What we collect, why we collect it, and the one thing we want to be unambiguous about: your screenshots are not used to train models.
The short version
- We collect what we need to run the service: your email, the screenshots you choose to upload, the reports we produce from them, and basic usage records.
- We do not use your screenshots to train models, and we do not sell your data.
- Payments are handled by a merchant of record — your card details never reach our servers.
- You can ask for a copy of your data or ask us to delete it, and we will act on it.
Who is responsible for your data
Readout is the controller for the personal data described here. Write to privacy@readout.fyi for anything privacy-related, including requests to exercise your rights.
What we collect
- Account data — email address, display name if you provide one, sign-in provider identifier, and hashed authentication credentials.
- Images you upload — the chart screenshot you submit, plus the annotated version generated from it if you choose to save it.
- Analysis records — the report produced from your image, the model identifier, processing time, credit consumption and any error code.
- Technical data — IP address, browser and operating system, language, and coarse request logs used for security and abuse prevention.
- Billing status — plan, renewal date and transaction identifiers from the merchant of record. We never see or store full card numbers.
- Messages — anything you send to support.
Why we process it
- To perform the contract — running your scan, keeping your history, delivering what you paid for.
- Legitimate interests — securing the service, preventing abuse and fraud, fixing errors, and understanding which features are used. We keep this to what is necessary and you may object (see Your rights).
- Consent — product email, if you opt in. Withdraw it with the unsubscribe link in any message.
- Legal obligation — retaining invoices where tax law requires it.
Screenshots and model processing
A screenshot is sent to our inference provider so that a vision model can read it and return structured output. That provider processes the image on our instructions under a data-processing agreement, for the duration of the request.
Your images are not used to train any model — not ours, not the provider's. We do not build a chart dataset from customer uploads.
Retention: a screenshot is transmitted only for the duration of the request and is not retained on our servers after the report is returned; your report and its thumbnail are kept in your browser's local storage on your own device so you can revisit them, and clearing site data removes them. You can delete an individual scan at any time from your history.
What the app stores on your device
The app uses local storage, not advertising cookies. These keys exist in your browser and nowhere else: stcn_lang (language), stcn_market (red-up or green-up candle colours), stcn_theme (light or dark), stcn_history (saved reports) and stcn_profile (the optional onboarding answers used to word a report). Clearing site data removes all of it.
We do not run third-party advertising or cross-site tracking scripts. If we add product analytics later, it will be cookieless or consent-gated and this page will say so before it goes live.
Who we share data with
- Inference provider — to read your image and produce the report.
- Hosting and database — to run the application and store your account and history.
- Merchant of record (Paddle / Stripe) — to take payment, calculate tax and issue invoices.
- Email delivery — to send sign-in links, receipts and service notices.
- Authorities — only where legally compelled, and we will tell you unless prohibited.
We do not sell personal data, and we do not share it with advertisers or data brokers.
International transfers
Our providers may process data outside your country. Where that happens we rely on appropriate safeguards — standard contractual clauses or an equivalent mechanism — and we choose providers that offer them.
How long we keep it
Account data: while the account is open, then up to 30 days after deletion in backups. Uploaded images: up to 30 days. Reports: while your account is open, or until you delete them. Invoices and tax records: as long as tax law requires (commonly 7 years). Support messages: 24 months.
Your rights
Depending on where you live you can ask to access, correct, export or delete your personal data, object to processing based on legitimate interests, or withdraw consent. Email privacy@readout.fyi; we respond within 30 days and may ask you to confirm control of the account first.
If you are in the EEA or UK you may also complain to your local supervisory authority. If you are a California resident, you have the rights described in the CCPA/CPRA — including the right to know and the right to delete — and note that we do not sell or share personal information for cross-context behavioural advertising.
Security
Traffic is encrypted in transit, access to production data is limited to the people who need it, credentials are hashed, and payment card data never touches our systems. No service can promise perfect security; if a breach affects your data we will notify you and the relevant authority as required.
Children
The service is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a minor has created an account, write to us and we will delete it.
Changes to this policy
If we change how we handle personal data we will update this page and, for anything material, email account holders before the change takes effect.