← Sistine

Privacy Notice

Updated October 6, 2026 · Email access and purchase linking

Looks Labs LLC, doing business as Sistine, is responsible for the processing described here. Contact support@sistine.ai for privacy questions or requests. This Notice covers Sistine, the market-research service called Sistine Path until September 2026 (the “Service”): its subscription, connection flow, market-data delivery, optional research newsletters and its pages at sistine.ai, /subscribe and /sistine/. It does not cover SistineGPT, which has its own privacy policy.

1. What stays on your Mac

Downloaded histories and your imported price files are stored in a local SQLite database. Watchlists, preferences and chart calculations remain on the Mac. Routine subscription checks and shared-data downloads do not upload your full watchlist, personal imported files or chart calculations. Choosing to email support or export a file can disclose the material you select.

The historical database is not itself an encrypted vault. Its protection depends on your Mac, FileVault, backups and any cloud-storage settings. Access credentials are stored in macOS Keychain. Uninstalling the Service’s Mac app may leave its Application Support files, preferences, Keychain entries and backups. It does not cancel billing.

2. Payment and subscription information

Stripe requires your billing email at checkout and collects payment details and, when requested, name, billing address or tax information through its hosted checkout. For the US launch, Stripe also collects the US address where you use the subscription to confirm US availability. Nothing is shipped. Our app and subscription database do not collect or store full card numbers or card security codes. We receive and maintain payment-related identifiers, subscription status, paid-through dates, consent version and time, and relevant refund or dispute events.

Authorized support personnel can access billing contact and limited payment information in Stripe when needed to resolve a purchase, cancellation, tax, refund or dispute question. Stripe also processes information for fraud prevention and its own obligations under Stripe’s Privacy Policy. Existing purchase and Mac connections continue to work. When available, you can also sign in using a one-time code sent to your purchase email. No password is required; device activation does not make a subscription anonymous.

3. Connecting your Mac and delivering data

The app generates a random device credential and keeps it in Keychain. The backend uses a hash of that credential to recognize the connected Mac. It is not derived from a hardware serial number or card fingerprint. A browser connection request contains that public hash, a random request reference and a ten-minute expiration, signed by our server. Only a verified, paid purchase can approve it. The original device credential is needed to use the connected subscription.

The service handles connection, verification and support events, subscription identifiers and signed access records. It also receives asset identifiers and data revisions requested during updates. Requests can reveal which histories your app holds or requests, even though the entire watchlist is not uploaded. Hosts process connection information such as IP addresses, timestamps, request paths, status codes and operational logs.

Server-side stock, index, crypto and commodity futures imports normally use our provider accounts and server network addresses. Logos are bundled in the app and do not require a provider request when displayed. If you choose a direct provider import, that provider receives your network address and selected instrument request under its own terms.

4. Website storage and the web app

Sistine’s web app uses the purchase credential already saved in your browser to check your paid subscription and retrieve private market reports. Those requests include the selected asset or report identifier. Shared reports are calculated centrally from market data; filtering happens in your browser, and your watchlist and appearance preferences are saved in browser storage and do not sync to the Mac app. Reports are cached in memory while the page is open. Clearing browser storage removes saved web preferences and access credentials. Once your purchase is linked to email, you can sign in again on any browser. Support can help with purchases that have not yet been linked.

The purchase browser stores a randomly generated purchase credential in local storage so it can resume checkout, verify payment, connect the Mac and open billing. This is sensitive access information even though it is not a card number. It is not placed in a URL. Until you link your purchase to an email account, clearing this storage can require recovery through support.

Email sign-in

Email verification with Sistine before checkout is optional. You can proceed to Stripe without a sign-in code; Stripe still requires a billing email.

When email sign-in is available, submitting your address requests a one-time code. Merely typing an address does not send it. Every address accepted by the code service is stored by Supabase Auth, even if the code is never verified. During a restricted test, only allowlisted addresses are accepted; other addresses are rejected before they reach Auth. Resend is the selected sign-in email delivery provider; it receives the recipient address, code message and delivery information. Supabase and Resend also process network and security information. This sign-in does not subscribe you to marketing email.

