Privacy Policy

Last updated November 4, 2026

This policy explains what Keystone by Solid Finance (the “service”, run by Solid Finance LLC, “we”) collects about you, why, and what you can do about it. We keep it short because we collect little.

What we collect

Your account: your email address and, if you choose, your name. If you sign in with Google or X, we also keep that account’s permanent ID (and your X handle) so we can recognise you next time. We never see your Google or X password.
Your plan: which plan you have, its dates, and your Stripe customer and subscription IDs.
Payments: handled entirely by Stripe. Your card number never reaches us; we only learn whether a payment succeeded, and its amount.
How you use the service: the days you open the app, which portfolios you open, and the choices you make (for example your wheel spins and promo codes).
The beta and new-portfolio list: if you reserve a spot, your email, name (if you give one), what you chose and your country, kept until the beta ends or you ask us to delete it.
Page statistics: which pages and free notes are opened, how far people read, whether the audio is played, which buttons are tapped (for example Reserve a spot), and the country, device type and site people came from. If you are not signed in this is anonymous: we set no cookie for it and keep no IP address, only a code that changes every day and cannot follow you from one day to the next, and we respect “Do Not Track” and Global Privacy Control. If you are signed in, it is linked to your account so Sam can see what is useful. It is kept for up to 400 days.
What you send us: help requests, questions to Sam, feedback, refund requests and the reasons you pick or type.
Security records: for sign-ins and changes we record the time, your IP address, approximate country and city, and device type, to detect abuse and protect accounts. Your sign-in attempts are kept for 90 days and you can see them in the two-factor sign-in window; a sign-in from a new country or device is marked so you can spot one that wasn't you.
Two-factor sign-in, if you turn it on: the secret key that links your authenticator app to your account, and your recovery codes stored only in scrambled (hashed) form, so nobody can read them back. See below.

Two-factor sign-in (optional)

Any member can turn on two-factor sign-in in their account settings. After you sign in your usual way (emailed code, password, Google or X), we then ask for a 6-digit code from an authenticator app on your phone, such as Google Authenticator, 1Password or Authy.

It is optional. It is off until you turn it on, and you can turn it off again with a code from your app.
What we store for it: the secret key your app uses to make the codes, kept in our app database, which is encrypted at rest; and your one-time recovery codes, stored only as hashes. We also note when it was turned on and the last code used, so a code can't be used twice.
Never shared: the secret key and the codes are used only to check your sign-in. We don't send them to anyone, including Google, X or the maker of your authenticator app, and the QR code you scan is drawn by our own site.
If you lose your phone: use one of your recovery codes. If you lost those too, ask through the Help page; after checking it is you, we can turn two-factor off so you can sign in and set it up again.
When you turn it off, or your account is closed, the secret key and recovery codes are deleted.

What we use it for

To run your account, show the portfolios your plan includes and take payment.
To email you: sign-in codes, plan changes and receipts, notes from Sam you opted into, and answers to what you sent. Each note has a one-tap switch-off link.
To keep the service secure and prevent fraud and abuse.
To understand what is used, in totals, so we can improve it.

We do not sell your information, and we do not use advertising trackers.

Who handles it for us

Cloudflare: hosting, the database and our email sending.
Stripe: payments and subscriptions.
Google and X: only if you choose to sign in with them. They tell us your verified email or account ID.
Yahoo Finance: share prices. No personal information is sent to it.
YouTube: some pages show a video thumbnail, which your browser loads from YouTube.

We share information with others only where the law requires it, or to protect the service and its members.

Cookies and storage

We use sign-in cookies, which are necessary for the service to work (your session, which lasts 30 days if you tick “Remember me” and otherwise ends when you close the browser, a browser you confirmed, a browser you chose to remember for two-factor sign-in for 30 days, and a short-lived one for the two-factor step), and your browser’s local storage for small preferences such as Simple view. We use no advertising or analytics cookies.

How long we keep it

We keep your account while it exists, and records of payments and security events for as long as needed for accounting, legal and security reasons. Security records are cleared on a rolling basis.

Your choices

Ask to see, correct or delete your information, or to close your account, using the Help page. Closing an account does not cancel a Stripe subscription; cancel it first in My plan.
Turn off emailed notes with the link in each one.
Sign out any time. Signing in on a new device ends the session on the old one.

Other things to know

The service is for people 18 and over. Our servers and providers may be in the United States and other countries. If we change this policy we will update the date above, and tell you in the app if the change is important.