Schema Technologies LLC ("Schema", "we", "us") makes software products and films. This policy explains what personal information we collect through our products, how we use it, who we share it with, and the choices you have.
Questions or requests about this policy go to hello@schematech.co.
This policy applies to the following services, together "the Services":
If a Service presents its own more specific notice, that notice adds to this policy for that Service. This policy does not cover third-party services you connect to ours — Plaid, SnapTrade, Apple, Google, Oura and others have their own policies, linked in section 06.
Market Terminal and Anthropic. Market Terminal can put into sentences the trace your own rules produced — which of them fired on your holdings, and why — and answer the questions you type about it. That writing is done by Anthropic’s API. It is off until you allow it, and Market Terminal asks in one of two wordings, depending on whether your account is a member’s or a founding member’s.
Member accounts are asked, on the web or in the app, in these words:
“If you allow it, your holdings, the names you hold, your rules’ trace and the questions you type are sent to Anthropic’s API, to narrate that trace and to answer your questions from it. Anthropic does not train its models on this data.”
Founding-member accounts are asked in their own words, because on a founding-member account a yes also lets Anthropic’s API write the advisors’ commentary on your reports and recommendations, sort and summarise public news headlines about the names you hold, and answer the questions you put to the advisors on the web’s Ask desk. On the web, and in the app from the version that carries this wording, these are the words:
“If you allow it, your holdings, the names you hold, your rules’ trace, the questions you type and public news headlines about the names you hold are sent to Anthropic’s API: to narrate that trace and answer your questions from it, to write the advisors’ commentary on your reports and recommendations, to sort and summarise those headlines, and to answer the questions you put to the advisors on the web’s Ask desk. Anthropic does not train its models on this data.”
A version of the app from before this wording shows a founding member the member’s words and cannot record a yes to them: it records nothing and says to allow it on the web, under Account → Written narration. The advisors’ text can go beyond your rules’ trace. It is labelled as model-written and is not advice.
What is sent. Your holdings and their dollar values, the names you hold, the measurements our engine computed from them, the questions you type and, on a founding-member account, public news headlines about those names. We do not add your name, your email address or your brokerage credentials. The requests are made from our servers, never from your browser or your phone.
Without your yes, nothing is sent. Until you allow it, nothing about your account goes to Anthropic: no narration is written, no typed question is answered, and your rules, thresholds and traces work exactly as they do with it. A yes is recorded with its date and the version of the wording you were shown, and it counts only for that version, and only while that version is the wording for your account’s type. A no, or a withdrawal, clears that record. If what is sent, or to whom, changes materially, the wording gets a new version and you are asked again, with nothing sent in between.
Which version, and when you are asked again. The member wording is the version of 26 September 2026, the first to name the questions you type, so anyone who allowed the earlier wording is asked again. The founding members’ wording is the version of 28 September 2026 (2026-09-28-founding). Until then founding members were asked in the member wording, so a founding member who allowed the wording of 26 September is asked again, in their own words, and nothing is sent for them until they allow it. A change to your account’s type clears a yes that is not to the new type’s wording, in the same step: a member who becomes a founding member is asked again, in the founding members’ words, and nothing is sent for anything that starts after the change until they allow it, and a founding member who becomes a member keeps no yes to the founding members’ wording and is asked in the member’s words, unless the yes on record is already to those.
You can withdraw at any time, under Account → Written narration, on the web or in the app. Nothing is sent for anything that starts after you withdraw. Withdrawing does not delete what was already written for you; deleting your account does.
Training. Anthropic does not train its models on this data. That rests on Anthropic’s Commercial Terms of Service, which govern our use of its API and do not permit Anthropic to train models on what we send. What Anthropic keeps, and for how long, is governed by those terms, not by this policy; what we say below about keeping and deleting covers our copies only.
What the operator can see. The person who runs Market Terminal can see, for each account, its email address and role, how many sessions are live, its companion devices, when it last synced, its recent jobs, what kind each was, when it ran and whether it failed (with the start of the error message, except for a job that carries your words), and its model budget and spend this month; and can change its role or model budget, sign it out, revoke its devices, remove its access, delete it, or run a report for it. The operator’s tools do not show the questions you type or the answers written to them: a request of yours, with what you asked and what came back, opens only from your own account, and when one that carries your words fails, the operator is told that it failed, not what it said. That is a limit on what the product shows, not encryption — your questions are stored in our database like the rest of your account, and the people who run our production systems can reach it (section 08).
