Privacy Policy

This Privacy Policy explains what personal information Orin (“Orin,” “we,” “us,” or “our”) collects when you use the website and application at orin.finance (the “Service”), how we use and share it, how long we keep it, and the rights and choices you have. It applies together with our Terms of Service.

We do not sell your personal information, we do not run advertising, and we do not buy marketing lists.

1. Information you give us

Account. Your email address and, if you give it, your name. If you sign in with Google, we receive your basic Google profile (email and name) through our sign-in provider, Amazon Cognito. We never receive your Google password.
Payment. If you start Orin Pro, you enter your card on Stripe's checkout page, not ours. Orin never receives or stores your full card number. Stripe shares with us your subscription status, plan, billing dates, the country used for tax, and a customer reference. We also keep a copy of each billing message Stripe sends us about your subscription; these can include your billing name, email address and billing address, the plan, and the amounts charged.
Research activity. The companies you follow, screens you save, alerts you set, and the questions you ask Orin.
Holdings. Holdings you enter by hand, or — if you choose to connect a brokerage account through Plaid — read-only holdings, positions, and balances (see Section 6). You sign in to your brokerage in Plaid's window or on your broker's own sign-in page — never on Orin — so we never see your brokerage password, and we never receive the ability to trade or move money.

2. Information collected automatically

Usage analytics. We use PostHog to understand how the Service is used: pages viewed, clicks, and recordings of sessions. In a recording, everything you type into a form field is masked, and so are your holdings and portfolio figures, your connected brokerage, your name and email, and your conversations with Orin. A click records the label of what was clicked, except on those private parts of the page, where clicks are not recorded. Other things on the screen can appear in a recording — for example the pages and companies you look at, your watchlist, alerts and saved screens, and a search shown on a results page. After you sign in, this activity is linked to your account (user id, email, and name). PostHog stores an identifier in a cookie and in your browser's local storage, from your first visit.
Logs and errors. IP address, browser and device type, and timestamps, to secure the Service and diagnose errors. Errors are reported to Sentry.
Cookies we set ourselves, all needed to run the Service: your sign-in session (which also carries the protection against cross-site request forgery); a short-lived cookie while you sign in with Google; onboarding state; orin_billing (whether your account may pass the payment page); and orin_open (which companies a reader without an account has opened this month, so the free allowance can be counted); and orin_skin, only if you switch the site's design preview on or off. Your light/dark theme is kept in your browser's local storage. See Section 7.

3. How we use your information

to create and secure your account and sign you in;
to provide the research product, including your watchlist, holdings, screens, alerts, and answers;
to bill your subscription;
to send email you need (sign-in codes, billing notices such as trial-ending reminders), the weekly digest unless you turn it off, and email you switched on (such as alerts);
to understand and improve the Service and prevent abuse;
to comply with law and enforce our Terms of Service.

We do not use your information to make personalized investment recommendations. Orin publishes general research; “personalized” means organizing that research around the companies and holdings you chose to give us.

4. Who we share it with

We do not sell your personal information and we do not share it for advertising. We share it only with these service providers, and only as needed for their job:

Amazon Web Services. Hosting, database, file storage, and content delivery, and Amazon Cognito for sign-in. Receives everything the Service stores.
Stripe. Payments, as merchant of record for Orin Pro (it sells the subscription, collects tax, issues receipts, and handles disputes). Receives the card and billing details you enter at checkout, your email, and the plan; sends us the billing messages described in Section 1.
Resend. Sending our email. Receives your email address and the email's content.
PostHog. Product analytics and session replay (United States). Receives usage events and masked replays; after you sign in, your user id, email, and name.
Sentry. Error monitoring. Receives error reports, which can include technical request data.
OpenRouter, and the companies hosting the models OpenRouter routes our requests to. OpenRouter may send a request to the company that made the model or to another company that hosts the same model. What each feature sends (models as of October 2026):
- a question you ask Orin, with the research gathered to answer it — models from OpenAI and Google, with the answer checked by a TypeSafe model;
- a question you ask about a filing, with that filing's text — a DeepSeek model;
- a screen or an alert you describe in your own words — a Google model;
- research Orin writes about companies (its views, filing and earnings-call summaries, the Desk Note, event write-ups) — models from Z.ai, Google, DeepSeek and Anthropic, and, when one of those is unavailable, a fallback model (currently from OpenAI or inclusionAI). This contains no personal information.
Anthropic, directly. Writes the introduction to the weekly digest from that week's market-wide events; it receives no personal information.
Voyage AI. Searching filings by meaning. Receives the text of a filings search or question.
ImprovMX. Forwards email you send to our orin.finance addresses (such as support@orin.finance) to our inbox. Receives those emails.
Google. Optional “Sign in with Google” — only if you use it.
Plaid. Optional brokerage connection — only if you connect an account.

We may also disclose information if required by law or valid legal process, to protect the rights, safety, and security of Orin or others, or in connection with a merger, acquisition, or sale of assets (in which case we will continue to protect your information under this policy or notify you of any change).

5. What we do not do

We do not sell or rent your personal information.
We do not show ads or use advertising trackers.
We do not buy marketing lists or send you unsolicited marketing on behalf of others.

