (API keys, OAuth refresh tokens) are encrypted at rest. Access to your
data requires authentication as you.
7. Changes
We may update this policy; material changes will be reflected by the "Last updated" date above.