Privacy Policy

1. Controller

The controller responsible for your personal data is Penumbreal, the sole proprietorship (eenmanszaak) of Tuna Battaloğlu, registered with the Netherlands Chamber of Commerce (KvK) under number 42159345, VAT identification number NL005545981B19, established at De Nieuwe Erven 3, Unit 15248, 5431 NV Cuijk, the Netherlands. Contact: [email protected].

Penumbreal has not appointed a data protection officer, as it is not required to; privacy questions and requests go to [email protected].

2. Scope

This policy covers the Tenebra website (tenebra.penumbreal.com), the Tenebra app for iPhone and iPad including TestFlight builds, the public pages (/live, /record, /r/...), the API, the Excel add-in and support correspondence. It does not cover third-party websites, marketplaces or services we link to or integrate with, which have their own policies.

3. What we collect

Account data: if you sign in with a Penumbreal account, the e-mail address, the display name if you gave one and a unique account identifier, which Microsoft passes to us when you sign in; your password is held by Microsoft and never reaches us. If we create an account for you, a username, an e-mail address where provided and your password stored only as an argon2id hash (a salted, deliberately slow one-way hash; we never store or see the password itself). In both cases, your plan, your settings and the date your account was created. For TestFlight testers, Apple shares with us the e-mail address you tested with and basic device and crash information.

Content you provide: the hypotheses, questions, notes, comments and ticker symbols you submit; conversations with the Desk; watchlists; alert rules; and any support messages. Ticker symbols describe instruments you choose to follow; Tenebra never asks for or stores holdings, amounts, account numbers, brokerage credentials or any link to a real portfolio.

Usage and technical data: server logs with IP address, timestamps, requested paths, response codes, user agent and app version; the identifiers of analyses and questions you run, their cost and duration; API key identifiers, scopes, quotas and usage counts; crash and diagnostic information; and, if you enable notifications, a device push token.

Payment data: when you buy a paid plan, our merchant of record (Lemon Squeezy) collects your name, e-mail, billing address, VAT number if any and payment details under its own privacy policy. We receive your e-mail, customer and order identifiers, plan, status and invoice references, never card numbers.

We do not collect special categories of personal data (such as health, political opinion or biometric data) and ask you not to submit any. Face ID or Touch ID, if you enable the lock in the app, is handled entirely by Apple on your device; biometric data never reaches us.

4. Why we process it, and on what legal basis

• To provide the Service you asked for: accounts, sign-in, tracked hypotheses, analyses, the Desk, alerts, the simulation, the API and add-in, support (performance of a contract, art. 6(1)(b) GDPR).
• To bill and administer paid plans and comply with tax and bookkeeping law (contract, art. 6(1)(b), and legal obligation, art. 6(1)(c)).
• To keep the Service secure, prevent abuse and fraud, enforce quotas and investigate breaches of our terms (legitimate interest, art. 6(1)(f)).
• To operate, measure, debug and improve the Service, including reviewing how the models perform and where they err, using aggregated or de-identified data wherever possible (legitimate interest, art. 6(1)(f)).
• To send push notifications and e-mails you have enabled or that are needed to run the Service, such as security or billing notices (contract, and consent for optional notifications, which you can withdraw in the app or device settings).
• To publish the record and the live index, which contain hypothesis names, probabilities and grades but no account information (legitimate interest in transparency, art. 6(1)(f)).
• To comply with legal obligations and respond to lawful requests from authorities (art. 6(1)(c)).

We do not sell personal data, do not run advertising, do not build marketing profiles, and do not make decisions with legal or similarly significant effects about you by automated means.

5. Artificial intelligence

To produce analyses and answers, the text of hypotheses, questions, notes you attach to an analysis and the relevant news are sent to large language models operated by Anthropic, PBC (United States). Anthropic processes this content as our processor under its commercial API terms, does not use it to train its models, and retains it only for abuse monitoring for a limited period under those terms. Do not include personal data of others, confidential information or anything you would not want processed by an AI provider in hypotheses, questions or notes. When you use the Desk or ask a question, the text you write, the conversation so far and, if the Desk needs it, the tickers in your book are sent to Anthropic to produce the answer. Model output is shown to you without prior human review; see the Research Disclaimer.

Answers in the Desk, analysis texts, briefings and estimate reports are generated by an AI model working from Tenebra's engine. They are research, not investment, legal or tax advice, and they can be wrong. Tenebra makes no decisions with legal or similarly significant effects about you by automated means.

6. Who receives your data

We use these processors:

• Microsoft Ireland Operations Ltd (Azure): hosting, database and backup storage, region Sweden Central (EU).
• Microsoft Ireland Operations Ltd (Microsoft Entra External ID): Penumbreal account sign-up, sign-in, e-mail verification and password reset, with the account directory held in Microsoft's European data location; Microsoft also keeps sign-in records for that service.
• Cloudflare, Inc.: network proxy, DNS, TLS termination and DDoS protection; traffic may pass through Cloudflare data centres worldwide.
• Anthropic, PBC: AI models, as described in section 5 (United States).
• Apple Inc.: push notifications, TestFlight distribution, iCloud storage of the operator's work files (which can include copies of the database) and, for App Store purchases if offered, in-app purchase handling.
• Lemon Squeezy, LLC (when paid plans launch): merchant of record for paid plans, including invoicing and tax collection (United States); it is an independent controller for the purchase itself.
• Microsoft Corporation (when the add-in is published): distribution of the Excel add-in through Microsoft's marketplace, if you install it that way.

