Privacy policy

Who we are

Breakaway is provided by Breakaway Research LLC, a Florida limited liability company run by Andrew Gomes, in Florida, United States. The company decides how the personal data described here is used and answers for it (in the words of European law, the controller). Write to support@getbreakaway.com with any question about it; a person reads every message.

What we collect

Your email address and a hash of your password when you sign up. What you set up in the app: your watchlist and notes, your saved scans, your alert rules, and the history of the alerts that fired for you.

For each signed-in session we record the browser type and the full IP address the request arrived from, so that you can tell your own devices apart and revoke any you do not recognize. The Account tab in your dashboard shows that address partially masked; the full value is what we hold, and it is what appears in your own data export. Signing out of a session, or revoking it from the Account tab, deletes its record straight away; a session that simply expires is deleted within a day.

If you subscribe, Stripe collects your payment details directly. We receive only a customer reference and your subscription status, never your card number.

Breakaway in the iPhone app

If you subscribe inside the iPhone app, Apple takes the payment. We never see your card or your Apple ID. RevenueCat, the company that checks App Store subscriptions for us, holds a random id we give your account and the record of the subscription itself: the plan, the day it started, and the day it renews or ended. We keep the same record so the app knows you are a Pro member. When you delete your account, we delete our copy, and we ask RevenueCat to delete theirs. A log of the subscription's changes (the plan, what changed, and when) stays with us for our records, under the account's old id but with no name or email address. Apple keeps its purchase records under your Apple ID, as it does for every app. A subscription bought through Apple is canceled in your iPhone's Settings, not by deleting the account.

If you turn on alerts in the iPhone app, Apple gives the app a device token, a long random string that lets Apple deliver our alerts to that phone. We keep it with your account and send to it only while alerts are on for that phone. Turning alerts off on that phone stops them and marks the token off, and so does signing out on it; deleting your account removes it. Apple carries each alert to your phone.

If you sign in with Apple, Apple gives us an id that stands for your Apple ID, which we keep so we recognize you next time, and an email address. If you chose Hide My Email, that address is a relay address Apple made for Breakaway and forwards to you; it is the address on your account and the one our emails go to. Apple keeps the link to your real address; we never see it. Deleting your account deletes both, apart from the records that "Retention" says outlive an account.

Free trial records

A free trial is meant to be one per person. To enforce that we keep a small ledger, separate from your account: a one-way hash of your email address (never the address itself), the random id from the device cookie described below, and the IP address the sign-up came from. A later sign-up that matches an entry gets an account without a second trial.

Where you came from

If the link you arrived on carried campaign tags (the utm_source, utm_medium, utm_campaign, utm_content, and utm_term parameters you can see in the address bar), or if it was a member's share link, we keep those values in a first-party cookie named mm_attr for 30 days and record them on your account if you go on to sign up. If the link came from one of our ads on X, it can also carry X's click id (the twclid parameter X adds to the address), which the cookie keeps too, so the site can tell that you came from X. If you then sign up, we keep it with the record of that sign-up only until our server has told X of the sign-up and of any first payment (described under "Visitors from our ads on X"), and never longer than 30 days; it is not recorded on your account otherwise. A link from one of our ads on Reddit can carry Reddit's click id the same way (the rdt_cid parameter), kept for the same reason and not recorded on your account either. A link from one of our ads on Google can carry Google's click id the same way (the gclid parameter), kept for the same reason and not recorded on your account either. What is stored on the account is the campaign tags themselves, the page you landed on, the domain that sent you (for example the search engine or social site, never the full address you came from), and the code of the member who referred you, if there was one. Nothing else: no advertising identifier and no profile. It is kept for as long as the account is, it is used to work out which of our links brought people here and to credit the member who shared one, and it is never sold. Deleting your account deletes it.

