How We Handle Your Data
We know you’re trusting us with important information—including investment data. This page explains how we handle your data in plain language. For complete legal details, see our Privacy Policy.Our Data Philosophy
- Collect only what we need — No data hoarding “just in case”
- Protect everything we have — Your security is a priority
- Be transparent — You should understand what happens with your information
What Data We Collect
Data You Give Us
Data We Collect Automatically
Data from Connected Services
Brokerage via Secure Connection: [REVIEW REQUIRED: Confirm data fields]- Holdings/positions — Display portfolio
- Cost basis — Calculate gains/losses
- Transaction history — Track performance
What We DON’T Collect
- Social Security numbers
- Full credit card numbers (Stripe handles payments)
- Brokerage login credentials
- Bank account numbers
- Tax identification numbers
- Government IDs
How We Protect Your Data
Encryption
- In Transit: TLS/HTTPS encryption (same as banks)
- At Rest: AES-256 encryption in databases
Access Controls
- Only authorized employees access user data
- Access limited to job necessity
- All access logged and audited
Infrastructure Security [REVIEW REQUIRED: List certifications]
- Secure cloud infrastructure
- Regular security audits
- Automated threat detection
- DDoS protection
Password Security
- Never stored in plain text
- Hashed using bcrypt
- Two-factor authentication supported
How We Use Your Data
- Provide Service: Display portfolios/watchlists, power AI, send alerts, process payments
- Improve Service: Analyze usage (anonymized), fix bugs, develop features
- Communicate: Updates, support, marketing (opt-in only), security alerts
AI Training [REVIEW REQUIRED: Legal review]
We may use anonymized conversation data to improve AI. Before training:- PII is removed
- Data is aggregated
- Safeguards prevent memorization
Who Can Access Your Data
Our Team
- Customer support (to help you)
- Engineering (to fix issues)
- Security (to protect against threats)
Service Providers [REVIEW REQUIRED: List all processors]
All partners contractually required to protect your data.
We Never Sell Your Data
We do not sell, rent, or trade your personal information.Brokerage Connection Security
How Brokerage Connection Works
- You enter credentials directly with our secure connection service (not us)
- The service verifies identity with your brokerage
- It provides us a secure token
- We fetch read-only portfolio information
What We CAN’T Do
- Make trades in your account
- Transfer money
- Change brokerage settings
- Access your password
Disconnecting
Disconnect your brokerage anytime in Portfolio settings. [REVIEW REQUIRED: Add link]Payment Data Security
How Stripe Works
- Card details go directly to Stripe
- We only see last 4 digits
- Stripe is PCI DSS Level 1 certified
What We Store
- Billing name/address (for invoices)
- Card type and last 4 digits (for display)
- Transaction history
What We Don’t Store
- Full card numbers
- CVV/security codes
- Bank account numbers
Your Data Rights
- See Your Data: View in settings or download a copy
- Correct Your Data: Update anytime in account settings
- Delete Your Data: Delete your account anytime
- Control Communications: Manage in notification settings