Privacy Policy

It covers visitors to our public Research Hub (research, team, fund, and subscribe pages) and members who sign in to the platform. “We” refers to the DogBone Capital investment club operating this platform.

We only collect data needed to run the club platform:

• Account identity (via Google sign-in). When you sign in we receive and store your email address, name, and profile image from Google, and we store the OAuth tokens needed to maintain your session. This is how we authenticate you and control access.
• Member profile. Optional fields you choose to add: profile photo, bio, headline, skills, university, graduation year, a LinkedIn URL, and a short trading-background signup profile, shown on your member page and the public team page. Officers of your club can read the signup profile in the members directory; it is not part of recruiting.
• Trading activity (simulated). The orders, fills, positions, ledger entries, realized P&L, and any journal/thesis notes you record. These power your portfolio, performance, and the club leaderboards.
• Research contributions. Research you upload (files stored in object storage) and contributor attribution (display name, and an email if provided) shown on published research.
• Newsletter subscription. If you subscribe, your email, optional name, and your frequency/content preferences, plus when you subscribed and the source of that consent.
• Access requests. If you request access, the email, name, and message you submit, so an administrator can review it.
• Technical and product telemetry. Standard server logs and in-app event records (e.g. news-pipeline and engagement events) used to operate, secure, and debug the platform. This includes how long a page stays open (time-on-page), tied to your account when signed in or the same cookie-less, browser-local identifier already used for page views when signed out. This is never a third-party analytics service. If error tracking is enabled, diagnostic error reports are sent to our error-tracking processor with PII scrubbing at the boundary.
• Problem reports you submit. If you use “Report a problem,” we store the page, your description, and, only if you check the technical-context box, the current page, browser identifier, and recent on-screen error text your browser already held. That box is never checked for you, and a report never includes your portfolio holdings or trading activity.

We do not sell personal data, run advertising, or use third-party analytics/marketing trackers.

The club enforces a one-account rule (see our Terms of Use). To identify accounts that may belong to the same person, we compare only these signals:

• emails you have linked to an account, or that match an email linked to another account;
• your declared name and university, matched against another account’s;
• your Google sign-in (SSO) identity; and
• your LinkedIn URL, if you have provided one, matched against another account’s.

That is the complete list. We do not use device or browser fingerprinting, IP address correlation, or any capture of your prompts, keystrokes, or session activity to detect duplicate accounts, and we do not reserve a general right to use signals beyond the four above. A match creates an internal record for review, not an automatic suspension; both accounts are notified of what was found and how to respond before any account restriction takes effect.

Where the platform records the history behind a decision, such as a trade idea, an order, a strategy version, a declared data source, or a disclosure flag, we call that a decision artifact. We keep an audit trail of these enumerated artifacts, not a general log of your activity. In these artifacts we do not capture keystrokes, browsing history, session recordings, or the raw prompts and transcripts of your conversations with an AI tool. If you used AI while making a decision, the artifact records that AI helped and which model was used; the full prompt or transcript is attached to your record only if you choose to attach it. Provenance for an external dataset you declare using is self-attested: it records what you told us you used, not an independent verification of that dataset. This provenance is retained for as long as you hold the associated record, follows the same archived-season presentation as the rest of your history, and is removed on account deletion along with the rest of your personal data.

AI usage records. Each time you use one of the platform’s AI tools (the Tutor, the Research Assistant, or Find), we keep a usage record of that use: which tool it was, a topic category worked out from what the tool did or whether a lesson was open (never from your words), the page or lesson you opened it from, how many tokens it used, and what it cost. Your club’s admins and faculty advisors (and platform operators, when supporting your club) can see these records member by member, including your Tutor use. These usage records never hold what you typed or what the AI answered. Your Research Assistant conversations are saved in your chat history, and the Tutor saves your conversations only if you turn on tutor memory. If you turn off product usage analytics, we still count your AI use and its cost, but we do not record the page or lesson you opened a tool from, and the AI analytics pages do not show your topics.

When you enter a competition, members of your club can see your competition portfolio during and after the season: its positions, value, cash, return and filled trades, under the name already shown on the season leaderboard. Your trade plans (the thesis you write on each order) are shown to them too, unless you choose to keep them private when you enter or later from your own entry. Orders that have not filled, and anything else about you, are not shown. If you finish in the top 10, your competition rank shows on your profile, unless you choose to keep it on the leaderboard only. A season leaderboard shared with another school never shows trade plans, positions or trades.

