Typecel Privacy Policy

Effective date: 4 November 2026

This policy explains what Typecel, operated by 株式会社Your Analyst ("Your Analyst, Inc."), collects, why, and what your choices are, across Typecel's products: Typecel for Markets (markets.typecel.io, "Markets"), your Typecel account (account.typecel.io), and any other Typecel product that links to this policy. It covers people with an account and people who read Markets without one. It is written for the service as it exists today: an early-stage product.

1. What we collect

If you read without an account. We do not ask who you are. Our servers and our network provider (Cloudflare, section 4) keep the standard log data described under "Usage and operational logs". Recent searches you make in the Library are kept in your browser's local storage, not on our servers. If you change an assumption on a page without signing in, the change stays in your browser and is not saved.

Account identity (via WorkOS). Sign-in is delegated to WorkOS AuthKit. When you sign in we receive and keep your email address, your name, your WorkOS user id, and your organisation memberships (if you belong to a Typecel organisation). We also store account attributes we set ourselves, such as your plan tier and your handle.

Your public profile. Your display name (the first and last name on your account, which you can change, and need not be your legal name), your handle, and, if you add them, a picture, a one-line bio, your Instagram, Facebook, LinkedIn and X ids, and up to three links. Your profile is kept once for your account and shown by every Typecel product that has profiles, together with counts of your public views' likes, forks and comments and of your followers and the people you follow.

Your content. The financial models you author (structure, formulas, values) together with their version history, project names, and visibility settings. If you attach source documents to a project (uploaded files such as PDFs or spreadsheets, or documents captured from a URL you provide), we store those files and text extracted from them too. This is the product; storing it is the service.

Community activity (Markets). Your comments and replies, with your display name as it was when you wrote them; your likes, follows, and when you last looked at a followed person's views; your saves and lists; your requests to add a company; the notifications we show you; and reports you send us. Comments are public on any model the public can read. The people your likes, follows, forks and comments concern are told it was you. Saves and lists are private to you.

Assistant conversations. If you use the built-in AI assistant, we store your conversations (your messages, the assistant's replies, and a summary of the actions it took) so you can review and continue them. We keep them while your account is active (section 5 says what happens when you delete it). On Markets, a conversation belongs to one model and only you can read it, also when the model is public. We also keep each run's usage: the AI it used and the web searches it made, which count against your assistant allowance and usage balance, and the pages it read and documents it captured, which are counted but not charged.

Billing records (paid plans and trials). We keep each product's plan tier and status for your account, including a trial's end. Where your account has a Stripe customer record (a paid plan, a trial run as a Stripe subscription, including a card-free trial from an invitation or campaign code, or a card registered to start a trial), we also keep the link to it and whether a payment card is on file (from Stripe, never the card itself). When you start a Markets trial, which needs a payment card, we also keep the fingerprint Stripe gives the card (a code that tells one card from another, not the card number), so that a card starts only one trial. Your payment details themselves go to Stripe, not to us; see section 2.

People named in company filings. Official models and the documents they cite can contain information about company officers and others that the company itself published, such as names, positions and remuneration. We use it only as it appears in those public documents, to show where a figure came from.

Usage and operational logs. Standard server logs (IP address, timestamps, requested endpoints) kept for security, debugging, and rate-limit enforcement. When something fails, the log line records internal references (such as our reference for the account or workspace concerned) and the kind of failure, not the failure's own text. The failure's full technical detail, which can include what a provider such as WorkOS or Stripe answered, is kept only on the server where it happened: it is deleted within seven days, and may remain in that server's daily backups for up to 14 days more.

2. What we do not collect or do

• No card numbers on our servers. Paid subscriptions are processed by Stripe; your card details are entered on Stripe's pages and never touch our systems. From Stripe we keep the reference that links your account to its Stripe customer record, your plan tier and status, whether a card is on file, the reference to a saved payment method if you switch on automatic top-ups (a reference, never the card itself), and a record of each top-up charge: its amount, currency and tax, and the payment and tax references. The other billing records we keep are listed in section 1.
• No training on your content. We do not use your models or any of your content to train AI models. AI features run only at a user's request: when you use the built-in AI assistant, your instructions and the model and attached source content needed to answer them are sent to our AI provider (Anthropic) solely to serve that request. On Markets, the request also carries the page's context: the company, your model's title and text, the title of the model you forked, and the most recent public comments on it, which may be other users'. So public content you wrote can reach our AI provider when someone else uses the assistant on that model, even if you never use it yourself; it is used only to answer that request. When the assistant searches the web, or the service looks up a source on the web, the search query (its text, with a country and language) is sent from our servers to a web-search provider: Brave Search, or Anthropic's web search. Anthropic's commercial API terms do not permit training on this data. Where source-document features are enabled, we use AI-powered services only to extract text from and index the documents you attach (see the providers in section 4), never for training.
• No advertising or third-party analytics trackers. See Cookies, below.
• No selling of personal data. To anyone, ever.

3. Public content - read this before you make a model or a fork

On the free plan, and on any plan or trial without private models, every model you create is public, and on a plan that limits how many models can be private at a time, so is every model you create that you have not made private within that limit: anyone with the URL can open it without an account, and anyone, signed in or not, can find it where the service lists it. On Markets this covers every fork you make (each is your view, shown on a company page or your profile), together with your comments and your profile. A reader sees the entire model, including formulas and values. Other users may fork public models while they are public, and, where their plan includes export, export them.

