Privacy

Page-view counts. We use Vercel Web Analytics to see which pages are read. It sets no cookies and stores nothing in your browser. For each page view it records the page address, the referring site, approximate location derived from your IP address (country, region, city), browser, operating system, device type and the time. To count a visit once rather than on every click, Vercel tells visitors apart with a hash computed from the request, which it discards after 24 hours; we only ever see totals. It is not used to identify you or to follow you to other sites. The script is served from this domain, and a content blocker that stops it changes nothing about how the site works.

Hosting logs. The site runs on Vercel. Like any web server, it handles your IP address, the address you requested, your browser's user-agent string and the time, in order to deliver the page and to keep the service secure. Vercel keeps these request logs for a limited time (between one hour and 30 days, depending on the hosting plan); we look at them only to fix errors and stop abuse.

Your theme. If you switch between light and dark mode, the choice is saved in your own browser's local storage under the key theme. It never leaves your device.

Your follows. Following members and tickers needs an account (below). While you are signed in, your browser keeps a copy of what you follow in its local storage (fatcat_watchlist_v1) so pages can show it at once; signing out clears it.

Signing in is optional; everything on the site can be read without it. You need it only to follow members and tickers: your follows are kept on your account, on every device, and we can email you about them. There is no password: you sign in with Google, or with a link we email you that expires after 15 minutes.

For an account we store, in private storage that is not publicly accessible:

• your email address (the account is keyed by a one-way hash of it);
• the members and tickers you follow;
• your email settings: whether you get the daily digest, cluster alerts and the weekly roundup, and the date of the last digest we sent;
• when the account was created and last changed.

With Google, we ask only for your email address and whether Google has verified it; we do not receive your name, photo, contacts or anything else, and Google learns that you signed in to this site. With an email link, the address you type gets one email; nothing is stored unless the link is opened.

Cookies. Signing in sets two cookies, both for 30 days: fcw_session, which proves you are signed in and cannot be read by scripts, and fcw_signed_in, which only tells the page to load your account. During a Google sign-in, fcw_oauth holds a one-time check value for up to ten minutes. These are strictly necessary for the sign-in you asked for; none is used for analytics or advertising, and signing out removes them.

Emails. A new account gets a daily digest (at most one a day, and only on days something you follow has new filings). Every digest has a one-click unsubscribe link, which stops the emails and keeps your account; you can also switch them off on your dashboard. We send nothing else.

Deleting it. “Delete account” on your dashboard removes the record immediately. We keep accounts until you delete them.

• No cookies unless you sign in, and then only the sign-in cookies described above. No newsletter: the only emails are the digests you choose.
• No advertising, no ad networks, no social-media pixels, no fingerprinting, and no third-party scripts: the site's Content Security Policy allows scripts from this domain only.
• Fonts are bundled with the site, so reading it makes no request to Google Fonts or any other font service.
• Members' official portraits come from the public unitedstates/images project, and company logos on ticker pages come from Financial Modeling Prep. Our server fetches and resizes them and serves them from this domain, so your browser never contacts those hosts.
• Share links are ordinary links. Nothing is sent to a social network unless you follow one and post from there.
• We do not sell, rent or trade personal data, and we do not use it for marketing.

The read-only API, llms.txt and the CSV exports need no key or account. Requests to them appear in the hosting logs like any page request and are not tracked any further.

If you write to us through the contact form, we store:

• your name, if you give one (it is optional);
• your email address, so we can reply;
• the topic you chose and your message;
• a one-way hash of your IP address, used only to limit how many messages can be sent from one place in a short time. Your IP address itself is not stored;
• when the message arrived and when we dealt with it.

Messages are kept in private storage that is not publicly accessible, and are read only by the person who runs this site, who signs in to a private admin page to do so. No sign-in script loads on any page. We use your message to answer it and, if it reports an error in the data, to fix it. We do not add you to any list.

We keep a message for as long as we need it to deal with your request and keep a record of any correction it led to, and no longer than 12 months after it is handled. You can ask us to delete it sooner at any time.

The site republishes public financial disclosures: periodic transaction reports that members of Congress file under the STOCK Act, and Form 4 reports that corporate insiders file with the SEC. These name public officials and company insiders and are published by the House Clerk, the Senate and the SEC so that the public can read them. We reproduce them as filed, for that same purpose.

If you think a row misreads its filing, please tell us through the contact form. We correct our own reading errors; we do not change what was filed. See the terms for how corrections work.

• Vercel Inc. hosts the site, runs the page-view analytics, keeps the hosting logs and stores accounts and contact-form messages in private storage. Vercel is a US company, and data it handles may be processed in the United States; see Vercel's privacy policy.
• Resend delivers the sign-in emails and digests, so it handles your email address and the content of those emails; see Resend's privacy policy.
• Google, only if you choose “Continue with Google”, confirms your email address; see Google's privacy policy.
• The operator's sign-in provider confirms who is signing in to the admin page. It receives nothing about readers or about anyone who writes to us.
• GitHub hosts the code and the disclosure database. No reader, account or contact data is stored there.

You can ask to see, correct or delete anything you have sent us, or object to how we use it, through the contact form. Use the email address you wrote from, so we can match the request to your message. We answer within 30 days. If you have an account, you can delete it yourself at any time from the dashboard.

Page-view counts are aggregated and cannot be traced back to you, so there is nothing in them to look up or delete. If you are in the EU, the UK or another place with data-protection law, you also have the right to complain to your local data-protection authority.

When what the site collects changes, this page changes with it and the date at the top moves. A change that uses data you already sent us in a new way will not apply to that data without your agreement.