How long it is kept. On our side, a question you type on the Explain desk, on the web or in the app, is kept only in the request that carried it, together with its answer, and those requests are cleared about 30 days after they are made. Narration written for a report is kept with that report. On a founding-member account, questions put to the advisors on the web are kept with the account as desk sessions, the way reports are (the 20 most recent of each). Deleting your account — yourself, under Account on the web or in the app, or by asking us — removes from our database your questions, the narration and answers written for you and your model-usage records. The server that runs your reports keeps its own working copy of your account’s files, including your reports and their narration and, on a founding-member account, the advisors’ desk sessions, and deletes it itself: it looks for deleted accounts when it starts, every five minutes between the jobs it runs, and at once when it turns away a job because the account behind it is gone. So that copy is normally deleted within minutes of your account. It can take longer while that server finishes a long job, or if it cannot read the list of accounts, and then it goes at the next check. If that server is stopped at the time, it is deleted when the server starts again. Deleting also disconnects your brokerage: we ask SnapTrade to delete the connection, and our own copy of the credential that reads it is deleted whether or not SnapTrade confirms, so we can no longer read it.
Your device’s own features. On iPad, what you drag out of the app (a ticker, a ticket’s or finding’s measurements, a narration with its trace, a chart image) can be read by Apple Intelligence if you invoke it on that item. That is Apple’s processing under Apple’s terms, started by you. The app sends nothing to us or to anyone else when you do, and the written-narration permission above does not cover it.
Strata's health data is used for one thing: composing your training. Sleep, heart-rate variability and resting heart rate adjust the day's recommended load. They are never used for advertising, marketing or data mining, never sold, and never disclosed to third parties except a processor acting on our instructions to run the Service.
Readiness, HRV, sleep and resting heart rate are never shareable — not with friends, not on leaderboards, not through any social feature, regardless of how you set your other switches. This is enforced in code and covered by tests.
You can revoke Strata's Health permissions at any time in iOS Settings → Privacy & Security → Health. Doing so stops new reads; ask us to delete what has already been stored.
Where the law asks for a legal basis: we process data to perform our contract with you, with your consent where we ask for it (health data, connected accounts, and in Market Terminal written narration, answers to your questions and, on a founding-member account, the advisors’ commentary and the sorting and summarising of news headlines), and for our legitimate interests in running secure, working software.
We keep your information while your account is active. When you delete your account, or ask us to, we delete it within 30 days, except for what we must keep for legal, security or accounting reasons, and except in encrypted backups, which expire on their own schedule.
Unlinking a bank or brokerage removes the connection and its access token; transaction history already imported stays until you delete it or your account. Revoking Health permissions stops new reads; stored health data is deleted on request.
In Market Terminal you can delete your account yourself, under Account on the web or in the app. Section 03 says what goes with it, and how long a question you type is kept before then.
Traffic between your browser and our servers is encrypted. Financial access tokens — bank tokens in Spend Terminal, brokerage credentials in Market Terminal — are encrypted before they are written, with a key held in the server environment rather than in the database, so a copy of the database alone does not yield them. Passwords, where a product uses one, are hashed with a memory-hard algorithm.
Sessions. Signing in issues one long-lived session, not a rotating pair of tokens: in Spend Terminal and Market Terminal a session lasts up to 30 days. Signing out ends it. Spend Terminal can also end every session on every device at once, and changing a password ends all of them; Market Terminal ends the session you are signed in to, and the operator can end the rest on request. We would rather say this plainly than describe protections these products do not have.
Access to production systems is limited to the people who run them. No system is perfectly secure. If we discover a breach that affects you, we will tell you.
The Services are not directed to anyone under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, email us and we will delete it.
You can ask us to access, correct, export or delete your personal information, and to stop a particular processing, by emailing hello@schematech.co. We will verify the request is yours and respond within 30 days. If you are in a jurisdiction that grants specific rights — the EEA, the UK, California and others — those rights apply and we will honour them.
Inside the products: unlink accounts in Spend Terminal and Market Terminal; allow or withdraw written narration, and delete your account, under Account in Market Terminal; adjust sharing switches and Health permissions for Strata; leave studios in Schema Creative.
Our servers are in the United States (Oregon). If you use the Services from elsewhere, your information is transferred to and processed in the US, where privacy law may differ from your own.
When this policy changes we will post the new version here with a new effective date, and for material changes we will tell you inside the affected Service or by email before they take effect.