Privacy Policy

GOptions · Last updated: 2026-10-02

This policy explains what personal information GOptions collects, why, where it is kept and what your rights are. We tried to keep it plain.

1. Who we are (controller)

GOptions (goptions.pages.dev) is run by an individual in Israel who is a sole proprietor (exempt dealer). There is no company. That person is the "controller" of the information described here. Contact for anything privacy-related: GOptions.app@gmail.com.

2. What we collect and why

When you ask for access and sign in with Google, we receive and store, for each user:

• your email address and your Google display name – to identify you and run the sign-in;
• when you asked for access (requestedAt), when and by whom you were approved (approvedAt, approvedBy) – to manage the invite-only beta;
• your tier (free or pro) and when it was set (tierAt) – to decide which features you see;
• your acceptance of the Terms and Privacy Policy: when you tick the checkbox at sign-up, we store a consent record (terms:<your email>) with the version you accepted and the time (acceptedAt) – to be able to show what you agreed to.

If you are removed from the beta, we keep a small removal marker (out:<your email>). It holds only your email address and the time of removal, and it is written only when an administrator removes you. Sessions issued before the removal end at their next refresh. It is kept for up to 400 days (the Cloudflare KV expiry), then it disappears by itself.

If you are a Pro user, we also store your preferences (colours and settings, at most 2 KB).

Google permissions (scopes) we ask for:

• openid, email, profile – to identify you (email and name);
• https://www.googleapis.com/auth/drive.appdata – to read and write your portfolio in a hidden, app-only folder in your own Google Drive ("appDataFolder"). The app cannot see your other Drive files.

Technical data: Cloudflare, which hosts GOptions, processes every request and keeps standard server logs (such as IP address, time and requested page). We don't use these logs for anything except running and securing the service.

Ticker symbols you look up are sent to our server functions to fetch market data. We don't store them. The market-data providers receive only the ticker, a User-Agent and an Accept header (see section 6).

We do not use analytics or advertising, we don't track you across sites, and we don't sell or rent your data. We don't give you recommendations or signals, and we don't build a profile of you.

3. Where your information is stored

• Your portfolio and deals live in your own Google Drive appDataFolder. They are never stored on our server and not in your browser's localStorage. You control them.
• Your browser keeps only your settings, your sign-in state (your email and tier) and, temporarily during sign-in, a copy of your unsaved edits.
• Account information and the consent record (section 2) are stored in Cloudflare KV, a database provided by Cloudflare.
• Session cookie in your browser (see section 5).

Google and Cloudflare operate worldwide, so your information may be processed outside Israel and outside your country.

4. Third parties

• Google – provides sign-in and Google Drive. Google's own privacy policy applies to your Google account. GOptions' use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements: we use it only to provide the features you see in the app.
• Cloudflare – hosts the site, runs our server functions, stores the KV data above and keeps standard server logs.
• Market-data sources – see section 6. They don't receive your IP address, cookies, email, name, language or portfolio.

We don't share your information with anyone else, except if the law requires it.

5. Cookies

GOptions uses only the cookies it needs to work. There are no advertising or analytics cookies.

• __Host-gopt_s – your session cookie. HttpOnly, Secure, SameSite=Strict, lasts up to 400 days. It holds your Google refresh token, encrypted, so you stay signed in. Signing out (which calls POST /api/auth/logout) clears it on this device only; sessions on your other devices stay signed in until you sign out there too or clear cookies.
• __Host-gopt_o – a short-lived cookie used during sign-in to protect against forged sign-in requests. It expires quickly.

The site also uses your browser's localStorage, but only for your settings, your sign-in state (email, tier) and a temporary copy of unsaved edits during sign-in – not for your portfolio. Fonts are served from our own site, not from Google Fonts, so your browser doesn't contact Google to load fonts.

6. Market data lookups

• Option prices are delayed by at least 15 minutes and stock (underlying) prices may be slightly delayed (the Yahoo stock price can be near real time). Prices are shown only to the administrators and to Pro users. They come from third-party public sources. Rates come from US Treasury / FRED data. Elsewhere in the app, values are calculated by the model.
• The lookups are made by our server functions, not by your browser, so those sources see requests from our server rather than from you. The providers receive only the ticker, a User-Agent and an Accept header – never your IP address, cookies, email, name or language, and not your portfolio. The ticker symbol you look up passes through our functions and Cloudflare's logs, and is not stored by us.

7. How long we keep things

• Account record (email, name, request/approval times, tier): while you have an account, until you ask us to delete it or we remove you.
• Removal marker out:<email> (your email and the removal time): up to 400 days after removal (KV expiry; the same as the longest life of a session cookie).
• Consent record terms:<email> (version and acceptedAt): while your account exists; deleted when your account is removed.
• Pro preferences: while you are a Pro user; deleted if you ask us to delete your data.
• Session cookie: up to 400 days, or until you sign out or clear cookies.
• Cloudflare server logs: kept by Cloudflare according to its own standard practice.
• Your Drive and browser data: until you delete it.
• Emails you send us: as long as needed to answer you and keep a record of your request.

8. Your rights

Under the Israeli Protection of Privacy Law (as amended by Amendment 13) and, where it applies to you, the GDPR, you can ask us to:

• access the information we hold about you;
• correct it if it is wrong;
• delete it;
• export it (we send it in a common, readable file).

This includes your consent record (terms:<your email>).

Email GOptions.app@gmail.com, preferably from the email address you signed up with so we can check it's you. We answer within 30 days. You can also complain to the privacy regulator in your country.

9. How to delete your data

1. Email GOptions.app@gmail.com asking us to delete your account data.
2. We remove you with the administrators' "Remove" action, which deletes your account record, access request, Pro preferences and consent record from our database. It also writes the removal marker (your email and the removal time), which expires by itself after up to 400 days; it's kept until then so that old sessions stop working. We confirm by email.
3. Please also revoke GOptions' access to your Google account at myaccount.google.com/permissions.
4. Your portfolio data in your own Google Drive appDataFolder and in your browser stays with you. Delete it yourself (remove the app's data in Google Drive; you can also clear this site's data in your browser to remove your settings and sign-in state). We can't delete it for you, because we don't hold it.

10. Security

Sessions use encrypted cookies (HttpOnly, Secure, SameSite=Strict). Access to the service is by the administrators' approval. Our database holds only the small amount of data listed above, and your portfolio is not on our servers. No system is perfectly secure. If a breach affecting you happens, we will tell you and report it as the law requires.

11. Children

GOptions is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you think a minor has signed up, write to us and we will delete the account.

12. Changes

We may update this policy. The "Last updated" date will change, and for significant changes we will try to tell you in the app or by email.

13. Contact

GOptions.app@gmail.com