Visitors from our ads on X

When you arrive from one of our ads on X, we load X's pixel, a small script from X, on the page you land on, so X can count that visit. If you then create an account, it loads once more, on the first page you see after signing up, to tell X that the sign-up happened. If that account later becomes a Pro member, it loads once more, on the first page after your payment, to tell X that a membership started, what the first payment was, and a code for that membership that we make from it and that means nothing outside Breakaway, so X counts it only once if it is told twice. It never carries your email or any payment details. When an ad opened a stock's page directly and your guest pass started by itself, X is told only once you use the pass: your first tap, or 15 seconds with a page on screen. Because the payment, or even the sign-up, often happens in another browser than the one the ad opened, our server also tells X of the sign-up and of a first payment directly, with the same codes, so X counts each only once: that it happened and when, what the first payment was, and X's click id from the ad, or, when the ad's link carried none, your email address in a one-way scrambled form (a SHA-256 hash), which X can only match to an address it already holds. X uses this to count which of our ads lead to sign-ups and to show them to people more likely to sign up. X receives that the visit or the sign-up or the membership happened, the address of the page, X's click id from the ad, and what any site's scripts can read about a browser, such as its type and screen size. Apart from that scrambled form of your email address, we send X no email address, no name, and nothing you type, and we switch off the pixel's features that would read form fields, record the buttons you tap, or time your visit. X's script keeps three cookies on this site, named _twpid, _twclid and _twsid, for up to 13 months. What X does with what it receives is covered by X's privacy policy.

Nothing else is shared with X, and no advertiser other than X, Reddit, and Google (below) gets anything from us. The pixel never loads for visitors who did not come from an ad on X, and apart from that one page after signing up and the one after a payment, it never loads while a signed-in member uses the site. It stops for your browser after 30 days, after a tagged link from anywhere else, or when you clear the mm_attr cookie.

Visitors from our ads on Reddit

When you arrive from one of our ads on Reddit, we load Reddit's pixel, a small script from Reddit, on the page you land on, so Reddit can count that visit. If you then create an account, it loads once more, on the first page you see after signing up, to tell Reddit that the sign-up happened. If that account later pays for a Pro membership, it loads once more, on the first page after the first payment, to tell Reddit that a membership started, what the first payment was, and a code for that membership that we make from it and that means nothing outside Breakaway (not the one X gets), so Reddit counts it only once if it is told twice. It never carries your email or any payment details. Reddit uses this to count which of our ads lead to sign-ups and memberships and to show them to people more likely to sign up. Reddit receives that the visit, the sign-up, or the membership happened, the address of the page, Reddit's click id from the ad, and what any site's scripts can read about a browser, such as its type and screen size. We send Reddit no email address, no name, and nothing you type, and our pages block the pixel's features that would read the page for email addresses or phone numbers, record the buttons you tap, or read the page's descriptions. Reddit's script keeps two cookies on this site, named _rdt_uuid and _rdt_cid, for up to 90 days. What Reddit does with what it receives is covered by Reddit's privacy policy.

Nothing else is shared with Reddit. The pixel never loads for visitors who did not come from an ad on Reddit, never for a link we or anyone else posted there, and apart from that one page after signing up and the one after a payment, it never loads while a signed-in member uses the site. It stops for your browser after 30 days, after a tagged link from anywhere else, or when you clear the mm_attr cookie.

Visitors from our ads on Google

When you arrive from one of our ads on Google Search, we load Google's tag, a small script from Google, on the page you land on, so Google can keep the ad's click id. If you then create an account, it loads once more, on the first page you see after signing up, to tell Google that the sign-up happened. If that account later pays for a Pro membership, it loads once more, on the first page after the first payment, to tell Google that a membership started, what the first payment was, and a code for that membership that we make from it and that means nothing outside Breakaway (not the one any other ad site gets), so Google counts it only once if it is told twice. It never carries your email or any payment details. Google uses this to count which of our ads lead to sign-ups and memberships and to show them to people more likely to sign up. Google receives that the visit, the sign-up, or the membership happened, the address of the page, Google's click id from the ad, and what any site's scripts can read about a browser (its type and its screen size). We send Google no email address, no name, and nothing you type. We switch off the tag's Google signals and ad personalization, so Google builds no advertising audience from your visit, and our pages block the frames its remarketing would draw. Google's tag keeps two cookies on this site, named _gcl_au and _gcl_aw, for up to 90 days. The _gcl_aw cookie holds the ad's click id; if it is missing when the tag loads, our page writes it back from the click id kept in the mm_attr cookie. What Google does with what it receives is covered by Google's privacy policy.

