Privacy policy
Phidox is a small project. We collect what running it requires and nothing more, and this page tells you exactly what that is, in plain words.
Who is responsible
Phidox is operated by its founders as individuals, not an incorporated company, based in Quebec, Canada. Our person in charge of the protection of personal information is Jay Khelifi, reachable at privacy@phidox.com. How we handle personal information internally — who can see what, how long it is kept, how complaints and incidents are dealt with — is set out in our privacy governance policy.
What we collect and why
| What | Why | How long |
|---|---|---|
| Email address and password | To create and secure your account. Passwords are handled by Firebase Authentication and never reach our servers in readable form. If you sign in with Google, Google gives us your name, email address and profile picture. | Until you delete your account. |
| Your questions and the answers given | So your conversations are there when you come back, and so we can tell whether the analysis is any good. | Until you delete the conversation or your account. |
| Alerts you set up | To run the saved query on schedule and email you the result. Includes the address alerts go to and a short history of past runs. | Until you delete the alert or your account. |
| Your own API keys, if you add any | To answer your questions with the model provider you chose. Stored encrypted with Google Cloud KMS. | Until you remove the key or delete your account. |
| Usage logs: IP address, approximate country, timestamps, your question, and your account identifier and email | To enforce usage limits, detect abuse, measure cost and understand how the service is used. Visible only to authorized administrators. Country is estimated on our own server from an IP database; no third party is asked. Rate-limit records use a one-way hash of the IP address. | Rate-limit records are keyed to a single day. Usage logs are kept until you delete your account; logs not linked to an account are kept until you ask us to delete them. |
| Page visits: which pages of this site you open, when, for how long you actively use them, how far you scroll, the site that sent you, your IP address and approximate country, your browser's time zone and language, and your browser and device type | To understand how the site is used and improve it, and to tell people from automated traffic. Recorded by Phidox's own code, not a third-party analytics service, and visible only to authorized administrators. If you have an account or a guest session, visits are linked to it; otherwise only to your IP address. Conversation links are never recorded. | Kept until you delete your account. Records not linked to an account are kept until you ask us to delete them. |
| Anything you publish, comment or react to | Publishing an analysis or commenting makes it and your display name public, by your own action. | Until you remove it or delete your account. |
We collect this information directly from you, from your browser as you use the site, and — only if you choose to sign in with Google — from Google. We use it only for the purposes listed above. We do not use advertising trackers, we do not run third-party analytics scripts in your browser, we do not build profiles of you, and we do not sell, rent or trade personal information. Ever.
No decision about you is made by automated processing. The AI writes answers to your questions; it does not evaluate, score or classify you.
Your questions
What you type is sent to OpenAI through its business API to produce an answer — or to the provider whose key you connected — and stored in your account so your conversations are there when you return. If a question needs outside context, a web search is run using search terms derived from the question.
Please do not put sensitive personal information — account numbers, health information, government identifiers, details of your own finances — into a question. Phidox has no use for it, will not use it to tailor an answer, and it would be stored with the rest of the conversation.
Conversations may be read by the operators named above to check whether answers are accurate and whether the service is being misused. That access is limited to those people.
Using Phidox without an account
You can ask a few questions as a guest. This creates an anonymous account so the conversation has somewhere to live; if you later sign up, it carries over. To count the free questions for the day we record a one-way hash of your IP address, which cannot be turned back into the address. Usage logs, described above, apply to guests too.
Cookies, browser storage, and location
Phidox stores only what it needs to work or to remember a display preference. Nothing here tracks you across other sites.
| Name | Purpose | How long |
|---|---|---|
| __session (cookie) | Keeps you signed in. Essential. | 5 days, or until you sign out. |
| Firebase Authentication (browser storage) | Holds the sign-in state, including an anonymous guest session. Essential. | Until you sign out or clear site data. |
| phidox.theme, phidox.rail (local storage) | Remember light or dark mode and whether the sidebar is collapsed. | Until you clear site data. |
| phidox.visit (session storage) | A random number that groups the pages you open in one tab into a single visit. It identifies the visit, not you, and is not shared with anyone. | Until the tab is closed, or after 30 minutes without activity. |
| phidox.warmed (session storage) | Avoids waking the analysis service twice in one visit. | Until the tab is closed. |
Approximate location.Our server estimates the country your IP address belongs to, using a database held on our own server, and stores it with usage logs and page visits to detect abuse and understand where the service is used. Page visits also record your browser's time zone, which we compare with that country to recognise VPNs and automated traffic. Both are country-level at most, are never used to target or profile you, and are not shared. Phidox does not use your device's location, and has no other function that identifies, locates or profiles you.
Where your information goes
Phidox runs on Google Cloud in the United States, and the services below are also based there. Your personal information is therefore communicated outside Quebec, where it is subject to the laws of that country, including lawful access by its authorities. Before relying on these services we assessed the sensitivity of the information involved, the purpose of each transfer, the protection each provider applies and the legal framework of the place it is held, and concluded that the protection is adequate for the limited information involved. Each provider handles the information under contractual terms that restrict its use to providing the service.
| Who | What for | Where |
|---|---|---|
| Google Cloud Platform (Firebase Authentication, Cloud Run, Firestore, Cloud Storage, Cloud KMS) | Hosting, sign-in, and storage of accounts, conversations, alerts and encrypted API keys. | United States (us-central1) |
| OpenAI | Runs the language model that writes the analysis, and the web search it uses when a question needs context the market data cannot supply. Receives the text of your questions and of the conversation so far. | United States |
| Amazon Web Services (Simple Email Service) | Delivers the alert emails you set up. Receives your email address and the alert’s content. | United States |
| Anthropic, OpenAI or Google — only if you connect your own API key | Your questions go to the provider whose key you supplied, under your own agreement with that provider. | United States |
| Financial Modeling Prep | Source of the market data. Receives no personal information. | United States |
We may also disclose information where the law requires it, for example in response to a valid court order.
Your rights
Under Quebec law you may, free of charge:
- Know what we hold about you and get a copy of it.
- Correct it if it is inaccurate, incomplete or ambiguous.
- Delete it. Delete a conversation from the chat, or delete your whole account from your account page, which removes your profile, conversations, alerts, saved keys, publications, comments, reactions and usage logs.
- Take it with you in a structured, commonly used technological format.
- Withdraw your consent at any time, by deleting your account or writing to us.
- Ask us to stop disseminating information about you, or to de-index a link to it, where the law allows.
- Complain to the Commission d'accès à l'information du Québec if you think we have got this wrong.
Write to privacy@phidox.com. We may need to confirm it is really you before acting. We will respond in writing within 30 days of receiving your request, as the law requires.
Keeping it safe
Authentication is handled by Firebase; we never see your password. Conversations are readable only by your own signed-in session and the named operators. API keys you connect are encrypted with Google Cloud KMS. Traffic is encrypted in transit and data is encrypted at rest by Google Cloud.
We keep a register of confidentiality incidents. If an incident creates a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected promptly, as Law 25 requires.
We are a small project, not a bank. We think the above is sound, but you should size your trust accordingly.
When we destroy information
When information is no longer needed for the purpose it was collected for — when you delete it, when you delete your account, or when its retention period above ends — it is destroyed. Any copies held in our providers' backup systems expire on those providers' schedules.
Children
Phidox is not intended for anyone under 14, and people under 14 may not create an account. We do not knowingly collect information from children; if you believe we have, write to us and we will delete it.
Changes
If this policy changes materially we will say so on the site and, if you have an account, by email before the change takes effect. Last updated 11 October 2026.