Verifying a billing email alone does not unlock an old purchase. The first link requires both verification of the email captured by Stripe at the original checkout and proof of the original purchase, such as the saved purchase-browser credential. A public Mac connection link is not proof of purchase. If you no longer have your purchase browser or a recovery credential, contact support. A later change to the Stripe customer contact email does not change this purchase proof. We retain the verified email, account identifier and proven purchase links to provide access across browsers.

Unverified Auth records created by this sign-in service are deleted after seven days by a daily cleanup, normally within eight days of creation. Verified account and purchase-link records remain while needed to provide or recover access, or until a verified deletion request, subject to required billing retention and backup rotation. Resend retains sent email content and delivery logs for 30 days under its standard Free, Pro and Scale retention policy. See Resend security and retention and Resend’s Privacy Policy.

For paid email-only accounts, the updated web app also saves a permanent recovery credential in browser storage. The server stores only its hash and order link. Account → Save recovery code lets you keep a private copy outside the browser. Recovery access still follows your subscription’s paid period and revocation status; email sign-out and session expiry do not revoke it. Clearing storage erases the local copy. Contact support if a recovery code is lost or exposed.

The browser stores a separate random email-session credential, expiry time and email address. The server stores a hash of the credential. Sessions expire after 30 days and expired rows are removed by the daily cleanup; local records remain until sign-out or you clear site storage. Up to five email sessions can be active; a further sign-in revokes the oldest. One-use signup admission hashes expire after ten minutes and are deleted on the next code request or daily cleanup. Hashed abuse-limit records expire through daily cleanup, normally within 48 hours. Signing out revokes that email session; “Sign out of email everywhere” revokes all email sessions for the account. Neither action cancels billing, erases the original browser purchase credential, disconnects a Mac, or clears a watchlist. Your existing purchase-browser access continues after email sign-out.

A pending public connection request is kept in that tab’s session storage, validated against its short expiration, and cleared when connected or found expired. Connection fragments are removed from the address bar before the page displays the request. They are not sent as part of an ordinary HTTP page request.

Cloudflare delivers and protects the website and provides aggregate traffic/performance information. Its Web Analytics service is designed without advertising cookies or individual fingerprinting. Hosting and security processing still involve network data such as IP addresses. Optional X advertising measurement is described below. We do not use session replay. See Cloudflare’s Privacy Policy.

Optional Telegram alerts

When you opt in to Sistine Alerts, we associate your Telegram chat identifier with your paid subscription and store your alert preferences, connection time, pause status, and delivery records. We generate a random, single-use connection link that expires after ten minutes; it does not contain your purchase credential or payment details. Telegram receives your chat identifier and alert messages, under Telegram’s Privacy Policy. We do not send Telegram your payment card, billing email, device credential, or private watchlist.

Disconnecting in alert settings removes the active chat association and unused connection link from our database. We also remove them when paid alert access is revoked or expires; the expiry cleanup runs every five minutes. Returning subscribers can create a fresh connection after payment. Pausing while your subscription remains active preserves your connection and preferences. Telegram retains messages under its own policies and your controls. We retain delivery records without chat identifiers for up to 90 days for troubleshooting and duplicate prevention; required billing and consent records may remain longer as described below. Database backups and hosting logs follow their normal retention. Send /stop to pause future alerts; it does not cancel your subscription.

Optional X advertising measurement

On our homepage and subscription pages, you can allow or decline the X advertising pixel. It is off until you allow it. We honor Global Privacy Control and Do Not Track by keeping it off. Use Ad privacy in the footer of those pages to change your choice. Declining has no effect on payment or access.

If allowed, X receives advertising measurements for page visits and newly confirmed purchases, a conversion identifier used to prevent duplicate counts, and network/browser information such as your IP address, browser and X click or cookie identifiers. X may associate this activity with its account and advertising data under X’s Privacy Policy. This can constitute sharing for targeted advertising. We do not supply X with your billing email, phone number, card details, purchase credential, watchlist or chart activity. The pixel is not installed in the Mac app or web screener.

We retain your choice in this browser for 180 days. A pending measurement is eligible for 24 hours, and local duplicate-prevention records expire after 30 days and are capped at 100 entries; expired entries are discarded when checked. These records can also be removed by clearing site storage. X controls retention of information it has already received. Withdrawing permission stops future measurement from these pages; it does not cancel your subscription or erase data already sent to X.