Nothing else is shared with Google through the tag. The tag never loads for visitors who did not come from an ad on Google, never for a Google search result, and apart from that one page after signing up and the one after a payment, it never loads while a signed-in member uses the site. It stops for your browser after 30 days, after a tagged link from anywhere else, or when you clear the mm_attr cookie.

Signing in with Google

You can create an account or sign in with a Google account instead of a password. If you do, Google tells us your email address, that Google has verified it, your name, and a Google account id, which we store so the same tap opens the same account next time. We receive nothing else: not your Google password, contacts, or anything in your Google account, and we never write to it. An account made this way has no password until you set one with the "Forgot password" link. To show the button and the one-tap prompt, Google's sign-in script loads on the sign-up and sign-in pages, on the public pages, and where a guest pass is asked to keep its stocks; apart from X's, Reddit's, and Google's pixels for visitors from our ads there, described above, it is the one script on the site that is not ours, it is not an analytics or advertising script, and we send it nothing about you. What Google records about a sign-in is covered by Google's privacy policy.

Page use

We measure our own pages. When you leave a page the browser sends us the path (for example /pricing) together with the view it was showing (a sort order or a filter you picked, never anything you typed), how many seconds the page was open, whether the screen is phone, tablet, or desktop size, the domain of the site that sent you if there was one, whether it was the first page of your visit, and whether the site was opened from your Home Screen. While a page is open the browser also says so once a minute, with the tab or view it is showing and how long it has been open, so we can count how many people are reading at a given moment; that note is kept in memory for a couple of minutes and never written down. On the public pages, such as the home page, the stock pages, and the sign-up page, the record also says which parts of the page came on screen and for how long, how far down the page you read, which buttons, links, and questions you tapped (by the button's name, never anything you type), taps on parts of the page that do nothing, how you left the page, how fast it loaded, any script errors, your screen width and connection speed class, the campaign tags on the link you arrived through, and on the sign-up form the name of the last field you used (never what was in it); it uses the same visitor cookie and sets no new one. The pages inside your account are measured the same way while you are signed in, or using a guest pass: which parts, tabs, and views were on screen and for how long, and which buttons, tabs, and links were shown and which you used, by their own names; on the scanner, also how many stocks came on screen (a count, never which ones) and whether you used its search box (never what you typed); that record is linked to your account and kept for 90 days. Never anything you type, and no script from anyone else. For signed-out visitors the record carries no address and no name: a one-way hash that changes every day, and a one-way hash of the visitor cookie described under "Cookies", which is how we can tell a first visit from a return. When you are signed in the record is linked to your account, so our support team can see which pages you used, and so a stock's page can tell you how many times you have looked at it lately when it suggests adding the stock to your watchlist. For a few member controls, such as the arrows that step through a list on a stock's page, we also count each use, with only the control's name, the kind of list, the screen size class, and the time: no account, no visitor cookie, and no page address. These records are kept for 90 days and then deleted. A few things about your use are kept on your account itself: when you first opened the site on a phone, when you first and last opened it from your Home Screen and how many times, and what you did with the cards that suggest putting Breakaway on your Home Screen or your computer (shown, their buttons used, or closed), so we can tell whether the cards help; they are in your data export and go when the account is deleted. Your browser keeps a few small notes for those cards (how many visits, and whether you closed one), which never leave it.

Session recordings

To learn where our site is hard to use, we record some visits. A recording shows the page as you saw it, where you scrolled, and what you tapped. Signed out, we record some visits to our public pages (the home page, our landing pages, the stock and sector pages, pricing, the FAQ, and the sign-up and sign-in pages, and a stock's page when an ad for that stock opens it directly): every visit that starts from one of our ads, and about one in four other first visits. With a guest pass, we record your visits to those pages and to the app's pages you open as a guest. With an account, whether a free trial, a free account, or a paid membership, we record your visits to the app's pages (the scanner, the stock pages, Insiders, Earnings, the map, Top 10, your watchlist and alerts, What's new, and the week) and to the public pages.