6. Brokerage connections through Plaid

Connecting a brokerage account is optional. If you connect one, you use Plaid to establish a read-only link, and we receive holdings, positions, and balances for that account to personalize your research. Orin can never place trades or move money. You can disconnect a brokerage connection at any time. Plaid's handling of your information is governed by Plaid's own privacy policy and end-user terms.

7. Cookies and similar technologies

The cookies we set ourselves (Section 2) are needed for the Service to work — keeping you signed in, protecting requests, and counting the free allowance — and disabling them may stop it working. PostHog's cookie and local storage are for analytics, not for the Service to work; you can block them with your browser's privacy settings or a content blocker, and the Service keeps working. We do not use advertising or cross-site tracking cookies.

8. Email

We send email you need to use your account — sign-in and verification codes, trial-ending reminders and other billing notices, and account notices — through Resend from orin.finance addresses. We also send a weekly digest unless you turn it off; other email, such as alerts, is sent only if you switch it on. You control both in Settings, and every such email has a one-click unsubscribe. Stripe may also email you payment receipts and notices.

9. How long we keep it

We keep your information while your account is open and as needed to run the Service. When you delete your account (Section 10), we delete your account and the personal data the Service holds about you, usually within 48 hours and in any case within 30 days — including our copies of Stripe's billing messages about you — except what we must keep: Stripe keeps payment and tax records as the law requires, as merchant of record; our automated database backups roll over within 7 days; and our server logs expire after 90 days. Analytics events and error reports are kept by PostHog and Sentry under their retention settings. We may keep information that can no longer identify you.

10. Your rights and choices

Delete your account: email support@orin.finance from the address on the account. We delete it, usually within 48 hours and in any case within 30 days, and confirm by email. If you have a paid subscription, cancel it in Settings first, or ask us to cancel it as part of the deletion.
Access, correction, export: email the same address. We may need to confirm it is you.
Analytics: block PostHog with your browser's privacy settings or a content blocker (Section 7).
Email: turn the weekly digest and alerts off in Settings, or use the unsubscribe link in any such email.
Depending on where you live, you may have more rights; see Sections 11 and 12.

11. Your U.S. state privacy rights

Residents of California and of other U.S. states with consumer-privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon) may have the rights below. We honor them for every user, wherever you live in the United States.

Know and access: the categories and specific pieces of personal information we hold about you, where it came from, why we use it, and whom we disclose it to.
Correct inaccurate personal information, and delete it, subject to the exceptions the law allows (Section 9).
Portability: a copy of your personal information in a commonly used format.
Opt out of the sale of personal information, its sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these.
Limit the use of sensitive personal information. The sensitive personal information we hold — your account login, and the encrypted access key Plaid issues for a brokerage account you connect — is used only to provide and secure the Service.
No discrimination: we will not deny you the Service, charge you a different price, or give you a lower quality of service for using any of these rights.

Categories we collect (as described in Sections 1 and 2): identifiers and customer records (name, email, billing address, account id, IP address); commercial information (your plan and billing history); financial information you choose to give us (holdings, and read-only brokerage data through Plaid); internet and electronic activity (usage, session recordings, logs, and an approximate location our analytics provider may derive from your IP address); and the content you submit (questions, screens, alerts, watchlists). We collect it from you, from your device, and from the providers named in Section 4, for the purposes in Section 3, and disclose it only to those providers for those purposes. We do not sell or share it as those laws define those terms.

How to make a request. Email support@orin.finance from the address on your account, saying which right you want to use. We will confirm your identity by matching that address (we may ask for more if needed) and respond within 45 days, or tell you if we need up to 45 more days and why. You may use an authorized agent; we may ask the agent for your signed permission and ask you to confirm your identity directly.

Appeals. If we decline your request, you may appeal by replying to our decision with the word “Appeal.” We will respond in writing within 45 days. If you disagree with the outcome, you may contact your state's attorney general.

Browser privacy signals. We treat a Global Privacy Control signal as a request to opt out of the sale and sharing of your personal information, which we do not do in any case. We do not otherwise change our practices in response to “Do Not Track” signals, because there is no common standard for them.

12. Users in the European Economic Area, the United Kingdom, and Switzerland

If data-protection law in these regions applies to you, Orin is the controller of your personal information. We rely on these legal bases: performing our contract with you (your account, the research product, and billing); our legitimate interests in understanding, securing, and improving the Service (analytics, logs, and error monitoring), balanced against your rights; your consent, where we ask for it; and compliance with legal obligations. You may have the right to access, correct, delete, restrict, or port your personal information, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. To use these rights, email support@orin.finance. You may also complain to your local data-protection authority. Your information is transferred to and processed in the United States (Section 14); where the law requires it, these transfers rely on safeguards such as the European Commission's standard contractual clauses in our providers' data-processing terms.

13. Data security

We use reasonable administrative, technical, and organizational measures — including transport encryption, scoped access, and managed authentication — to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

14. Where data is processed

Orin hosts data in the United States (Amazon Web Services, us-east-1). Some of the providers in Section 4 process data in other countries under their own safeguards. If you use the Service from outside the United States, your information will be processed in the United States, where data-protection laws may differ from those in your country.

15. Children's privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will update the effective date above and, for material changes, tell you by email or in the Service at least 14 days before they take effect, unless a change is required by law sooner.

17. Contact

Questions about this policy, your personal information, or a privacy request can be sent to support@orin.finance.