News, market data and prediction-market prices are fetched by our servers from public sources (Google News, GDELT, Yahoo Finance, Polymarket, FRED and OpenSky). When you ask the Desk a question or create a hypothesis, a few keywords from its text are sent to Google News and GDELT as a search query; no account information or IP address of yours goes with them. The website's map loads tiles from CARTO, which sees your IP address and browser like any website you visit. The website also loads scripts and a stylesheet from unpkg.com, which sees your IP address the same way. We may disclose personal data to professional advisers, to authorities where the law requires, to a successor if the business is transferred or converted into a company, and to anyone you ask us to share it with.

7. International transfers

Your data is stored in the European Union, except copies in the operator's iCloud storage (section 8), which Apple may hold outside the EU. Where a processor operates from the United States, transfers rely on the EU-US Data Privacy Framework where the processor is certified and, in any case, on the European Commission's standard contractual clauses with supplementary measures. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

• Account data and content: for as long as your account exists. When you ask us to delete your account, we delete it from the live system within 30 days, except as stated below.
• Desk conversations, analyses and notes: until you delete them or your account is deleted.
• Published hypotheses and their grades: kept indefinitely in the public record in de-identified form (name of the hypothesis, probability, outcome), as the record is the product's audit trail.
• Penumbreal account: kept by Microsoft for as long as the account exists. It is shared by Penumbreal products, so ending your Tenebra access does not delete it unless you ask; on request we delete it within 30 days. Microsoft keeps sign-in records for a limited period under its own retention rules.
• Server and security logs: up to 60 days.
• Database backups: kept 14 days on the server and up to 120 days in a separate storage account in the EU, encrypted at rest by the storage provider, then deleted automatically. The operator's computer, its iCloud storage and its encrypted company backup, kept for the business's legal record-keeping, can hold older copies. Copies in backups are never restored except to recover from a failure.
• API usage and cost records: 12 months.
• Billing and invoice records: 7 years, as Dutch tax law requires.
• Support correspondence: 2 years after the matter is closed.

We may keep data longer where needed to establish, exercise or defend legal claims or to comply with a legal obligation.

9. Security

Traffic is encrypted in transit (TLS). Passwords of accounts we create are stored as argon2id hashes; passwords of Penumbreal accounts are held by Microsoft and never reach us. Data at rest is encrypted by our hosting provider. Production access is key-based and limited to the operator. The servers sit behind a firewall that accepts web traffic only through Cloudflare, and sign-in attempts are rate-limited. API keys are stored hashed and can be revoked at any time. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the Autoriteit Persoonsgegevens as the GDPR requires.

10. Cookies and local storage

The website sets aol_session, which is strictly necessary to keep you signed in (30 days if you choose to stay signed in or sign in with a Penumbreal account, otherwise until the browser closes). When you sign in with a Penumbreal account it also sets aol_oidc for at most ten minutes, to match the sign-in page's answer to your browser, and Microsoft's sign-in page at penumbreal.ciamlogin.com sets its own strictly necessary cookies to run the sign-in. Signing out of Tenebra also signs you out of the Penumbreal account. No analytics, advertising or third-party tracking cookies are used, so no cookie banner is shown. The app opens the Penumbreal sign-in page in a private browser window that keeps no cookies. The app stores your settings, cached data and the acceptance of these documents on your device only. The Excel add-in stores your API key in Office's secure storage on your machine.

11. Your rights

You have the right to access your personal data and receive a copy; to have inaccurate data corrected; to have data erased; to restrict processing; to receive the data you provided in a portable format; to object to processing based on legitimate interest; and to withdraw consent at any time where processing relies on it, without affecting earlier processing.

Write to [email protected]. We may ask you to verify your identity. We respond within one month, extendable by two months for complex requests, and we will tell you if we extend. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority of your country of residence.

12. Children

Tenebra is not directed at children and may not be used by anyone under 18. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

13. Public pages and search engines

The live index and the record are shown to every signed-in user and are not open to search engines. They show hypothesis names, probabilities, deadlines, outcomes and grades. They never show account names, notes, conversations or tickers. Estimate reports at /r/... are unlisted: anyone with the link can view the report, which contains the question asked and the estimate but no account information. When the Desk runs an estimate for you, it creates such a report, so do not put a private person's name in a question.

14. Changes to this policy

We may update this policy. Material changes are announced in the app, on the website or by e-mail, and the apps will ask you to acknowledge the new version. The effective date at the top tells you which version applies.

15. Contact

Privacy questions and requests: [email protected]. Postal address: De Nieuwe Erven 3, Unit 15248, 5431 NV Cuijk, the Netherlands.