Legal
Privacy policy
Last updated October 22, 2026
This policy explains what personal information BasicMath LLC (“13F Flow”, “we”, “us”) collects when you use this website, 13f-flow.ai, and the 13F Flow app at app.13f-flow.ai; what we do with it; who else handles it; and how long it is kept. The short version: we collect what we need to sign you in and to run Ask AI, we keep no record of what you ask, and we do not sell or share your information for advertising.
Who we are
13F Flow is operated by BasicMath LLC, Washington 98004. For anything in this policy, write tosupport@13f-flow.ai.
What we collect
Your account
- Email address, used to sign you in (by a one-time email link) and to contact you about your account.
- Google profile details, only if you choose to sign in with Google: the name, email address, profile picture link and account identifier Google shares with us. We ask Google for nothing beyond basic sign-in.
- Sign-in records: when you signed in and from which IP address, kept by our sign-in provider for security.
- Your plan (during the beta, every account is on the free beta plan).
Your Ask AI usage
For each question you ask, we record when it started and ended, which AI model answered, how many tokens it used, its cost against your monthly allowance, and whether it succeeded. We do not record the text of your question or of the answer. These records are what the usage bar in Settings is drawn from.
Things that stay in your browser
Your watchlist, saved fund groups, recent searches and display settings are kept in your own browser’s local storage. They are not stored on our servers; clearing your browser data removes them.
What we do not collect
We use no analytics, advertising or tracking cookies, on this website or in the app, and we load no third-party trackers. We do not sell your personal information or share it for targeted advertising.
Ask AI and our AI providers
Your questions are sent to our AI providers (Anthropic, OpenAI) to be answered. They keep them for a limited period for abuse monitoring, then delete them, and do not use them for training. We store no question text at all.
One detail beyond abuse monitoring: OpenAI also keeps the answers it gives for up to 30 days before deleting them (see the table below).
When you ask a question, the app sends the provider your question, the conversation so far, a short description of the page you are on (its address, filters and heading), and the 13F data the assistant looked up to answer. Your name, email address and account identifier are not sent. Conversations are not saved: when you close or clear the panel, the conversation is gone from our side.
Anthropic answers by default; OpenAI answers only if Anthropic is unavailable. Their terms, as of the date above:
| Provider | How long they keep it | Training |
|---|---|---|
| Anthropic | Inputs and outputs are deleted within 30 days. Content flagged as violating Anthropic’s usage policy may be kept for up to 2 years. | Not used to train models. |
| OpenAI | Abuse-monitoring logs are kept for up to 30 days. OpenAI also stores the response itself for30 days by default, as application state, before deleting it. Either may be kept longer only where the law requires it. | Not used to train models. |
Sources: Anthropic’s data retention articleand commercial terms; OpenAI’sAPI data controls. If we add or change an AI provider, we will update this section before it receives any question.
How we use your information
- To sign you in and keep you signed in.
- To answer Ask AI questions and to measure usage against your monthly allowance.
- To keep the service secure: to stop abuse, rate-limit sign-in attempts and investigate errors.
- To email you about your account and the service (for example, before paid plans start). We send no marketing email without your permission.
Who processes it for us
We use these service providers. Each handles your information only to provide its service to us.
| Provider | What it does | Location |
|---|---|---|
| Supabase | Accounts and sign-in, Ask AI usage records, daily backups | United States (N. Virginia) |
| Resend | Sends sign-in emails from no-reply@13f-flow.ai | United States (N. Virginia) |
| Cloudflare | Domain, network and security in front of the app; bot checks on the sign-in page (Turnstile); hosts this website | Global network |
| Hetzner | The server that runs the app | United States (Ashburn, Virginia) |
| Sign-in with Google, if you choose it | United States | |
| Anthropic | Answers Ask AI questions | United States |
| OpenAI | Answers Ask AI questions when Anthropic is unavailable | United States |
Our market-data vendor and our uptime monitor receive no personal information. When paid plans start, payments will be handled by a payment processor, which we will name here first; we will never see or store your full card number.
Cookies
This website sets no cookies. The app sets only the cookies it needs to sign you in:
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-…-auth-token | Your signed-in session | Until you sign out; renewed while you use the app |
sb-…-code-verifier | Completes a sign-in with Google | Until that sign-in finishes |
auth_next | Returns you to the page you were on after signing in | Up to 1 hour |
All three are first-party, are not readable by page scripts, and are never used for tracking.
How long we keep it
- Account and Ask AI usage records: until you delete your account.
- Server logs: 30 days. They record errors and service events, not your questions; an error report may occasionally include a fragment of an AI answer.
- Backups of the account database: rolling daily backups, kept by Supabase for up to 7 days.
- AI providers: as in the table above.
Your choices and rights
- Delete your account at any time in the app under Settings. This removes your account and your Ask AI usage records at once; copies in backups expire within 7 days.
- Access or correct your information, or ask any question about it, by writing to support@13f-flow.ai.
- Depending on where you live (for example, California or the European Economic Area), you may have further rights, such as to receive a copy of your data or to object to how we use it. Write to us and we will respond within 30 days. We will not treat you differently for exercising them.
Security
All traffic is encrypted in transit. The app’s server accepts no direct web connections: requests reach it only through Cloudflare’s network. Access to account data is limited to the server itself and to us, and AI providers never receive your identity.
Children
13F Flow is not directed at anyone under 18, and we do not knowingly collect information from children.
Where your information is processed
We and our providers process information in the United States. If you use 13F Flow from elsewhere, your information will be transferred to the United States.
Changes to this policy
We will post any change here and update the date at the top. If a change affects how we use information we already hold, we will email account holders before it takes effect.
Contact
BasicMath LLC, Washington 98004. Email support@13f-flow.ai.