Oracular: Privacy
Oracular is a personal project by Ethan Tam. It has no ads and no analytics. Signing in is optional: everything in the app works without an account. This page says what data touches the service and where it goes. It covers the website at oracular.ethantam.dev and the Android app, which opens the same site.
Last updated: 12 November 2026
What is collected
- Your account, only if you sign in. Signing in with Google gives Oracular your Google account's name, email address, profile photo and an ID for the account. Your Google password never reaches Oracular. Stored with them:
- your quick-access tickers, so they follow you to every device;
- your settings, so they follow you too: the range and candles a chart opens on, its type, your indicators and their settings, Pine scripts you write, and the view each card was left on;
- the alerts you set and the alerts that fired for you;
- when the account was created and last used.
Each signed-in device keeps a random session key in its browser storage. The server keeps only a one-way hash of that key, so the stored data can't be used to sign in. All of this is kept in a Cloudflare D1 database, except your settings, which are kept in Cloudflare Workers KV.
- Notifications, only if you turn them on. On a device where you turn on notifications, your browser gives Oracular a push address for that device and the keys to encrypt messages to it. Alerts are encrypted and sent there through your browser maker's push service (Google, Mozilla, Apple or Microsoft). Signing out on that device removes its push address.
- Feedback you choose to send. The Feedback button sends:
- your message;
- an email address, if you choose to give one (it's optional, for a reply);
- the page you were on;
- your browser's user-agent string (its name and version).
They are stored in a Supabase database so Ethan can read them and reply. Email [email protected] to have yours deleted.
- Chat messages. When you use the AI research chat, your messages are sent to a DeepSeek AI model through a Cloudflare Worker, together with the ticker's public market data. The Worker does not log or store your messages.
- Your IP address, for usage limits. The Workers count requests per IP address to enforce daily limits. A count lasts at most a day and isn't linked to anything else.
- This device. The app saves your quick-access tickers, chart settings and similar preferences in your browser's local storage, so they persist between visits. If you sign in, it also saves your session key and your name. Anyone who uses that browser can see that copy. Clearing the browser's data (or the Android app's storage) removes it.
Deleting your data
- On one device: signing out ends that device's session and stops its notifications.
- Everywhere: Delete account (in the account panel: the header on a computer, More on a phone) erases your account, tickers, settings, alerts, inbox, sessions and push addresses at once. It can't be undone.
- By email: you can also email [email protected] from the address you signed in with.
Who else processes data
- Cloudflare: hosts the site and the Workers, caches market data at the edge, and stores account data (D1) and settings (Workers KV).
- Google: runs Sign in with Google. When you sign in, Google knows you signed in to Oracular. Google also delivers notifications to Chrome and Android.
- Push services (Google, Mozilla, Apple, Microsoft): carry encrypted notifications to the devices where you turned them on. They can't read them.
- DeepSeek: generates the AI research and chat replies, on servers in China. Only the messages you type and the public market data for the ticker you're viewing are sent; never your account details.
- Supabase: stores feedback sent through the Feedback button.
- Bargo: members of Congress's trades, on the Smart Money page. Your browser asks bargo.ai directly for the ticker you're viewing, so Bargo sees your IP address and that ticker.
- Market data sources: Yahoo Finance, Nasdaq, FINRA, the SEC, FRED, the BLS, CNN, Google Trends, StockTwits and ApeWisdom. The Workers fetch from them on Cloudflare's servers. Those requests carry ticker symbols and dates, nothing about you.
The Android app
The Android app shows this website in Chrome, or another browser on your phone that can run it full screen. The only permission it can ask for is notifications, and only if you turn alerts on. It collects nothing beyond what this page describes. That browser's own privacy policy covers the browser itself.
What is not done
- No ads, no analytics, no tracking pixels, no cross-site tracking.
- No selling or sharing of personal data.
- Nothing about you is stored on a server unless you sign in or send feedback.
Changes
If this policy changes in a way that matters, the app will say so before it takes effect.