Last updated October 2026. PentaRatio is operated by Saga Dog Corp, Miami, Florida. Questions: juanrodriguez@civisource.app.
1. Browsing the rankings
You can use PentaRatio without an account. We don't run an account database, and we don't sell, rent or share personal data with advertisers or data brokers. There are no advertising cookies.
Analytics. We use Vercel Web Analytics and Vercel Speed Insights on the live site. They are cookie-free: no cookies are set and nothing is stored on your device for them. They count aggregated page views, referrers, rough country, device type and page-load speed. They don't track you across other websites, and we can't use them to identify you.
Hosting. The site runs on Vercel. Like any web host, Vercel processes your IP address and standard request details to deliver pages and keep the service secure. Vercel keeps short-lived request logs for us. Our own code uses your IP address briefly, in memory, to rate-limit heavy use of our APIs, and use the country Vercel derives from it to show region-appropriate content on the brokers page. We don't store your IP address.
Fonts. Pages load fonts from Google Fonts, so your browser sends your IP address and a standard request to Google when it fetches them.
2. My Penta lists stay in your browser
Holdings and watchlists you enter in My Penta, your chosen profile, the "hide funds" setting and a cache of grades are saved in your own browser's local storage. We don't receive or store them. To show grades, charts or filings, your browser asks our servers about ticker symbols only (never quantities), and we don't save what you asked beyond the host's short-lived request logs. Clearing your browser data removes your lists.
3. Membership and sign-in (if offered)
If we offer a membership and you sign in, we keep only your email address. It's held in an encrypted, HttpOnly cookie in your browser (30 days), and, if you become a member, with our payment processor Stripe as your billing contact. Stripe handles payments and stores your card; we never see your card number. Resend delivers the one-time sign-in emails. There is no password.
Sign-in cookies: a session cookie (30 days), a short-lived cookie that ties a sign-in link to your browser (15 minutes), and a small "member" hint (30 days) so the page asks for the full rankings.
To protect sign-in from abuse we use an invisible proof-of-work check and request limits. Those checks count requests using keyed (one-way) hashes of your email address and network, and log the decision with a hashed email and a coarse country code, never your raw email address, IP address or browser details.
Grade Watch (members, if offered). Members get a weekly email summarising changes in the public letter grades; every member gets the same email. If you turn on watchlist alerts in My Penta, we save your watchlist symbols (and the grades shown when you added them) under a code derived from your email, not your email itself, so we can email you when one of them changes grade. Your holdings never leave your browser. Turning alerts off, or using the unsubscribe link, deletes the saved symbols. Every Grade Watch email has a one-click unsubscribe link, and Resend delivers these emails.
4. Optional broker connections (if offered)
If we offer a paper-trading or holdings view and you connect a brokerage account (Alpaca), the access token Alpaca gives us is kept only in an encrypted, HttpOnly cookie in your browser (8 hours for paper trading, 1 hour for the read-only holdings view), plus a 10-minute cookie that protects the connection step. We don't store your holdings or orders on our servers.
5. Chat assistant (if offered)
If we offer our chat assistant, the text of your messages is sent to an AI model through the Vercel AI Gateway to write a reply. We don't log message text. IP addresses, and phone numbers on messaging apps, are only ever stored or logged as salted one-way hashes, for rate limits and to honor "stop" requests.
6. Your choices
- Clear your browser's site data to remove your My Penta lists and any cookies.
- If you're signed in, sign out from your account page, and cancel or manage billing through the Stripe billing page linked there.
- To ask about or delete any record we or Stripe hold for you, email juanrodriguez@civisource.app.
7. Changes
We may update this policy. The date at the top shows when it last changed. See also our terms of use.