Privacy Policy

Last updated: August 2, 2026

This is standard-form template language, not a substitute for review by a licensed attorney in your jurisdiction. Data-protection obligations vary significantly by region (GDPR in the EU/UK, CCPA/CPRA in California, etc.); have this reviewed and tailored to the jurisdictions you actually operate in and to your final data-processing setup before publishing.

1. Overview

This Privacy Policy explains what information Portfolio OS (the "Service") collects, how it is used, and the choices you have. It should be read together with our Terms of Service. By using the Service you agree to the practices described here.

2. Using the Service as a Guest

You can use most of the Service without creating an account. In guest mode:

The holdings you enter are stored only in your own browser (via localStorage). They are not transmitted to or stored on our servers, and are used solely to compute analytics that are returned to your browser.
Clearing your browser data removes them. They do not sync across devices.
Requests to compute analytics do send the list of tickers/quantities you entered to our server so it can calculate the result, but we do not persist that payload against your identity.

3. Information We Collect When You Create an Account

Account data: your email address and a securely hashed password (we store a one-way hash using a modern password-hashing algorithm — we never store your plaintext password).
Portfolio data: the holdings, transactions, and watchlist items you choose to save. This is stored server-side so it persists across sessions and devices.
Subscription data: your plan status and, if you subscribe, a payment-processor customer identifier. We do not collect or store your full card number — payment card data is handled entirely by our third-party payment processor.

3a. Feedback You Send Us

If you use the in-app feedback box — available to guests and account holders alike — we store:

the message you write and the category you select;
an email address only if you choose to provide one. It is optional and used solely to reply to you; leave it blank to send feedback anonymously;
your account identifier, but only if you happen to be signed in when you send it.

We do not store your IP address on the feedback record. This data is used only to understand and act on your feedback and is retained no longer than necessary for that purpose.

4. Information Collected Automatically

Technical/usage data: IP address, request metadata, and coarse geolocation derived from IP, used for security (rate limiting, abuse prevention) and basic operational visibility.
Cookies / local storage: we use browser storage for essential functionality (e.g. keeping you signed in, remembering your holdings in guest mode, and recording your ad-consent choice).
Advertising (free tier): the free tier is ad-supported. Before any advertising cookies or ad-network scripts load, we ask for your consent via an in-app banner. If you decline, we do not load tracking-based ads. Paid subscribers and administrators see no ads at all.

5. How We Use Information

To provide the Service — compute and display your analytics, save your portfolio, and authenticate you.
To operate the paid tier — process subscriptions and enforce plan entitlements.
To secure the Service — detect and prevent abuse, fraud, and unauthorized access.
To improve the Service and, on the free tier and with your consent, to show advertising.

We do not sell your personal information.

5a. Legal Bases for Processing (EEA / UK)

Where the EU or UK GDPR applies, we rely on the following legal bases for the processing described above:

Performance of a contract — creating and operating your account, saving your portfolio, and providing the paid tier (Art. 6(1)(b)).
Legitimate interests — securing the Service against abuse and fraud, basic operational visibility, and understanding and acting on feedback you send us, each balanced against your rights and freedoms (Art. 6(1)(f)).
Consent — loading advertising or other non-essential cookies on the free tier, which we request through the in-app consent banner and which you may decline or later withdraw at any time (Art. 6(1)(a)).
Legal obligation — retaining limited records where the law requires us to (Art. 6(1)(c)).

You may object to processing based on legitimate interests at any time (see "Your Rights and Choices").

6. Third-Party Services

Payment processing: subscription payments are handled by a third-party processor subject to its own privacy policy; we receive only the confirmation and identifiers needed to manage your subscription.
Advertising networks (free tier, with consent): may set cookies and process data per their own policies.
Market and reference data: the Service fetches prices, ETF constituents, macro indicators, and prediction-market data from third-party providers. These are outbound data requests we make to build analytics; we do not send your personal information to them.
Hosting/infrastructure: the Service runs on third-party cloud infrastructure that processes data on our behalf.

7. Data Sharing

We share personal information only: with service providers acting on our behalf (hosting, payment processing, advertising) under appropriate terms; when required by law or to protect rights and safety; and in connection with a business transfer (merger, acquisition, or asset sale), with notice as required.

8. Data Retention

We retain account and portfolio data for as long as your account is active. If you delete your account, we delete or de-identify your personal data within a reasonable period, except where we must retain limited records to meet legal, tax, or security obligations. Feedback you sent while signed in is deleted along with your account; feedback sent anonymously contains no identifier that can be linked back to you, so it cannot be individually retrieved or deleted on request. Guest-mode holdings live only in your browser and are never retained by us. Technical/usage logs (including IP-derived data) are kept only for a short operational window and then expire automatically.

9. Your Rights and Choices

Access, correction, deletion: you may request access to, correction of, or deletion of your personal data by contacting us, subject to applicable law and identity verification.
Account deletion: you can request deletion of your account and associated portfolio data.
Advertising/cookies: you can decline ad consent in the app, and control cookies through your browser settings.
Regional rights: depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have additional rights, including to object to or restrict processing, to data portability, and to lodge a complaint with a supervisory authority.

10. Security

We use reasonable technical and organizational measures to protect your data, including one-way password hashing, encrypted transport (HTTPS) in production, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Service is not directed to, and may not be used by, children. We do not knowingly collect personal information from anyone under the age required to form a binding contract in their jurisdiction (and in no case under 13). If you believe a child has provided us information, contact us and we will delete it.

12. International Users

The Service may process and store data in countries other than your own, whose data-protection laws may differ. Where required, we implement appropriate safeguards for such transfers.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by other reasonable means, and the "Last updated" date above will change. Continued use after an update constitutes acceptance of the revised Policy.

14. Contact

Questions or requests regarding this Policy or your data: [CONTACT EMAIL].