A recording never includes what you type: every form field is masked in your browser before anything is sent, so your password is never recorded. Your email address, your watchlist notes, the names you give saved scans, and anything else we mark as private are hidden in your browser too, wherever they appear on the page. We never record the account, security, profile, or billing tabs, the sign-in, password, and two-step verification steps once you have an account, our admin pages, or a browser where a member of our team is signed in.

Recordings go only to our own server, never to an outside analytics company, and only our team can watch them. A signed-out visit's recording is linked to the same random browser id as our page records, not to your name or email address; if you sign up, it is marked as a visit that ended in an account, and if you sign in to an account you already had, it is deleted. A recording made with a guest pass or an account is linked to that account, so we can see how people use the site, and each time our team watches one, the admin record described below notes it. We keep recordings for 30 days and then delete them. Deleting your account deletes the recordings linked to it; a guest pass carries no email address, and its recordings keep their 30 days even after the pass itself is deleted.

To stop being recorded, turn off "Record my visits to help improve Breakaway" on the Account tab of your dashboard. Nothing more is then recorded from your account on any device, and the recordings we kept of it are deleted. If your browser sends Do Not Track or Global Privacy Control, or has data saver turned on, we do not record your visit at all. Recordings add no cookie; your browser keeps a small note for the open tab (in session storage) so a recording can continue from page to page.

Your choice before the pixels and recordings

We ask first in California, in the European Economic Area (the European Union with Iceland, Liechtenstein, and Norway), in the United Kingdom, and wherever our host cannot tell where a visit comes from. A small bar at the foot of the page offers two choices, "Allow" and "Only what the site needs". Until you tap Allow, no advertiser's pixel loads (X's, Reddit's, and Google's pixels), our server tells X nothing about your sign-up or payment, and no session recording starts, and after Only what the site needs, none ever does in that browser, and our server tells X nothing about the account. Everything else on the site works the same either way. We learn where a visit comes from from the country, and in the United States the state, that our host, Cloudflare, reads from the connection; we keep nothing more precise.

We keep your answer for a year in the consent cookie, named mm_consent, which holds "all" or "needed" and nothing else, and whether your region is asked first for a day in the region cookie, named mm_rg, which holds one letter. We count how many visitors see the bar and how each answer is chosen, by region, never by person. To change your answer, clear this site's cookies, and the bar asks again.

Admin records

When a member of our team looks at or changes an account through the support tools, we write a permanent entry recording who did it, which account it concerned, what was done, and the full IP address it was done from. That log is deliberately append-only: it exists so that any access to your data can be accounted for afterwards, so we do not delete from it. The same log records each time you make a code on your computer to sign in on your phone, and each time one is used: your account, whether it was a phone or a computer, and the IP address. The code itself is a one-time link that works for five minutes; we keep only a one-way hash of it, and delete even that within a day of it running out.

What we do not do

We do not sell personal data. We do not share it with advertisers, apart from X's, Reddit's, and Google's pixels for visitors from our ads on each, described under "Visitors from our ads on X", "Visitors from our ads on Reddit", and "Visitors from our ads on Google". We do not run third-party analytics, and no other advertising tracker or social media pixel runs on the site. We do not store card numbers.

Cookies

We set seventeen, all first-party. Seven are HttpOnly and are not readable by any script on the page: the session, device, visitor, arrival, watchlist layout, Apple sign-in, and preview cookies below. Ten can be read by the page: the mm_attr cookie described under "Where you came from", which the sign-up form has to read, and which holds only the campaign tags that were already in your own address bar, the member, new-account, guest, account button, account line, chart, and entry cookies below, and the two consent cookies described under "Your choice before the pixels and recordings". For a visitor from one of our ads on X, X's pixel also sets three cookies, described under "Visitors from our ads on X". For a visitor from one of our ads on Reddit, Reddit's pixel sets two, described under "Visitors from our ads on Reddit". For a visitor from one of our ads on Google, Google's tag sets two, described under "Visitors from our ads on Google".

The session cookie, named __Host-mm_session (mm_session on a plain http development server), keeps you signed in. It holds a random token rather than anything that identifies you, and signing out deletes it.

