Legal

Privacy Policy

Last updated 21 October 2026. This policy covers xoomar.com, the API, the client libraries, the MCP server and our emails.

In short

We collect what the Service needs: an email for an account, hashed keys, usage counts, the alerts you set, the messages you send.
We do not sell personal data. Providers help us run the Service. Google uses analytics and advertising data under its own privacy policy.
Analytics and advertising cookies are off in the EEA, the UK and Switzerland until you accept them; you can change your choice at any time.
Delete your account yourself; its personal data is erased within thirty days.

1. Who is responsible

XOOMAR ("we", "us") operates xoomar.com, the XOOMAR API, the client libraries and the hosted MCP server (the "Service") and is the controller of the personal data described here. Reach us at info@xoomar.com. This policy is part of the Terms of Service.

2. What we collect

Account. Email address, a name if you give one, a password (stored as a hash) or, if you sign in with Google or Microsoft, the name, email and profile picture the provider sends. We never see your provider password.
Keys and usage. Your API keys (as hashes), the number of requests each key makes per endpoint per day, the plan on the key, and the last time it was used.
Plans and payments. If you buy a plan, our payment processor collects your card and billing details; we receive the plan, the amounts, the invoice, the last four digits of the card and a customer reference, never the full card number.
Watchlists, alerts and webhooks. The tickers you follow, the alert rules you set, and any webhook URL you give us.
Newsletter. Your email address, your confirmation, your preferences and whether you unsubscribed.
Messages. What you send through the contact and services forms, with your name, email and, to stop abuse, your IP address.
App registrations. The app's name, link, description and datasets, your email and, to stop abuse, your IP address. If you ask for a listing, the name, link, description and datasets appear on Built with XOOMAR; your email never does.
Technical data. IP address and request headers, used in memory for rate limits and security and written to server logs; aggregate visitor counts by hour, country, device and page, which do not identify you.
Cookies and similar. Essential cookies (sign-in session, theme, your cookie choice) and, only with your consent where the law requires it, Google Analytics and advertising cookies. Section 6 has the detail.

3. Why we use it and on what basis

To run the Service you asked for (contract): sign-in, keys, limits, plans, invoices, alerts, webhooks, answers to your messages.
To keep the Service secure and fair (legitimate interests): rate limits, abuse prevention, fraud checks on payments, logs, backups.
To understand and improve the Service (legitimate interests, or consent where cookies require it): aggregate statistics, analytics.
To write to you: service emails about your account, keys, plan and changes to these documents (contract or legitimate interests); the newsletter (consent, given with the box at signup or the subscribe form, withdrawn with one click); onboarding notes to new key holders, a one-time invitation to the newsletter for account holders, and a one-time question to active key holders about what they build with the data (legitimate interests, with an unsubscribe link).
To show ads (consent in the EEA, the UK and Switzerland; legitimate interests elsewhere, with the opt-out in section 6).
To meet legal duties: tax and accounting records, responses to lawful requests.

5. International transfers

We and our providers process data in more than one country. Where data leaves the EEA, the UK or Switzerland, we rely on an adequacy decision, on the European Commission's standard contractual clauses (and the UK addendum) in our providers' contracts, or on a provider's certification under the EU-US Data Privacy Framework.

6. Cookies, analytics and ads

Essential. A session cookie when you sign in, your theme, and your cookie choice. These need no consent.
Analytics. Google Analytics measures pages, sessions and device types. When it loads, Google receives information about the pages you visit, your browser and device, and your IP address. Google says Analytics 4 doesn't log or keep individual IP addresses. Analytics cookies can distinguish visits when you allow them. Our own first-party cookies remember how you first reached the site (a search engine, an assistant or a link) for ninety days, and the page your visit began on until you close the browser; if you open an account, both are kept with the account so we can tell which channels and pages bring developers. They hold nothing else.
Advertising. We use Google AdSense on some pages. When ads load, Google receives your IP address, browser and device information, the page address and information about the ads you view or click. Google and third parties involved in serving ads may place and read cookies, use web beacons (small images that report a page or ad view), and use IP addresses and cookie or other online identifiers to deliver ads, measure them and prevent fraud. Non-personalised ads can still use cookies for these purposes.