This includes source documents attached to a public project: a signed-in reader of a public model can open and download them. Treat anything you put in a public model as published. Do not put personal data (yours or anyone else's) or confidential information into one; information a company itself published in its filings, used as it appears there, is the exception. On Markets, company pages are indexed by search engines and profile pages may be. Pages of individual views are marked noindex, but a shared link shows the view's title and the start of its text. Anyone with a link can still share it.

4. Who we share data with

We use these subprocessors:

We disclose data beyond this only if legally required (for example a valid court order), and where lawful we will tell you when that happens.

Because WorkOS, Stripe, Anthropic, Brave, Cloudflare, Amazon CloudFront (for public images) and the source-enrichment provider process data outside Japan, visiting any page, signing in, paying or starting a trial, using the built-in AI assistant, and attaching source documents each involve a cross-border transfer of the data listed above.

5. Retention and deletion

• Your content is kept while your account is active. Version history is part of the model and is retained with it.
• Deleting a project removes the model from the service: no new access to it is granted, though access already granted can continue for a short time (minutes). For seven days support can restore it at your request. It is erased from storage, with its version history, within 30 days of deletion.
• Deleting your account removes your projects and account records from the service, with no restore window. Erasing your models' stored content and version history from storage does not yet follow automatically: until it does, we erase them within 30 days of your asking at support@typecel.io. Residual copies may persist in encrypted database backups for at most 35 days before rotating out.
• Kept after you delete your account. Your handle stays reserved, so nobody else can take it and pose as you at your old addresses. Records of invitation or campaign codes you redeemed, and the fingerprints of cards that started a trial, are kept so each code's limits and the one-trial-per-card rule can be applied. Records of your usage and its cost (what the AI assistant used and when, and what it cost, linked to your account's reference) are kept as accounting records for as long as accounting and tax law requires. None of these is shown publicly.
• Private models over a plan's limit. When a plan ends or changes, or a payment fails, private models over the new limit that you have not made public or deleted within 15 days may be deleted then, and are erased as a deleted project is (above; Terms, section 4).
• Markets activity. Comments, likes, follows, saves, lists, requests and notifications are kept while your account is active, and deleted when you delete them or your account (see the Terms, section 9); to have a comment deleted, write to support@typecel.io with its link, where its page does not offer that. Where someone replied to a comment of yours, the reply stays and your comment shows as removed. Account deletion does not yet reach Markets automatically: until it does, we delete your Markets activity, your assistant conversations and your profile picture within 30 days of your asking at support@typecel.io.
• Your public profile is deleted with your account. Copies search engines or other sites made while it was public are outside our control; you can ask the search engine to drop them.
• What deletion cannot undo: forks and exports other users made of your public models while they were public remain in those users' accounts, and identity records held by WorkOS are deleted per their retention practices. Anthropic retains assistant inputs and outputs only under its commercial API terms (no training; limited abuse-monitoring retention); deleting content on Typecel does not reach copies already processed during your past assistant runs.
• Operational logs are kept for no longer than 90 days for security purposes, then discarded.

6. Your rights

You can access and correct your account data in the product, edit or remove your profile, name and picture on Markets, and delete projects yourself; to delete your whole account, contact support@typecel.io. Beyond that, you can ask us to:

• tell you what personal data we hold about you;
• correct it, delete it, or stop using it;
• provide a copy of it in a portable format.

We honour these requests for everyone, and specifically as required by Japan's Act on the Protection of Personal Information (APPI) for users in Japan (disclosure, correction, and cessation-of-use requests) and by the GDPR for users in the EU/EEA (access, rectification, erasure, portability, objection). Contact us using section 9; we may need to verify you control the account's email address first.

7. Cookies and local storage

Typecel sets only strictly necessary first-party cookies. On your account site: typecel_session, an encrypted session cookie that keeps you signed in (it expires after 8 hours, extended while you actively use the service), typecel_pkce, a short-lived (10-minute) cookie that exists only during the sign-in handshake, and typecel_account_delete_af, set only when you open the page that deletes your account, which checks that the request to delete came from that page (it ends when you close the browser). On Markets: markets_session, an encrypted session cookie that never outlives your account session, and markets_signin, a 10-minute cookie that exists only while you sign in. If you read Markets without signing in, we set no cookie. Our network provider, Cloudflare, may set its own strictly necessary security cookies. There is no cookie-consent banner because there is nothing optional to consent to. We set no advertising or tracking cookies.

We also use your browser's local storage for functional state only: for example, remembering your workspace selection, and that you recently had a session so an expired one signs you back in smoothly. On Markets this includes your recent Library searches (local storage) and, for one browser tab only, the tab you last opened and an action you started before signing in (session storage). Nothing in it identifies you to any third party.

8. Children

Typecel is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16; if you believe a child has created an account, contact us and we will delete it.

9. Contact

Privacy questions or rights requests: support@typecel.io.

10. Changes

We will update this policy as the service evolves. Material changes will be announced by email or in-product, and on the service's pages, before they take effect, with the effective date updated above.