Privacy policy

Updated Nov 8, 2026

This page covers the owlmastery.com website. It lists what Owl Mastery stores, where it keeps it and why.

Reading the site without an account

You can read every public page without an account, and reading them sets no cookie unless you answer the analytics question described below. If you change the theme, palette or text size, the site saves your choice in the appearance cookie listed below.

Analytics

The site asks once whether it may use Google Analytics to count visits and see which pages are used. You can use the whole site either way. Until you accept, it loads nothing from Google. If you reject it, or your browser sends a Global Privacy Control signal, it never loads Google Analytics.

If you accept, your browser loads Google's script and sends Google the pages you open, the page titles, the address of the site you came from, your browser and device type, and your IP address, from which Google works out an approximate location. Google sets the _ga and _ga_* cookies to tell repeat visits apart, for up to 2 years. Google Signals and ad personalisation are turned off, nothing is used for advertising, and the site never sends your name, email address, lists or portfolio. Google keeps this data for 14 months.

Each time you answer, the site records the random id from the cc_cookie cookie, the categories you accepted and the time, as proof of your choice. That record holds nothing else and is not linked to your account.

Your account

Accounts run on Amazon Cognito, the sign-in service of Amazon Web Services.

To register with an email address and password, you give your email address, your first and last name, and a password. Owl Mastery's server passes them to Cognito, which keeps them and emails you a code to confirm the address.
A forgotten password is reset with a code that Cognito emails to you.
With Google sign-in, your browser goes to Cognito's sign-in page and to Google. Google shares your email address, whether Google has verified it, and your first and last name with Cognito.
Google sign-in and email and password sign-in with the same verified email address open one account, with the same lists, portfolio and picture. A Google account can add a password from Profile. Cognito emails a code to confirm it.
When you sign in, the site keeps Cognito's access token in the session cookie. On each page load the server asks Cognito who the token belongs to, and reuses that answer for up to five minutes. No refresh token is kept, so you sign in again once the access token expires.
Logging out ends your sessions on every device. A device that did not log out can stay signed in for up to five minutes.
Owl Mastery's own database keys what it stores about you by your account id, the Cognito id of the first sign-in on the account. It stores no passwords.

Cookies

Every cookie below is set by Owl Mastery itself. None is used for advertising or to follow you across other sites. Google's _ga cookies, described under Analytics, are set only if you accept analytics.

The cookies Owl Mastery sets
Cookie	What it holds	Why	How long
`session`	Your Cognito access token	Keeps you signed in. Page scripts cannot read it.	Until the token expires, as Cognito sets it
`google_flow`	A random value and a one-time code verifier, nothing about you	Protects the Google sign-in round trip from forgery	10 minutes, deleted when Google sign-in returns
`pending_registration`	Your email address	Remembers which new account to confirm while you enter the emailed code	1 hour, deleted once the account is confirmed
`pending_reset`	Your email address	Remembers which account is resetting its password	1 hour, deleted once the password is reset
`appearance`	Your theme, brightness, palette and its intensity, and text size	Shows the site the way you set it	1 year
`list`	The id of the list you last picked or created	Remembers which of your lists is shown	1 year, deleted when you delete that list
`layout`	The dashboard's panels, their order, size and zoom, and what each one shows, such as a chart's range and candle size or a summary tab	Keeps the dashboard the way you set it when you open another ticker or come back	1 year. Your first change also deletes chart_prefs, the older cookie it replaces
`cc_cookie`	Your cookie choice, when you made it, and a random id that is not linked to your account	Remembers your answer so the site does not ask again	6 months
`admin_views and tz`	Chart choices and a time zone	Set on the admin pages only, for administrators	1 year

Before lists moved to your account, the site kept a watchlist in a watchlist cookie in your browser. It no longer sets that cookie. The first time you open the dashboard or your lists with it still in your browser, the site adds its tickers to Favorites, which holds at most 100, and then deletes the cookie, even if adding them fails part way.

The search box on the dashboard remembers the last 8 tickers you picked from it, in your browser's local storage under recent_tickers. That list stays in your browser.

What the database stores

Your account record. Once Cognito reports your email address verified, the database keeps your email address, your first and last name, when it first saw your account, when you last signed in, how many times you have signed in, and the minute of your last request. If you change your name in the app, it also keeps when you last did, and shows that name whichever way you sign in. Administrators see these records on the admin pages.
Your sign-ins. For each way you sign in, Google or email and password, the database stores its Cognito id, the account it opens, which of the two it is, and when the site first saw it.
Your profile picture. If you add one, the server crops it to a square and saves it in three sizes, each as WebP and JPEG. Saving them drops the photo's EXIF data, GPS position included. The six files go to Cloudflare R2 and are public at media.owlmastery.com to anyone who has their address, which holds a random id. The database stores only that id and when it was set. Removing the picture deletes its row, and the server then deletes its files.
Your portfolio. For each position, the database stores the ticker, the number of shares, and when you added or last changed it, under your account id. It also stores when your portfolio was created. You can change or remove a position at any time.
Your lists. For each of your lists, the database stores its name and when it was created or renamed, under your account id. For each ticker on a list, it stores the ticker and when you added it. Every account has a list named Favorites, created empty the first time the site loads your lists.
Activity. For each minute in which a signed-in account makes a request, the server records that minute and the account id. It uses these rows to count active users on its admin pages and deletes them after 30 days.
Administrators. The database stores each administrator's email address and role. It also stores the email address of the administrator who granted the role, and when.
Service metrics. The database stores request counts, error counts, response times and memory use, with nothing about who made the requests, and keeps them for 30 days.

Request logs

The API writes one log line per request with the method, the path without its query string, the status code, the duration, a request id and the IP address of the connection. It never logs request bodies or query strings, so passwords and codes stay out of the logs. A request that fails on the server is also logged with its cause. The API also writes each line to the server's standard output, which stays with the container.

Your browser does not connect to the API directly. The site's web server calls the API for you, so the address in these lines is the web server's. The log files stay on the server until an administrator deletes them, and nothing deletes them on a schedule.

Services that handle your data

Amazon Web Services runs the server, the database and Cognito, in Amazon's us-east-1 region in the United States.
Cloudflare carries requests to owlmastery.com before they reach the server, so it handles your IP address and the pages you request. It also stores and serves profile pictures, through its R2 storage.
Google takes part if you choose Google sign-in, and runs Google Analytics if you accept it.

The site loads no advertising scripts, and no code from other sites except Google Analytics once you accept it. Its fonts and ticker logos are served by Owl Mastery itself.

Your choices

Clearing this site's data in your browser resets the appearance, the chart picks, which list is shown and the recent searches, and signs you out in that browser. Your lists stay on your account.
Logging out ends your sessions on every device. A device that did not log out can stay signed in for up to five minutes.
You can change your cookie choice at any time from Cookie settings, at the foot of every public page or here. Turning analytics off deletes the _ga cookies.
You can remove any position from your portfolio.
You can change your name and remove your profile picture at any time.
You can remove any ticker from a list, and delete any list except Favorites.
The site has no button to delete an account yet.

Contact

There is no contact address yet.