Signed-in members can share first-party product-usage analytics that help us understand how the platform is used and where it can improve. It is on by default and you can turn it off with one tap during onboarding or any time under Settings → Privacy & data. When it is off, your account generates no behavioral analytics events on our servers. This is a real off switch, not a hidden collection. It is all first-party; we never send this to a third-party analytics service.

When it is on, we record:

• Page/route views and how long a page stays open (dwell time).
• Which features you interact with and for how long (e.g. chart tools, opening the order ticket, opening a research document, invoking the copilot, viewing an unlock step, acknowledging the welcome message, opening or confirming a fund mandate, starting a calibration or unlock test): counts and durations, not the content.
• Whether you opened a key communication, such as the welcome message, the leadership handbook, a fund mandate document, or an announcement page, and how long it stayed open. We record which communication and the dwell time, never the communication’s own text.
• A coarse device class (mobile / tablet / desktop and a viewport size bucket), never a device fingerprint.
• A profile-completeness snapshot (what percentage of fields are filled and which sections are empty).
• Your progression through the onboarding and unlock funnels, and through a few key flows (placing an order, joining a challenge, asking the research assistant or the tutor, writing a pitch, and whether you opened or hid a feature tip we showed you): which step you reached, and for a refused order the platform’s own refusal code, never what you entered.
• That you were signed out after going idle (a count, never what was on your screen).

Even when it is on, we never collect through this:

• Page content, keystrokes, or anything you type.
• Your order details, positions, or trading activity.
• Research document content or copilot prompts and responses.
• Precise geolocation or your contacts.

Who can see it

Admins and fund advisors can see a summary built from these events for a member in their organization: which communications you have read and for how long, your onboarding progress, your active days, which features you have used, and your quiz and calibration results. With usage analytics on (the default; turn it off in Settings), we record the pages you open and the features you use, with times. Your club’s admins and advisors can see this activity event by event, plus your orders, trade plans, competition entries and sign-ins. Every page an admin opens, and every time an admin views or exports member data or changes a setting, is logged with who and when. Your data export lists who viewed your data. If your usage analytics is off, your summary shows as off, not reconstructed from any other source.

Turning usage analytics off does not affect the operational records we must keep to run the club safely: authentication and security logs, your order and ledger records, scrubbed error diagnostics (if error tracking is enabled), and metering of AI/tool usage for billing. Those are not behavioral analytics and are described elsewhere in this policy.

The AI tutor keeps nothing about you unless you say so. Both choices below start off, are recorded with the version of this wording you agreed to (currently wp672-v1), and can be changed any time under Settings, Privacy and data. Turning the first one off deletes your tutor conversations that day.

• Keep my tutor conversations and build my concept map. Off unless you turn it on. Turning it off later deletes the conversations that day and freezes the concept map.
• An interviewer may see my concept map as counts, and I am told each time. Off unless you turn it on, and it only takes effect once you have also turned on "Show my record to hiring teams" in Settings. An interviewer sees counts, never a transcript, a narrative, or a score.

What we tell you before the first tutor conversation:

• What is kept: the concepts you worked on, what you missed, and what you reviewed. The tutor does not keep anything you say about your life, and it never asks about your feelings, stress, or wellbeing.
• How long: transcripts are kept for 90 days. The concept map is kept while your consent is on and is deleted when you revoke it.
• Who can see it: you. An interviewer sees your concept map as counts only if you turn on the second box below, and every view is listed for you under Settings, Privacy and data.
• A person, never the tutor, decides anything about you: eligibility, an interview, a rung. The tutor never makes that call and never scores you.

Nothing identifiable leaves the platform: prompts go to an approved model vendor under a pseudonymous id, with names and email addresses removed.

Under Settings, Privacy and data you can also read your consent ledger: every choice you have made and when, every time you changed who can see part of your profile, and everyone who has viewed your data, with their name and role.

The separate research-assistant prompt logging choice is also off unless you turn it on. Declining this never blocks the research assistant. It only controls whether the prompts you send it are stored against a pseudonymous reference.