Third-party vendors, including Google, use advertising cookies to serve personalised ads based on earlier visits to this or other websites. Google's advertising cookies allow it and its partners to show ads based on those visits. Our cookie banner doesn't enable personalised ads: ads requested here are non-personalised.

How Google uses information from sites or apps that use its services explains Google's collection, sharing and use of this data. Google's Privacy Policy explains its purposes and your rights. Google's advertising provider list links to providers' privacy information; inclusion in that list doesn't mean a provider serves ads here.

You can turn off personalised advertising in Google's Ads Settings or opt out of some other companies' personalised advertising at aboutads.info. Those choices don't turn off all ads or all advertising cookies.

In the EEA, the UK and Switzerland, we ask before allowing analytics and advertising cookies. We don't load AdSense or request ads until you accept advertising cookies. For advertising, we also ask first if we can't determine your country. Outside these regions, analytics and advertising cookies are on by default. Choose Essential only to decline or withdraw permission for analytics and advertising cookies; this also stops further ad requests. You can use Cookies at the bottom of every page, or the button below. This doesn't undo earlier use of your data.

We keep your choice and its date in your browser for a year. If your browser can't save it, you may be asked again. Google Analytics may send basic measurements without analytics cookies when you decline. We honour Global Privacy Control as an opt-out of advertising cookies, even if you previously accepted them.

at any time.

7. How long we keep it

Data	Kept
Account details	While the account exists. Thirty days after you delete the account the personal fields are erased; the record keeps an anonymous id so usage totals and invoices still add up.
API keys	Stored as a hash from the moment they are created; we cannot read a key back. Revoked keys keep an anonymous usage record.
Usage counts per key	Twenty-four months. Site-wide totals by hour and endpoint hold nothing personal and are kept.
Rate-limit counters	One minute and one day, in memory, then gone.
Server logs	Rotated automatically, kept for at most thirty days.
Newsletter	Until you unsubscribe. The address then stays on a suppression list so we do not write again.
Contact and service messages	Twenty-four months. The sender's IP address, kept only to stop abuse, is cleared after ninety days.
App registrations	While the app is listed on Built with XOOMAR, otherwise twenty-four months. The IP address is cleared after ninety days, as for messages.
Billing records	Seven years, as tax law requires.
Analytics	Aggregate visitor statistics by hour, country, device and page hold nothing personal. Google Analytics keeps its event data for the period set in our account, at most fourteen months.

8. Your rights

Wherever you live you can see, correct and delete your data from the account pages: profile and email under Profile, keys under API keys, the plan under Plan, the newsletter through the link in every email, the account itself under Profile with "Delete account".

If you are in the EEA, the UK or Switzerland you also have the rights to access, rectification, erasure, restriction, portability and objection, to withdraw consent at any time without affecting earlier processing, and to complain to your supervisory authority. If you are a resident of California or another US state with a privacy law, you have the rights to know, delete and correct, to opt out of the sale or sharing of personal data (we sell none; use the cookie banner or Global Privacy Control for advertising cookies), and not to be discriminated against for exercising them.

For anything you cannot do yourself, write to info@xoomar.com from the address on your account. We answer within 30 days, and we may ask you to confirm your identity first. An authorised agent may act for you with your written permission.

9. Security

Traffic is encrypted in transit. Passwords and API keys are stored only as hashes. Access to production systems is limited and logged, and backups are encrypted. No method is perfect; if a breach affects your data we will tell you and, where required, the authorities without undue delay.

10. Children

The Service is for adults and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has given us some, write to us and we will delete it.

11. Changes

We update this policy when the Service or the law changes and put the date at the top. For a material change we tell account holders by email at least 30 days before it takes effect.

12. Contact

Privacy questions and requests: info@xoomar.com.