Privacy Policy
Last updated: October 2026
This policy explains which personal data we process when you use Stock-scoring.com, why we do it and which rights you have under the EU General Data Protection Regulation (GDPR). We do not use tracking, analytics, advertising or social media plugins.
1. Controller
Stefan Schaub, Calvisiusstraße 26, 04177 Leipzig, Germany (see also Impressum). You can reach us via the contact form or by email at info@stock-scoring.com.
2. Hosting and server log files
The website and our mailbox are hosted by dogado GmbH, Germany. When you open a page, the web server automatically records: IP address, date and time, requested URL, HTTP status code, transferred data volume, referrer URL and browser identification (user agent).
We need this data to deliver the website, to keep it secure and to defend against attacks and abuse (for example rate limiting). Legal basis is our legitimate interest according to Art. 6 (1) (f) GDPR. Log files are deleted after 14 days at the latest, unless a security incident requires longer storage. We have concluded a data processing agreement with our hosting provider according to Art. 28 GDPR. All data is transmitted encrypted via HTTPS.
3. Cookies
We only use cookies that are strictly necessary to provide the services you request. They do not track you and are not shared with third parties. Therefore no consent is required (§ 25 (2) No. 2 TDDDG); legal basis for the related processing is Art. 6 (1) (b) and (f) GDPR.
| Cookie | Purpose | Lifetime |
|---|---|---|
| session_id | Keeps you logged in after login | 7 days |
| logged_in | Shows the login state in the menu; contains only the value "1" | 7 days |
| google_oauth | Protects "Continue with Google" against forged requests | 10 minutes |
| new_api_key | Shows your new API key once after sign-up with Google | 5 minutes |
Fonts are served from our own server; your browser does not connect to Google Fonts or other content delivery networks.
4. User account
Browsing the website works without an account. Some analyses and the API require a free account. When you register, we store your username, email address, first and last name and a hash of your password (not the password itself), as well as the time of registration and of your last login. We send you a verification code by email to confirm your address. To protect your account against password guessing, we store the number and time of failed login attempts.
Legal basis is Art. 6 (1) (b) GDPR (providing the account you asked for) and, for security measures, Art. 6 (1) (f) GDPR. We store your data as long as your account exists. You can ask us to delete your account at any time via the contact form; we then delete your data unless legal retention obligations apply.
5. Sign-in with Google
You can optionally sign in with your Google account. When you click "Continue with Google", you are forwarded to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then sends us your Google account ID, your email address, whether it is verified, and your name. We use this data only to create or log in to your account. Google may also process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.
Legal basis is Art. 6 (1) (b) GDPR. No data is sent to Google unless you click the button. More information: Google Privacy Policy.
6. Contact form and email
When you send a message via the contact form, we receive your name, email address, username and message by email in our mailbox. When you write to us by email, we receive your email address and the content of your email. We use this data only to answer your request.
Legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or account, otherwise our legitimate interest in answering requests according to Art. 6 (1) (f) GDPR. We delete the messages when your request is completed, unless legal retention obligations apply. To prevent abuse, we count the number of messages per account and day.
7. API keys
Registered users receive a personal API key. We store only a hash and the first characters of the key, the time it was created, and the number of API requests per day to enforce the daily limit. Legal basis is Art. 6 (1) (b) GDPR. The data is deleted together with your account.
8. Recipients
We do not sell your data and do not share it with third parties for advertising. Recipients are only our hosting provider (as processor) and, if you use it, Google for the sign-in (Section 5). We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR; the scores on this website rate stocks, not people.
9. Your rights
You have the right to:
- access your personal data (Art. 15 GDPR),
- rectification of incorrect data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on Art. 6 (1) (f) GDPR for reasons arising from your particular situation (Art. 21 GDPR).
To exercise your rights, please use the contact form or write to info@stock-scoring.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or of our seat.
10. Changes
We update this policy when our services or legal requirements change. The current version is always available on this page.