Privacy Policy

Information we collect

• Account information: your name, email address, and a securely hashed password (we never store your password in plain text).
• Trade data you upload: broker account statements you choose to import. Account numbers are masked to their last 4 digits before storage — the full account number is never written to our database, including in the raw archived copy of an uploaded statement.
• Billing information: if you subscribe, payment is handled entirely by Stripe. We store a reference to your Stripe customer/subscription record, not your card details.
• Support requests: anything you send us through the contact form, including your name, email, and message.

How we use it

To provide the service (reconstructing and displaying your trades), to authenticate you, to process subscription billing, to respond to support requests, and to notify you or ourselves about account security events (for example, a login lockout after repeated failed attempts).

Who we share it with

• Stripe — payment processing and subscription management.
• Resend — delivery of transactional email (password resets, account notifications, contact form messages).
• Cloudflare Turnstile — bot/abuse protection on our contact and password-reset forms.
• Our hosting and database providers — to run the application and store your data.

We don't sell your data, and we don't share it for advertising purposes.

How we protect your data

We use industry-standard measures to protect your information, including encryption, password hashing, and access controls. If we experience a data breach affecting your personal information, we'll notify you as required by applicable law.

Cookies & similar technologies

We use strictly-necessary cookies required for the application to function: one to keep you signed in (your session), and one that remembers which broker account you last selected so the app can restore that view when you reopen it. Neither is used for tracking or advertising, and neither is shared with any third party.

When you subscribe, our embedded checkout page (/checkout) also loads Stripe's own JavaScript, which sets first-party fraud-prevention cookies (__stripe_mid, __stripe_sid) used by Stripe to detect fraudulent payments. These are set and controlled by Stripe, not us — see Stripe's Cookies Policy for details.

We may use Vercel Web Analytics and/or Vercel Speed Insights to understand aggregate usage and performance. As currently offered by Vercel, these tools do not use cookies or persistent identifiers. If we adopt additional analytics, monitoring, or advertising tools in the future that do use cookies, we will update this policy and, where required by law, request your consent before doing so.

Data retention & deletion

We retain your data for as long as your account is active. If you'd like your account and associated data deleted, contact us and we'll process the request.

Children's privacy

The Service is not directed at children under 18, and we don't knowingly collect personal information from them. If you believe a child has provided us information, contact us and we'll delete it.

Your rights

If you're in the EU or UK, the GDPR gives you rights to access, correct, delete, or export your personal information, and to object to certain processing. If you're a California resident, the CCPA gives you similar rights, including the right to know what personal information we hold and to request its deletion; as stated above, we don't sell personal information. Contact us to exercise any of these rights.

International data transfers

Our hosting and database providers process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home country.

Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do.

Contact

Questions about this policy? Contact us.