Privacy Policy

Last updated: March 16, 2026

1. Information We Collect

Account Information

When you register, we collect your email address and a hashed password. We never store plaintext passwords.

Financial Data

You may choose to enter portfolio holdings, account balances, transactions, and budget information. This data is stored in our database to provide the Service.

Third-Party API Keys

If you connect integrations (e.g., Coinbase), your API credentials are encrypted at rest using Fernet symmetric encryption before storage.

Usage Data

We collect basic request logs (IP address, user agent, timestamps) for security and performance monitoring.

2. How We Use Your Information

To provide and maintain the Service
To process subscriptions via Stripe
To send password reset and account verification emails
To improve Service reliability and performance

3. Data Sharing

We do not sell, rent, or share your personal or financial data with third parties, except:

Stripe: processes subscription payments (receives only billing-related data)
Email provider: sends transactional emails (receives only your email address)
Legal obligations: if required by law or valid legal process

4. Data Security

Passwords are hashed with bcrypt
Sensitive API keys are encrypted at rest (Fernet)
Session cookies are Secure, HttpOnly, and SameSite=Lax in production
CSRF protection on all mutating endpoints
Rate limiting on authentication endpoints

5. Data Retention

Your data is retained as long as your account is active. If you delete your account, all associated data will be permanently removed within 30 days.

6. Your Rights

You can:

Export your portfolio data at any time
Delete individual holdings, transactions, or accounts
Request full account deletion by contacting support

7. Cookies

We use a session cookie for authentication. We do not use advertising or third-party tracking cookies.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify users of material changes via email or an in-app notice.

9. Contact

For privacy-related questions, email [email protected].