We share data only with providers that help us run the platform:

• Google: Sign-in and OAuth identity. Data shared: Account identity: email, name, profile image, OAuth tokens. Its privacy terms.
• Neon: Managed PostgreSQL database hosting. Data shared: All platform records. Its privacy terms.
• Cloudflare R2: Object storage for profile photos and research files. Data shared: Uploaded files. Its privacy terms.
• Fly.io: Application hosting and server infrastructure. Data shared: All platform records, in transit and at rest on the host. Its privacy terms.
• Resend: Transactional and newsletter email delivery. Data shared: Email address, message content. Its privacy terms.
• Alpaca: Market data only: quotes and bars. Data shared: Ticker symbols. No personal data, and no brokerage account or order is created. Its privacy terms.
• Finnhub: Market news ingestion. Data shared: Ticker symbols. No personal data. Its privacy terms.
• Tiingo: Market news and price-fallback ingestion. Data shared: Ticker symbols. No personal data. Its privacy terms.
• Anthropic: Configured LLM provider: news screening, the order copilot, and the restricted AI tutor lane. Data shared: Submitted prompt text. On the tutor lane, names and email addresses are removed first. We do not send your account identity for any of these calls. Its privacy terms.
• OpenAI: Configured LLM provider: news screening and the order copilot. Data shared: Submitted prompt text. We do not send your account identity for these calls. Its privacy terms.
• Groq: Configured LLM provider: news screening and the order copilot. Data shared: Submitted prompt text. We do not send your account identity for these calls. Its privacy terms.
• Sentry: Error-tracking diagnostics, only if enabled. Data shared: Scrubbed error reports. Its privacy terms.

The newsletter signup and the access-request form are open to anyone, so both are protected against automated abuse. We limit how many submissions one network address can make in a minute, cap the size of a submission, and include a hidden field that a person never sees and never fills in. Refused submissions are not stored.

Some features send text to a language-model vendor. This list is generated from the platform’s own model configuration, so a provider the code can reach is always on it. How we use AI says what each feature is shown and what it is never shown.

• Anthropic: Not in use at this tier. Anthropic is a contracted vendor and no contract is signed, so nothing on this platform routes to it. It is listed because the code can reach it the day one is.. Key used: none configured. Training on prompts: PENDING-HUMAN: what the Anthropic API terms say about training on API inputs
• Groq: Not in use at this tier. Groq is a contracted vendor and no contract is signed, so nothing on this platform routes to it. It is listed because the code can reach it the day one is.. Key used: none configured. Training on prompts: PENDING-HUMAN: what the Groq API terms say about training on API inputs
• OpenAI: Not in use at this tier. OpenAI is a contracted vendor and no contract is signed, so nothing on this platform routes to it. It is listed because the code can reach it the day one is.. Key used: none configured. Training on prompts: PENDING-HUMAN: what the OpenAI API terms say about training on API inputs
• A self-hosted or third-party OpenAI-compatible endpoint: configurable, with nothing routed to it by default. Key used: yours. Training on prompts: PENDING-HUMAN: this provider is whatever endpoint an operator configures, so its terms are the operator's to state. It is excluded from every restricted lane.
• OpenRouter: reachable by AI judge, AI tutor, Claim adjudication, Eval runner, Agent-fleet Call review, Agent-fleet decision, Assessment generation, Claim adjudication assist, Course authoring assist, Error triage, Journal assist, News routing, News screening, Research assistant, Research compliance, Research data sourcing, Research orchestrator, Research oversight, Research reporting, Research subagent, Risk narrative, Trade copilot. It is a router; the parties whose models it serves for us are Alibaba Qwen, DeepSeek, Meta, Mistral AI, Moonshot AI, Z.ai. Key used: ours or yours. Training on prompts: Read on 2026-09-09; the Privacy Policy and the Terms of Service both say "Last Updated: August 31, 2026". Privacy Policy: "OpenRouter does not use your Inputs or Outputs for model training." It also says "Some Model Providers may use your Inputs and Outputs for model training or improvement" and that a customer should "select a Model or Model Provider that commits to not using your data for that purpose". Terms section 6.1: "Some Models may store or train on your Inputs for improving their own large language models and may allow you to opt-out of model training, as described in their Model Terms." Terms section 6.2: prompt logging is opt-in ("If you have opted into prompt logging in your account settings") and, once enabled, grants OpenRouter a "worldwide, perpetual, irrevocable, non-exclusive, royalty-free" licence over the logged content, including for commercial purposes and anonymized licensing. The customer is "solely responsible for reviewing the Model Terms applicable to each Model". So whether a request reaches a provider that trains on it depends on the account privacy settings and on the request provider-routing options OpenRouter documents (data_collection, zero data retention), not on OpenRouter alone. Prompt logging is never enabled on the platform account. Since WP784 (2026-09-09) the restricted lanes DO reach OpenRouter, and they satisfy the no-training rule by REQUEST SHAPE rather than by exclusion: every lane call sends the documented provider-routing options that deny data collection and require zero data retention, and an answer that does not name the upstream provider that served it is refused. The upstream sub-processors OpenRouter may route to on this platform behalf are the publishers of the open-weight models in the active chains (Meta, Mistral AI, Z.ai, DeepSeek, Moonshot AI, Alibaba Qwen) served by whichever host OpenRouter selects from its zero-collection set; which one served a given call is recorded on that call. Terms section 7 also states the service is offered to users 18 or older.