The device cookie, named mm_device, is a random id set when you sign up or sign in. It lasts up to 400 days and does one job: it remembers that a free trial has been started in this browser, so the same browser cannot start another one. It is not linked to your browsing, it is not shared with anyone, and it carries nothing about you.

The visitor cookie, named mm_visit, is a random id set on the first page you open and kept for a year. It lets our own page use records, described under "Page use", say whether a browser is here for the first time or has been here before, and how a visit went from one page to the next. The records hold a one-way hash of it, never the id itself. It carries no address, no account, and nothing about you, it is not shared with anyone, and it is not used for advertising.

The member cookie, named mm_member, holds the value 1 and nothing else. It is set once you have signed in on a browser and lasts up to 400 days, so that a later visit to a member page, after your session has ended, is sent to the sign-in page rather than the sign-up page. It carries no account and nothing about you.

The new-account cookie, named mm_new, also holds the value 1 and nothing else. It is set when you create an account and lasts three days, so the scanner can lay out your new, empty watchlist before it loads. It carries no account and nothing about you.

The arrival cookie, named mm_arrival, lasts half an hour. When you open a stock's member address without being signed in, we send you either to the sign-up page or to the stock's public page, and this cookie records which of the two you were shown, so the page you land on reports the same one to our own page use records. It does the same when an ad for one stock opens that stock's page directly. It carries no id and nothing about you.

The guest cookie, named mm_guest, holds the time your guest pass ends and nothing else. It is set while you use Breakaway as a guest and ends a week after the pass does, while what you saved is kept, so each page can keep room for the line under the header that says what your guest pass is, and draw a guest's buttons, or once the pass has ended the page as you can still see it, instead of moving the page when that loads. It is removed once you add your email or sign out. It carries no id, no account, and nothing about you.

The account button cookie, named mm_orb, holds two things and nothing else: whether your account is a trial, a free account, Pro, or a guest pass, and the first letter of your email address, the letter on the round button at the top right of each page. It is set while you are signed in and lasts 30 days from your last visit, so each page can draw that button at once instead of a moment after it opens. It is removed when you sign out. It carries no email address, no id, and no name.

The account line cookie, named mm_line, holds when the line under the header is said from and nothing else: for a free trial, when the free days end and the day to confirm your email address by, as two times; for a free account, the letter f. It is set while you are signed in on a free trial or a free account, so each page can draw that line at once instead of moving the page down when it loads, and lasts until the later of those two times, or 30 days from your last visit for a free account. It is removed when your account has no such line. It carries no id, no account, and nothing about you.

The watchlist layout cookie, named mm_shape, holds how many stocks your watchlist shows, how many more a free account keeps there, whether the card that asks for the stocks you own is in its place, whether your account is a free one, and a short code made from your session cookie, so it is only ever used with the session that set it. It is set when you sign in, each time your watchlist loads and each time you open a page of the app, and lasts 30 days from the last time it was set, so the scanner can lay out your watchlist before it loads instead of moving the page when it does. It carries no stock names, no id, no account, and nothing about you.

The card cookie, named mm_keep_hide, holds only a date. It is set when you tap Not today on the card that says when your free days end. It keeps that card hidden until the next day. It lasts two days.

The Apple sign-in cookie, named mm_apple, exists only while you sign in with Apple: it is set when you tap the Apple button and holds, sealed so no one can read or change it, the one-time codes that tie Apple's answer to this browser, then Apple's answer on its way to your account. It lasts at most ten minutes, is sent only to our Apple sign-in addresses, and is removed the moment you are signed in or turn back.

The chart cookie, named mm_chart, holds the chart settings you picked in this browser (the range, the chart type, the lines and panes, and the scanner's and Earnings page's views) and nothing else. It is set when you pick one, or sign in to an account that has some saved, and lasts up to 400 days, so a stock's page arrives drawn your way instead of changing a moment after it opens. It is sent only with the scanner's pages, and it carries no id, no account, and nothing about you.

The FDA calendar cookie, named mm_bio, holds the choices you made on the FDA calendar in this browser: the company size, the kind of date, the area, the window, the cash filter, and the sort. It holds nothing else. It is set when you change one, is removed when they are back to the calendar's defaults, and lasts up to 400 days. It is sent only with the FDA calendar's page, so the list arrives drawn your way instead of changing a moment after it opens. It carries no id, no account, and nothing about you.

