Privacy Policy

Who We Are

PortfolioTrackr ("we", "us", "our") is a personal investment portfolio tracking service available at portfoliotrackr.com. It is built and operated by Web Marketing Wave FZ-LLC, FDAM0795, Compass Building, Al Shohada Road, Al Hamra Industrial Zone, Ras Al Khaimah, United Arab Emirates, which is responsible for your personal data. We are committed to protecting your personal data and respecting your privacy.

If you have any questions about this policy, contact us at [email protected].

Data We Collect

We collect only the data necessary to provide the Service:

• Account data, your name and email address when you register. If you sign in with Google or Apple, we receive your name, email address and an account identifier from them
• Portfolio data, investment positions, trade history, price targets, and notes you enter
• Notification preferences, phone numbers, Telegram chat ID, the push-notification tokens for your browser and phone, and the alert settings you configure
Broker connection credentials, when you connect Alpaca, Bybit or Interactive Brokers directly, the access token or API key you authorise is stored encrypted on our servers and used only to read your positions and trade history. We never see your broker password. Brokers connected through SnapTrade are described in Section 04
• Payment & subscription data, subscription status and billing dates. We do not store card details. Payments made on our website are handled by Stripe. Purchases and subscriptions made inside our iOS or Android app are processed by Apple (App Store) or Google (Google Play) respectively, under their own payment terms and privacy policies; we receive only the purchase/subscription status needed to unlock your plan, never your payment-card details.
• Screenshot images, when you use the AI trade import feature, images you upload or paste are sent to our AI parsing service to extract trade data. Images are processed transiently and are not stored after parsing is complete
• Sign-in security data, if you turn on two-factor authentication (2FA): your authenticator key, one-time backup codes (stored hashed, like passwords), and a record of sign-in attempts. If you add a passkey we store only its public key and a device name — your fingerprint or face never leaves your device and is never sent to us or stored by us. All of this is deleted with your account
• Usage data, basic server logs including IP address and browser type for security and debugging, and the page or campaign that first brought you to us, so we know which of our own marketing works

How We Use Your Data

We use your data solely to provide and improve the Service:

• To operate your portfolio tracker and display your positions and performance
• To send price alerts and notifications you have opted into
• To manage your subscription and billing
• To send account-related emails such as verification, password reset, and subscription receipts
• To detect and prevent fraud or abuse

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Service.

Third Parties We Share Data With

We share minimal data with the following third-party services, only as required to operate the Service:

• Stripe, processes payments. Your card details go directly to Stripe and never touch our servers. Stripe Privacy Policy →
• Twilio, sends SMS alerts to the number you provide. Twilio Privacy Policy →
• Meta (WhatsApp Business Platform), delivers WhatsApp alerts to the number you provide. Meta receives your number and the alert text. Meta Privacy Policy →
• Google (Firebase Cloud Messaging), delivers push notifications to your phone and browser. Google receives your device's push token and the alert text. Firebase Privacy →
• Google and Apple (sign-in), only if you choose Sign in with Google or Sign in with Apple. They send us your name, email address and an account identifier. Google Privacy Policy →  ·  Apple Privacy Policy →
• Telegram, delivers alerts to your Telegram account via your chat ID. Telegram Privacy Policy →
• Anthropic (AI trade parsing & fundamental analysis), when you use the AI trade import feature (text, screenshot, or PDF), or the AI fundamental analysis feature on a position, the relevant content is sent to Anthropic's Claude API. For image and PDF trade imports, the entire uploaded file is transmitted to Anthropic in full, we do not extract or pre-process specific regions, so any account numbers, balances, names, addresses, or other personally identifiable information that is visible in your screenshot will also be sent. If you do not want a particular field processed, redact it locally before uploading. For text imports, only the text you paste is transmitted. For fundamental analysis, the ticker, your entry / target / stop-loss values, and publicly-available market data for that ticker are sent. Anthropic does not use API-submitted data to train its models per their commercial terms (E-004 update, 2026-05-26). Images and inputs are processed transiently and not retained on our servers. Anthropic Privacy Policy →
• SnapTrade (brokerage connections), when you link a brokerage account to automatically import your holdings and trades, your connection is established and maintained through SnapTrade, a third-party financial data aggregator. SnapTrade securely handles the brokerage authentication and retrieves your positions and transaction history on your behalf; we store only the resulting holdings data and an encrypted connection reference, never your brokerage login credentials. Alpaca, Bybit and Interactive Brokers connect to us directly, not through SnapTrade; the access token or API key involved is stored encrypted on our servers, as described in Section 02. SnapTrade Privacy Policy →
• Market data providers, Yahoo Finance, CoinGecko and Alpha Vantage receive the ticker symbols we need prices for. They never receive your identity, your holdings or their size.
• Our hosting and email provider, located in the United States, stores our database and relays the emails we send you.