Every cookie we set is functional: it either keeps you signed in or remembers a choice you made. We set no analytics, advertising, or cross-site tracking cookies, and we load no third-party tracker, so no consent banner is required. This is the whole list, taken from the code that sets them:

• authjs.session-token (__Secure-authjs.session-token over HTTPS): Keeps you signed in. The session itself is stored in our database, not in the cookie. Until you sign out or the session expires.
• dbc-org-ctx: Which organization you are currently looking at, so pages load the right one. Session.
• dbc-org-ctx-synced: A marker that we already tried to set the organization cookie once, so we do not retry in a loop. Session.
• theme: Your light or dark preference, so the first paint is the one you chose. One year.
• dbc-design-system: Your chosen interface design (Classic, with Modern reserved for a later release), so the first paint is the one you chose. One year.
• density: Your compact or comfortable layout preference. One year.
• dbc_invite: The invite code you arrived with, held across the sign-in redirect. Short lived, cleared once the invite is used.
• dbc_member_invite: The member invite you arrived with, held across the sign-in redirect. Short lived, cleared once the invite is used.
• dbc-pending-enrollment: The enrollment you started before signing in, so it is not lost on the way back. Short lived, cleared once enrollment completes.
• dbc_signin_email: If your sign-in is turned away, the email address your school or Google sign-in sent us, so the request form can fill it in for you and an officer answers the address you really use. Two minutes, sent only to the request page, and cleared as soon as that page has read it or you sign in.
• dbc_challenge_visit: Remembers that you opened a challenge or team invite so the club can see who is still signing in. Thirty days.
• dbc_demo_convert: Set only if you ask to turn a demo walkthrough into an account. Short lived.
• viewed_<research id>: Counts one view per research note per hour, so a refresh is not a second read. One hour.

Account, profile, trading, and research records are retained while you are a member and for the club’s historical and audit purposes. Operational data is pruned on a schedule, deleted by the same code that runs the platform, not just described here:

• Non-portfolio news articles: kept for 30 days, then deleted automatically.
• Portfolio-relevant news articles: kept for 365 days, then deleted automatically.
• Dismissed news alerts: kept for 90 days, then deleted automatically.
• Read news alerts: kept for 30 days, then deleted automatically.
• Hourly team snapshots (downsampled to one per local market close): kept for 30 days, then deleted automatically.
• Product analytics events: kept for 180 days, then deleted automatically.
• RUM beacon samples: kept for 90 days, then deleted automatically.
• Consented page visits (time on page): kept for 180 days, then deleted automatically.
• AI tutor transcripts and turn provenance: kept for 90 days, then deleted automatically.
• Research-assistant prompt logs (pseudonymous, consent-gated): kept for 180 days, then deleted automatically.
• Idle research chat threads (and their messages and uploads): kept for 180 days, then deleted automatically.
• Claim adjudication assist logs: kept for 180 days, then deleted automatically.
• Consented product-usage events: kept for the life of your membership, and removed on account deletion or anonymization; not on an automatic timer.
• Trading activity (simulated): kept for 3 years in the live system, then in verified archive storage to 7 years from the date of the record, then deleted unless it has already been anonymized.

When a member departs, we anonymize their personal profile data while preserving the integrity of append-only financial records (which are anonymized rather than deleted). You can ask us to do this sooner (see your rights below).

• Access / export. Signed-in members can export their account data from Settings, or request a copy from us.
• Correction. Update your profile fields anytime under Settings.
• Deletion / anonymization. You can ask us to delete or anonymize your account. Financial ledger records are anonymized rather than hard-deleted to keep the club’s books consistent.
• Newsletter opt-out. Every email includes a one-click unsubscribe link; you can also manage preferences on the Subscribe page.

Questions or requests about your data? Contact a club administrator, or request access via our access request page. See also our Terms of Use.