The preview cookie, named mm_preview, lasts half an hour. When an ad for one stock opens that stock's page directly, it lets that one page open before your guest pass exists; the pass then starts about a second after the page is on your screen, with nothing for you to tap or fill in. It holds the stock's ticker, when it ends, and a signature, and nothing about you. The entry cookie, named mm_entry, set beside it for the same half hour, holds only the ticker, so the page can measure itself the way our landing page does and open on the same card the ad showed, in the page itself.

Retention

If you open Breakaway as a guest from one of our landing pages, we make an account with no email address for as long as the guest pass lasts (24 hours, or until 24 hours after the market opens if you start while it is closed), in that browser only. It holds what you do as a guest (the stocks you star, any alerts, the pages you open) and the campaign tags of the link you came from. If you add your email, it becomes your account. If you do not, the guest account and everything in it are deleted within 8 days after the guest pass ends. We send nothing to a guest, since there is no address to send to. When a new guest pass opens the scanner, a short sheet about how Breakaway works shows there once; your browser keeps two small notes for it (that the pass is opening the scanner, and when the sheet closed), which never leave it.

To keep automated sign-ups out, the guest pass uses Cloudflare Turnstile, which checks in the background that a browser is run by a person and shows nothing on the page. To keep scripts from reading the scanner, the app's pages can run the same check for a signed-in member, about once every half hour; when they do, Cloudflare sets a cookie, cf_clearance, so the app's data loads with no further check, and your browser keeps a note of when the check last ran, which never leaves it. Cloudflare handles the signals it reads under its Turnstile Privacy Addendum.

To keep scripts from copying the site's data, our server counts the data requests it gets in each hour by IP address and by account: how many, how evenly they are spaced, whether a page of ours was on screen, and a short name for the browser (such as "Safari on iOS"). Only the counts are kept, never what was read. They are used to spot automated copying and nothing else, and are deleted after 30 days.

Account data is kept while the account exists. Sessions expire after 30 days of inactivity, or 90 days after they were created, whichever comes first; sessions for our own admin accounts expire after 12 hours of inactivity. Page use records are kept for 90 days, and the request counts by IP address for 30. Cached headlines are kept for a week.

You can ask us to delete your account, and you can delete it yourself from the Account tab in your dashboard. That removes the account itself and, with it, your watchlist, saved scans, alert rules, alert history, push subscriptions, and sessions. The page use records described above still carry the account id until they age out on the 90 day schedule, and the request counts on their 30 day one. Two things deliberately survive deletion. The trial ledger entry above keeps its hashed email, device id, and sign-up IP, so that deleting an account is not a way to start a fresh free trial. Admin log entries about the account keep the account id and the email address as it was at the time, because a record of who accessed what is not useful if it can be erased. Neither one lets us reconstruct the account, and neither is used for anything else.

You can download your account's data as JSON at any time, from the Account tab in your dashboard: your account and billing details, your sessions, your watchlist, your alerts, and the alerts sent to you, your preferences, and where you came from. Session recordings and our page records are not in that file. To get a copy of them, or to have them deleted, write to support@getbreakaway.com.

Your rights, wherever you are

You can ask us to show you the personal data we hold about you. You can ask us to correct it, to delete it, or to give it to you in a form you can take elsewhere. You can object to a use of it and ask us to stop. The Account tab does most of this itself: there you can download your account's data, change your email, stop the recordings, stop the emails, and delete the account. For anything else, write to support@getbreakaway.com from the address on your account. For a visit without an account, tell us the day of the visit and the browser you used. We answer within 30 days. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

Where your data is kept

Everything we keep is kept in the United States, on Amazon Web Services' servers in its US East region. If you use Breakaway from outside the United States, what you send us goes to, and is kept in, the United States.

Security

Passwords are hashed with Argon2id, traffic is encrypted in transit, and secrets are kept in a managed secrets store rather than in code.

Contact

Privacy requests: support@getbreakaway.com.