What we record, and what we do not.

One cookie of our own and no accounts

This site sets one cookie, dvc_v: a random id, kept for a year, that lets us tell a returning browser from a new one. It carries nothing about you, is sent only to this site, and is never shared. There is no login, no signup, and no email box anywhere on the free tool. You do not have to identify yourself to read a 10-K here, and there is no way for you to do so even if you wanted to. A visitor who arrives from a Google ad also gets two of Google's cookies, under Visitors from a Google ad.

How we count visitors

Our own server counts each page view, with no third party in the path. For each day it keeps totals by page, by the site you came from, by campaign tag, by country and by device type (phone or desktop), and it counts known crawlers apart from readers. Unique visitors are estimated from a hash of your address and browser that is salted per day, so it cannot be joined from one day to the next. We keep the hash, not the address. The first page a new browser lands on, with the site it came from, is kept once against the cookie id. We also keep a short label for where that first visit came from, such as "search" or "reddit", so we can count where visitors, free keys and paid plans come from. That label, and the day of that first visit, are also written to the payment session when you subscribe and to your API key record, which we keep while the key exists. If measurement is allowed, the first visit's campaign source, medium, campaign name and tagged keyword also accompany your payment session and subscription. This lets us connect a paid plan to its campaign. We do not send your visitor cookie id or a Google click id to the payment provider. Every other count here expires after 400 days.

What the counters hold

We count page views so we know which parts of the site are worth the work, and so a sector sponsor can be quoted an honest number. A count is a number attached to a public thing: a ticker, a section id, a sector. For example, the counter records that item-1a was read a certain number of times today. It does not record who read it, in what order, or from where. There is no profile, no session, no identifier that follows you between pages, apart from the Google ad tag described below.

The trending page is built from those totals, and any figure below 50 views is left out entirely, so a page nobody much visits cannot be traced back toward a single reader.

Analytics

We use Vercel Web Analytics, which is cookieless and does not fingerprint visitors or follow them across sites. That is why there is no consent banner to click away: there is nothing to consent to, except the Google ad tag described below.

Visitors from a Google ad

If you arrive by clicking one of our Google ads, the page you land on loads Google's ad tag, so Google Ads can count whether the click led to a copied section or filing, a free API key or a paid subscription. We keep a note in your browser for 90 days that you came from an ad; within that time, the tag loads again only on a page where one of those happens, at that moment: a filing page where you copy, the free key page once your key is issued, or the checkout success page once your key arrives. Google receives the ad click id, the address of those pages without any query string, their titles (a filing page's title names the filing), and which of those happened, and it sets two cookies of its own (_gcl_au and _gcl_aw). Ad personalization is off. We never pass Google your email address, your API key or any payment detail. For visitors who did not come from a Google ad, nothing loads from Google. Global Privacy Control, Do Not Track and our internal flag turn it off.

Assistant and IDE connector

An assistant sends the arguments for the tool it calls, such as a ticker or filing id. It does not send its conversation through this connector. We use those arguments to answer the request. Usage events contain only the tool name, result category, a broad response-time bucket, an allowlisted assistant label and whether traffic was marked as an internal test. Unmarked traffic stays unclassified. Events contain no arguments, filing text, IP addresses, cookies, credentials or raw user agents. These compact events go to Vercel Analytics and our existing host logs; they are not a per-person history. Retention: Vercel keeps the log entries for the period its plan sets, and Vercel Analytics keeps the events under its own terms. We set no longer period, we copy the events to no other store, and there is no separate conversation or filing-query store. Removing the connector stops future calls.

Connector usage measurement is skipped for DNT: 1, Sec-GPC: 1, or a query string on the connector URL. We also pass that choice to the API's own measurement. The daily per-address allowance still applies. A failed analytics delivery never changes the filing answer.

Global Privacy Control

If your browser or extension sends a Sec-GPC header, or the older DNT header, we honour it. Our own server side counters skip your visit, and the visitor count above records nothing and sets no cookie. When your browser also reports the setting to the page, as browsers with Global Privacy Control built in do, the analytics script and Google's ad tag are not loaded either. We do this everywhere, not only where the law requires it, and you do not have to ask.

One count is kept whatever your browser sends, because it measures our work rather than your visit: how many filings we fetch from EDGAR and parse because they were not yet in our cache. It records only that a parse happened and whether the company is in the S&P 500, not which filing, who asked or from where.

Rate limiting

The free API allows a number of calls a day per address, so one caller cannot exhaust it for everyone. That needs a per address tally, which is kept for the current UTC day and then expires. It is a protection, not a measurement, and it is never used to build a picture of anyone. A subscriber who reaches us through the RapidAPI marketplace is counted under the RapidAPI user name that RapidAPI sends, not under an address, for the current UTC day.

Payments and API keys

Plans are paid on Stripe's hosted checkout page, so card details go to Stripe, not to us. We store an API key only as a hash, with its plan, its Stripe customer and subscription identifiers, its status and billing period, and when it was created.

Logs

Our host keeps short lived request logs, as every host does, which include IP addresses. We do not export them, build profiles from them, or join them to anything else.

The filings themselves

Source documents are public domain filings from SEC EDGAR. Reading one here does not tell the SEC anything about you, because we fetch and cache the document rather than sending you to them.

Changes and contact

If this page ever needs to say something less generous than it says today, the change will be obvious rather than quiet. Questions to hello@darkvectorcognition.ai.