Privacy policy
Phidox is a small project. We collect what running it requires and nothing more, and this page tells you exactly what that is.
Who is responsible
Phidox is operated by its founders as individuals, not an incorporated company, based in Quebec, Canada. The person responsible for the protection of personal information is Jay Khelifi, reachable at privacy@phidox.com.
What we collect and why
| What | Why | How long |
|---|---|---|
| Email address and password | To create and secure your account. Passwords are handled by Firebase Authentication and never reach our servers in readable form. | Until you delete your account. |
| Your questions and the answers given | So your conversations are there when you come back, and so we can tell whether the analysis is any good. | Until you delete the conversation or your account. |
| IP address, approximate country, and timestamps | To enforce the free daily limit and to detect abuse. IP addresses used for rate limiting are stored hashed, not in the clear. | Rate-limit records are keyed to a single day. Usage logs are kept for up to 12 months. |
| Anything you choose to publish | Publishing an analysis makes it and your display name public, by your own action. | Until you unpublish it. |
We do not use advertising trackers, we do not run third-party analytics scripts in your browser, and we do not sell or rent personal information to anyone. Ever.
Your questions
What you type is sent to Google's Vertex AI to produce an answer, and stored in your account so your conversations are there when you return. If a question needs outside context, search terms derived from it go to a web search provider.
Please do not put sensitive personal information — account numbers, health information, government identifiers — into a question. Phidox has no use for it and it would be stored with the rest of the conversation.
Conversations may be read by the operators named above to check whether answers are accurate. That access is limited to those people and is read-only.
Using Phidox without an account
You can ask a few questions as a guest. This still creates an anonymous account so the conversation has somewhere to live, and we record a one-way hash of your IP address to count the free questions for that day. The hash cannot be read back as an address from our database.
Where your information goes
Phidox runs on Google Cloud in the United States. This means your personal information is communicated outside Quebec, and is subject to the laws of the country it is held in, including lawful access requests by foreign authorities. We have assessed this and consider the protection adequate for the limited information involved; you should decide whether you agree before creating an account.
| Who | What for | Where |
|---|---|---|
| Google Cloud Platform (Firebase, Cloud Run, Firestore, Cloud Storage) | Hosting, authentication, and storage of accounts and conversations | United States (us-central1) |
| Google Cloud Vertex AI | Runs the language model that writes the analysis | United States / multi-region |
| Financial Modeling Prep | Source of the market data. Receives no personal information. | United States |
| DuckDuckGo | Web search when a question needs context the market data cannot supply. Receives the search terms derived from a question, not your identity. | United States |
Your rights
Under Quebec law you may, at any time and free of charge:
- See what we hold about you. Ask, and we will send it.
- Correct it if it is wrong or incomplete.
- Delete it. Deleting a conversation removes it. Deleting your account removes your conversations, your profile and your published analyses.
- Take it with you in a structured, commonly used technical format.
- Withdraw consent and stop using the service.
- Complainto the Commission d'accès à l'information du Québec if you think we have got this wrong.
Write to privacy@phidox.com and we will respond within 30 days, as the law requires.
Keeping it safe
Authentication is handled by Firebase; we never see your password. Conversations are readable only by your own signed-in session and the named operators. Traffic is encrypted in transit and data is encrypted at rest by Google Cloud. If a breach creates a risk of serious injury, we will notify affected users and the Commission d'accès à l'information promptly, as Law 25 requires.
We are a small project, not a bank. We think the above is sound, but you should size your trust accordingly.
Children
Phidox is not intended for anyone under 14. We do not knowingly collect information from children; if you believe we have, write to us and we will delete it.
Changes
If this policy changes materially we will say so on the site. Last updated 16 August 2026.