Privacy Policy

Information we collect

• Account information: your name, email address, and a securely hashed password (we never store your password in plain text).
• Trade data you upload: broker account statements you choose to import. Account numbers are masked to their last 4 digits before storage — the full account number is never written to our database, including in the raw archived copy of an uploaded statement.
• Billing information: if you subscribe, payment is handled entirely by Stripe. We store a reference to your Stripe customer/subscription record, not your card details.
• Support requests: anything you send us through the contact form, including your name, email, and message.

How we use it

To provide the service (reconstructing and displaying your trades), to authenticate you, to process subscription billing, to respond to support requests, and to notify you or ourselves about account security events (for example, a login lockout after repeated failed attempts).

Who we share it with

• Stripe — payment processing and subscription management.
• Resend — delivery of transactional email (password resets, account notifications, contact form messages).
• Cloudflare Turnstile — bot/abuse protection on our contact and password-reset forms.
• Our hosting and database providers — to run the application and store your data.

We don't sell your data, and we don't share it for advertising purposes.

How we protect your data

We use industry-standard measures to protect your information, including encryption, password hashing, and access controls. If we experience a data breach affecting your personal information, we'll notify you as required by applicable law.

Cookies & similar technologies

We use one strictly-necessary cookie to keep you signed in (your session). It's required for the application to function and isn't used for tracking or advertising.

We may use Vercel Web Analytics and/or Vercel Speed Insights to understand aggregate usage and performance. As currently offered by Vercel, these tools do not use cookies or persistent identifiers. If we adopt additional analytics, monitoring, or advertising tools in the future that do use cookies, we will update this policy and, where required by law, request your consent before doing so.

Data retention & deletion

We retain your data for as long as your account is active. If you'd like your account and associated data deleted, contact us and we'll process the request.

Children's privacy

The Service is not directed at children under 16, and we don't knowingly collect personal information from them. If you believe a child has provided us information, contact us and we'll delete it.

Your rights

If you're in the EU or UK, the GDPR gives you rights to access, correct, delete, or export your personal information, and to object to certain processing. If you're a California resident, the CCPA gives you similar rights, including the right to know what personal information we hold and to request its deletion; as stated above, we don't sell personal information. Contact us to exercise any of these rights.

International data transfers

Our hosting and database providers process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home country.

Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do.

Contact

Questions about this policy? Contact us.