We do not sell, rent, or share your personal data with any other third parties.

International Data Transfers

Our servers and most of the third-party processors listed in Section 04 are located in the United States. If you are accessing the Service from the European Economic Area (EEA), the United Kingdom, or another jurisdiction outside the United States, your personal data will be transferred to and processed in the United States, which may have data-protection laws different from those in your country.

For transfers of personal data out of the EEA or UK we rely on the following lawful safeguards under Article 46 of the EU GDPR (and the equivalent UK GDPR provisions):

• Standard Contractual Clauses (SCC), we rely on the European Commission's 2021/914 Standard Contractual Clauses as the legal basis for transferring personal data to processors located in countries without an EU adequacy decision. Each third-party processor we work with (Stripe, Twilio, Meta, Google, Apple, Anthropic, SnapTrade, our hosting provider) maintains SCCs as part of their Data Processing Agreement.
• EU-US Data Privacy Framework, where applicable, our US-based processors are certified under the EU-US Data Privacy Framework, providing an additional layer of safeguard.
• UK International Data Transfer Addendum (IDTA), for transfers from the United Kingdom, the UK IDTA addendum to the SCCs applies.

To request a copy of the safeguards we have in place for a specific transfer, email [email protected].

Data Retention

We retain your data for as long as your account is active. When you delete your account, it immediately enters a 14-day recovery grace period during which sign-in is disabled and you may restore the account from the confirmation email. After the 14-day grace period expires, everything held under your account, including portfolio positions, trade history, broker connections, notification preferences and sign-in security data, is permanently deleted from our systems. You may also request immediate deletion by contacting support.

Two kinds of record outlive the account: payment records, kept for as long as accounting and tax law require (Stripe, Apple and Google also keep their own transaction records under their own policies), and, if you were an affiliate, the payout records for commissions you earned. A deletion log entry records that the account was removed; it carries your name and email only when we removed the account ourselves, never when you did.

Anonymised aggregate data (such as total number of users per plan) may be retained for business analytics.

Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or UK, you have the following rights regarding your personal data:

• Access, request a copy of the data we hold about you
• Rectification, correct inaccurate data
• Erasure, request deletion of your data ("right to be forgotten")
• Portability, export your portfolio data via the export feature
• Objection, object to processing of your data

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Cookies

We use only our own first-party cookies. The session cookie and the “remember me” cookie (also set when you choose “Don’t ask again on this browser” at 2FA sign-in) each last 30 days. A few small cookies remember which sign-in method you used, which plan you clicked before signing up, which page or campaign first brought you here and, if you arrived through an affiliate or offer link, that link. We do not use advertising cookies, third-party analytics or third-party cookies of any kind. See our Cookie Policy for full details.

Security

We take reasonable technical measures to protect your data including HTTPS encryption, hashed passwords, and restricted database access. You can add 2FA to your account in Settings — a passkey (your fingerprint, face or screen lock) or an authenticator app. However, no system is 100% secure and we cannot guarantee absolute security.

Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or by updating the date at the top of this page. Continued use of the Service after changes constitutes acceptance.

Contact