Privacy Policy

1. Information we collect

• Account information: username, email address, a securely hashed password, and any optional profile details you choose to save (such as your full name or timezone). We never store your password in plain text.
• Trading data you provide: trades, positions, notes, and CSV imports you add to your ledger.
• Broker API credentials: if you connect a brokerage account, your API tokens are stored encrypted at rest and used to retrieve account data and market data. We never see or store your brokerage username/password.
• Broker-derived data: when you use the broker workspace, the positions and order history retrieved from your connected broker are also stored, so reconciliation and history features keep working across sessions.
• Billing information: payments are processed by Stripe. We never receive or store your card number. We store subscription status and Stripe identifiers needed to manage your plan.
• Technical data: session cookies (essential, used only to keep you signed in), session records that include your browser's User-Agent string (to help you and us recognize sessions), and standard server logs (IP address, timestamps) for security and debugging. We do not use advertising trackers.

2. How we use information

To operate the Service: authenticate you, store and display your trading data, fetch market data for symbols you track, process subscription billing, prevent abuse, and communicate service or billing notices. We do not sell your personal information, and we do not use it for third-party advertising.

3. Third-party services

• Stripe (payments and billing portal) — your payment details are handled under Stripe's privacy policy. To create and link your billing account, we share your email address, username, and internal account id with Stripe.
• Market and reference data — requests to Finnhub use our own key and carry only ticker symbols, not your identity. If you connect Tradier, quote and price-history requests are made with your stored token, so they are associated with your brokerage account like any request you make through your broker.
• Your connected broker (e.g. Tradier) — if you store broker API credentials, we make authenticated, account-identified requests to that broker on your behalf to retrieve your own positions, orders, and balances. This traffic goes to your broker, which already holds that data; it is governed by your agreement with them.
• Railway (cloud hosting, USA) — our servers and database run there.
• Content delivery networks — some pages load static assets (charting libraries, fonts) directly from CDNs such as jsDelivr and Google Fonts; as with any web asset, those providers see your IP address and standard request metadata when your browser fetches them.

4. Data retention and deletion

Your data is retained while your account is active. If you cancel, your data remains so you can return, unless you request deletion. To delete your account and personal data, email us at the address below; we will remove your personal data from our live systems within 30 days, except records we must keep for legal, tax, or accounting purposes. Copies may persist briefly in compressed database backups held with our hosting infrastructure, which age out automatically under our backup retention schedule (typically about 30 days).

5. Security

Passwords are hashed; broker API credentials are encrypted at rest; traffic is encrypted in transit (HTTPS); user data is isolated per account. No system is perfectly secure — please use a strong, unique password.

6. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from them.

7. Changes to this policy

We may update this policy; material changes will be announced on the site or by email.

8. Contact

Privacy questions or deletion requests: [email protected].

INVEST & DEVELOP GROUP LLC, Homestead, Florida, USA.