Privacy Policy

The short version

• Your financial models are stored in your browser, not on our servers. We do not have a copy.
• Your account is your email address and a password, or your Google account if you choose to sign in with Google. Either way it is held by our authentication provider.
• When you use an export or an AI feature, your model is sent to our servers for that request only, and for AI features it is forwarded to a third-party model provider. We do not store it.
• Ticker symbols you look up are sent to a market-data provider.
• We use no advertising, no tracking pixels, and no analytics as of the date above. If we add error monitoring or analytics, this policy will say so first.

1. Account information

When you create an account we collect your email address and a password. These are stored and verified by Supabase, our authentication provider, which processes them on our behalf. We use your email to sign you in, to send account emails such as confirmation and password reset, and to notify you of material changes to the Service or to these documents. We do not sell it and do not use it for marketing without your consent. If you sign in with Google instead, we receive the name, email address, profile picture and account identifier that Google shares with us, and we do not store a password for that account.

If you use Google to sign in, Google's own privacy policy applies to what Google does on its side. We use what Google shares only to create and identify your account.

Signing in sets session cookies that are strictly necessary for the Service to know who you are. They contain no tracking identifiers and are not shared with third parties.

2. Your financial models

Everything you enter into a model (historical financial statements, forecast assumptions, company descriptions, comparable companies, cap tables, notes) is saved in your web browser's local storage on your device. It is not transmitted to us and not stored by us. This is why the Service works offline once loaded, and why your models are not available from another browser or device.

Because we do not hold your models, we cannot recover them if your browser storage is cleared, and we cannot see them, back them up, or hand them to anyone. If we introduce optional server-side storage in future, it will be opt-in and this policy will be updated before it is available.

3. When your model leaves your browser

Some features cannot run in the browser. When you use one, the current model is sent to our servers for that single request, processed in memory, and discarded when the response is returned. We keep no copy. Our hosting provider may retain standard request logs (time, route, status, IP address) for a limited period for security and operations. Those logs do not contain the model.

Exports. Generating an Excel workbook or a slide deck sends the model to our server, which builds the file and returns it to your browser. Nothing is retained.

AI features. Features that classify line items, suggest forecast assumptions, propose comparable companies, or review a summary send the relevant parts of your model, which can include a private company's financial statements, to a third-party AI model provider, currently OpenAI or Anthropic, depending on how the Service is configured. That provider processes the data under its own terms and privacy policy. We send only what the feature needs, we do not include your email or account identity, and we do not use your data to train any model. If you do not want your financial data sent to an AI provider, do not use the AI features. Every other part of the Service works without them.

Market data. Looking up a listed company or its peers sends the ticker symbol to Finnhub, or Yahoo Finance when no Finnhub key is configured. Only the symbol is sent. Nothing from your model is. Market figures shown in the Service and in exported files carry the provider's name and a timestamp.

4. Cookies, analytics and tracking

As of the effective date, the Service sets only the session cookies described above. There are no advertising cookies, no third-party trackers, no fingerprinting, and no analytics software. We may add error monitoring (to learn when the Service breaks) and privacy-respecting usage analytics (to learn which features are used). If we do, this policy will be updated before they are enabled, and any such tool will be configured not to receive the contents of your models.

5. How long we keep information

Account information is kept for as long as your account exists. Request logs held by our hosting provider are retained for its standard period and then deleted. Models are never held by us, so there is nothing for us to retain or delete.

To delete your account, email hello@thecel.app from the address on the account. We will delete it from our authentication provider and confirm. Deleting your account does not delete models from your browser. Clear your browser's site data for the Service to do that.

6. Your rights

You can ask us what account information we hold about you, ask us to correct it, ask us to delete it, or object to how we use it, by emailing hello@thecel.app. We will respond within thirty days. If you are in Brazil, these rights are provided under the Lei Geral de Proteção de Dados (LGPD), and under the GDPR and UK GDPR if you are in the European Economic Area or the United Kingdom. In either case you may also complain to your local data-protection authority.

7. Where data is processed

Our servers and those of our providers are located in the United States, and account information is processed there. If you use the Service from outside the United States, your account information is transferred to and processed in the United States under this policy.

8. Security

Every request to the Service's application interfaces requires a signed-in account and is rate-limited per account. Passwords, for accounts that use one, are handled by our authentication provider and are never visible to us. Connections use HTTPS. No system is perfectly secure, and because your models are held in your browser, the security of your own device matters as much as ours.

9. Children

The Service is not directed to anyone under 18 and we do not knowingly collect information from them.

10. Changes to this policy

When this policy changes, the effective date at the top changes with it. For material changes (in particular, any new category of third party that receives your data, or any server-side storage of models), we will notify account holders by email or in the Service before the change takes effect.

11. Contact

Thecel, 31 South Street, Brighton, MA 02135. Privacy requests: hello@thecel.app.