5. Purposes and service providers

We use information to supply the purchased service, verify payment and device access, deliver updates, prevent abuse, recover purchases, answer support, resolve disputes and meet legal obligations. We do not sell personal information or use local watchlists and imported files to train a general-purpose AI model. Optional advertising measurement and the choice to decline it are described above.

• Stripe: checkout, payments, invoices, subscription management and payment disputes.
• X (only if you allow ad measurement): measurement of page visits and newly confirmed purchases from our ads, as described in Optional X advertising measurement.
• Supabase and its infrastructure providers: verified email accounts, subscription/device records, authentication, API operations and protected history storage/downloads. Our selected project region is in the Americas; that does not mean every provider processes all information only there. See Supabase’s Privacy Policy.
• Cloudflare: website and app-file delivery, security and website statistics.
• Resend: delivery of sign-in codes for the optional email sign-in, as described above.
• Support email providers: delivery and storage of messages to and from support@sistine.ai. Information you choose to include in a support email or attachment is processed to answer it. Stripe delivers payment-related email according to its settings and notice; Sistine does not automatically email an activation key.
• Market-data providers: including Marketstack, CoinGecko and Yahoo Finance for centrally scheduled daily imports and historical data. Central imports do not need customer payment or device credentials. Optional direct imports are described above.
• Ghost: delivery of optional research newsletters and their subscriber lists.
• Jatevo and its configured model providers: drafting newsletter commentary from public market information only, never subscriber lists, billing details, device credentials or private watchlists.
• Apple: macOS security, Keychain and distribution checks operate under Apple’s applicable privacy information and your operating-system settings.

We may disclose relevant information to professional advisers, authorities or transaction counterparties when reasonably necessary for legal compliance, security, protection of rights or a business transfer subject to applicable safeguards. A provider may process some information independently under its own notice; using a provider does not give it unrestricted permission to use your information.

6. Retention

Local histories, watchlists and credentials remain until you remove them using app, Finder or operating-system controls; your backups can retain copies. The service retains purchase and device records while needed to supply or recover access. Billing, tax, consent, refund and dispute evidence can be kept after cancellation for applicable legal, accounting or claims periods.

Support and operational records are retained according to the purpose of the request, incident investigation and any required retention. Hosting logs and backups also follow provider settings. On a verified deletion request, we identify what can be removed or de-identified, what must be retained and why. Restricted backup copies may remain until their normal rotation; a legal hold can delay deletion of relevant records.

7. Your choices and rights

Contact support to request access, correction, deletion, portability or another privacy right available under the law that applies to you. Depending on that law, you may also object to or restrict processing, withdraw consent, use an authorized agent, appeal a decision or complain to a supervisory authority. We respond within the applicable timeframe and explain lawful exceptions. We do not discriminate for exercising a protected right.

We may need proportionate proof that a request concerns your purchase; never send full card details, passwords or wallet keys. We cannot remotely erase local files or backups you control. Cancellation, deletion and email unsubscribe are separate actions; tell us which you intend and we will help you complete it.

8. International processing and legal bases

Our service providers may process information in the United States and other countries. Where a law requires a legal basis, processing may be necessary to perform our agreement, meet legal duties, pursue legitimate interests in operating and securing the service, or rely on consent where required. Legitimate interests remain subject to applicable rights; withdrawing consent does not invalidate earlier lawful processing. Where required, international transfers need the applicable contractual or other lawful safeguards. Contact us for information relevant to your location.

9. Security and age limits

We use encrypted network connections, access restrictions, protected backend keys, signed short-lived access records and Keychain storage. No system is completely secure. We make legally required notices of qualifying incidents. The Service is intended for adults 18 and older; contact support if you believe a child has supplied personal information.

10. Changes

We identify the current version and give appropriate notice of material changes. A revised notice does not by itself supply consent for an unrelated new use of personal information. Contact support@sistine.ai with questions or requests.

Newsletter research

Optional research newsletters are delivered through Ghost. To prepare editorial commentary, we may send public market observations, company information and published research to Jatevo and its configured model providers. We do not include newsletter subscriber lists, billing details, device credentials or private watchlists in those model requests. Newsletter sources and AI-assisted content may contain errors. You can unsubscribe using the link in each marketing email.

© 2026 Looks Labs LLC · support@sistine.ai