Pineflows

Privacy Policy

Effective 17 September 2026. Applies to https://pineflows.com, app.pineflows.com, docs.pineflows.com, the Pineflows connector for Claude, and the Pineflows Robinhood Bridge Chrome extension (together, the Service). Pineflows is operated by Pineflows. Questions: support@pineflows.com.

In short

1. What we collect and why

Account. Your name, email address and a user id, received from Clerk when you sign in with Google. Used to create your workspace, identify you when Claude connects, and contact you about the Service.

Onboarding answers. Three multiple-choice answers: asset class, trading experience, risk style. Used to tailor the onboarding copy. They change nothing about how orders are placed.

Automations. Everything an automation is made of: its name, instrument, the adapter rules that turn alert text into a signal, sample alert messages, default quantity, mode (test, live, paused) and version history. Created by Claude on your instruction or by you in the workspace. Used to interpret alerts and place the orders you configured.

Alert log. The text of each TradingView alert delivered to your webhook URL, when it arrived, what the adapter made of it, and the outcome (test, placed, duplicate, blocked, rejected, unknown). Unrecognised alert bodies are kept verbatim so Claude can repair the adapter. Used to run the pipeline and to show you what happened.

Broker connection. If you connect Robinhood: the OAuth access and refresh tokens Robinhood issues, your account number, and the positions and order records we read to size sells and confirm fills. Tokens are encrypted at rest with a key held outside the database. We never see or store your Robinhood password. Disconnecting deletes the tokens at once.

Claude connector. When you add Pineflows to Claude, Claude acts through an OAuth grant tied to your account. We receive what Claude sends to our tools: automation definitions, sample alerts, mode changes, and the questions it asks about status. Your conversation and your Pine Script stay in your Claude account with Anthropic; we only receive text Claude includes in an automation.

Billing. Your Stripe customer id, subscription id and status (trialing, active, past due, canceled). Payment card details are entered on Stripe's pages and never touch our servers.

Chrome extension. The Pineflows Robinhood Bridge watches for one address, http://localhost:17051/, where Robinhood delivers its sign-in result. When that tab appears the extension sends the address's query string (a one-time authorization code and an encrypted state value) to pineflows.com and closes the tab. It reads no other pages, browsing history or cookies, stores nothing, and has no analytics. It also answers an "are you installed" message from pineflows.com.

Technical data. Our hosting provider records the IP address, browser and time of each request in short-lived server logs used for security and debugging. We run no analytics trackers. Advertising measurement runs only with your consent; see section 7.

Support messages. Emails you send us, kept so we can follow up.

2. Legal bases

For users in the EU, EEA, UK or Switzerland: we process account, automation, alert, broker and billing data to perform our contract with you; technical logs and fraud checks under our legitimate interest in keeping the Service secure; billing records to meet legal obligations; advertising cookies and anything else only with your consent, which you can withdraw at any time. We send you no marketing email.

3. Who sees your data

We share data only with providers that run part of the Service, each bound by their own data processing terms:

We disclose data to authorities only when the law requires it, and we tell you first when we are allowed to. We never sell personal data, share it for advertising, or profile you for lending or credit decisions.

4. Where data lives

Our servers and database are in the United States. If you use the Service from the EU, EEA, UK or Switzerland, your data is transferred to the United States under standard contractual clauses in our providers' agreements.

5. How long we keep it

6. Your rights

Wherever you live, you can ask us to show you the data we hold, export it in a portable format, correct it, delete it, or restrict what we do with it. Email support@pineflows.com; we answer within 30 days and never treat you differently for asking. If you are in the EU, EEA, UK or Switzerland you can also complain to your data protection authority. If you are a California resident, the rights to know, delete and correct above are how you exercise your CCPA rights; we do not sell personal information. Allowing advertising cookies counts as "sharing" for cross-context behavioural advertising under the CPRA; decline in the banner or click Cookie settings in the footer to opt out.

7. Cookies

Sign-in cookies. Clerk sets the cookies that keep you signed in. They are strictly necessary and expire when your session ends or you sign out.

Advertising cookies. Only after you click Accept on the cookie banner do we load the Meta Pixel and the Google Ads tag. They set cookies and identifiers on Meta's and Google's domains and tell those companies that an ad brought you to Pineflows and whether you signed up, started a trial or subscribed, so we can measure our ads and pay for them. Decline and nothing loads. Change your mind at any time with Cookie settings in the footer; withdrawal takes effect immediately. Your choice is stored for one year in a cookie named pf_consent on pineflows.com and its subdomains.

Stripe sets its own cookies on its checkout and portal pages. We set no analytics cookies.

8. Security

All traffic uses TLS. Broker tokens are encrypted at rest with AES-256-GCM using a key kept outside the database. Each automation's webhook URL is a secret you can rotate at any time. Access to production systems is limited to the people who operate the Service. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authorities as the law requires.

9. Children

The Service is for adults who can hold a brokerage account. We do not knowingly collect data from anyone under 18. If you believe we have, email us and we will delete it.

10. Changes

We will announce material changes by email or in the workspace at least 14 days before they take effect. The effective date at the top tells you which version applies.

11. Contact

support@pineflows.com. For data requests, write from the email address you sign in with so we can verify it is you.