Privacy Policy

Information We Collect

Account information includes your first name, email, authentication and session information, display name, settings, and your age-eligibility and policy-acceptance statements. Supabase processes passwords and email verification/recovery codes for authentication. Our financial-record tables do not store those passwords or codes.

You may enter spending, subscriptions, budgets, tags, descriptions, notes, trades, holdings, cash activity, brokerage reconciliation evidence, saved calculations, and hypothetical portfolios. We store the records and resulting calculations needed for the features you use. Competition records include membership, display names, simulated orders, balances, and results.

If you supply market-data API keys, they are stored for server-side provider requests and can be accessed by authorized server processes. We do not display saved key values back to you. Do not submit bank passwords, Social Security numbers, payment-card numbers, or unrelated sensitive information. We do not collect a birth date or identity document for the 13+ checkbox.

Hosting, authentication, and email systems process operational information such as IP addresses, request and delivery information, device/browser information, timestamps, and security logs. Support correspondence and privacy requests contain the information you provide. We do not add IP addresses or browser fingerprints to the app's policy-acceptance receipt.

Imports and Sources

Information comes from you, your use of the service, authentication and infrastructure providers, and market-data providers. CSV tools parse supported records. Brokerage reconciliation uploads are processed on the server, and the app retains bounded normalized evidence, hashes, masked labels, and comparison results rather than storing the raw upload as a document. Infrastructure may retain operational logs. Review imported data and remove unnecessary sensitive details before submitting files.

How We Use Information

We use information to authenticate accounts, maintain your records, calculate and display your requested analyses, operate competitions, retrieve market data, save preferences, send verification/recovery messages, prevent misuse, resolve errors, respond to requests, and meet legal obligations. Automatic price refresh uses your stored symbols and enabled settings; it does not execute real trades.

Agreeing to the Terms and acknowledging this notice is not consent to unrelated advertising or new uses of sensitive information. We will provide any notice or separate choice required before materially different processing.

Sharing and Service Providers

Supabase provides authentication and database services; Vercel provides application hosting; our configured email delivery provider handles account emails. Authorized service providers and support personnel process information needed to operate and secure the service. Market-data requests send symbols, query parameters, and the applicable API credential to Finnhub or Twelve Data. We do not need to send your spending ledger or brokerage account number to obtain a quote.

Other members of a competition can see your competition display name and aggregate leaderboard results. They are not given your email or personal financial records through that leaderboard. Use a non-identifying nickname if you prefer.

We may disclose information when legally required, to address fraud or security, or to protect legal rights, subject to applicable law. If operation of the service is transferred, any transfer of personal information must remain subject to applicable protections and required notice. We do not sell personal information or share it for cross-context behavioral advertising, and the app does not serve targeted advertisements.

Cookies, Storage, and Tracking Choices

Authentication uses essential session cookies. The interface may store local preferences used by the version of the app you access. Blocking essential cookies can prevent sign-in. The app does not install advertising pixels or use cross-site behavioral tracking. Hosting and authentication providers still process operational requests and security information.

Because we do not sell or share information for behavioral advertising or track you across unrelated sites for that purpose, a Global Privacy Control or Do Not Track signal does not change those practices. If our practices change, we will update this notice and implement choices required by law before the change. We do not authorize third parties to collect information through this app for cross-site advertising.

Retention and Deletion

We retain active account and financial records to provide your saved history and requested features. Deleting an individual record may be restricted where it anchors an accounting correction or competition history; contact us for account-level requests. We evaluate deletion requests across account data, provider keys, competition links, and relevant service providers rather than treating removal from a screen as complete erasure.

Retention depends on the record's purpose, account status, security needs, dispute handling, and legal requirements. Limited records may be retained when necessary for a lawful reason, including evidence of policy acceptance or request fulfillment. Backup copies and operational logs may expire on a separate provider schedule and are not necessarily erased immediately. We will explain applicable exceptions rather than promise instant or unconditional deletion. Information restored from a backup must remain subject to completed deletion requests.

Your Requests and Choices

Use Privacy Requests in Settings, available even if you decline updated terms, or email personal.finance.dashboard@gmail.com to request access, a copy, correction, deletion, or information about our practices. You may also contact us without an account. Existing Settings CSV exports cover spending, subscriptions, and trade-journal records; they are not an export of every category we hold.

A request receipt confirms submission, not completed deletion or export. We may reasonably verify identity or an authorized agent's authority before disclosing or deleting data. Provide only the information needed for verification; do not send passwords, OTPs, full account numbers, or API keys. We respond within applicable legal deadlines and explain a denial or permitted extension. You may reply to appeal a decision or contact the privacy authority where you live. We do not retaliate for exercising a legally protected privacy right.

Depending on applicable law, your rights may include access, correction, deletion, portability, and choices about certain processing. Those rights and exceptions vary by location and whether a law applies to the service. This notice does not claim that every state's comprehensive privacy statute applies to every account.

Young Users and Schools

The service is intended for people 13 and older. Do not register if you are under 13. If you believe we have collected information from someone under 13, contact us so we can investigate, restrict further use as appropriate, and address deletion or other legally required action. The age checkbox is self-attestation, not identity verification.

Student participation does not by itself mean a school has authorized the service. School-sponsored use may require separate agreements and procedures. Do not upload education records about other students without authority. This policy does not claim that a student's checkbox is parental consent or that the service is certified under an education privacy law.

Security and Processing Locations

We use access controls and technical safeguards designed to protect information, including authenticated access and database ownership restrictions. No system can guarantee absolute security. The operator and authorized providers may access information for the purposes in this notice. This is not an end-to-end encrypted personal vault.

The service is operated from California using cloud providers; information may be processed in the United States and other locations where authorized providers operate, subject to applicable obligations. Contact us for questions about a particular request or processing arrangement.

Changes and Contact

We date and retain versions of this notice. We will provide an in-app notice of material changes and any additional notice or consent required by law. A changed policy does not retrospectively authorize a use that was unlawful when information was collected. Contact Amogh Bhat at personal.finance.dashboard@gmail.com for privacy, accessibility, security, or legal questions.