Your trade history is the most private thing here.

One thing leaves, in one situation: a question you ask the copilot. It travels to Anthropic's API together with the portfolio figures needed to answer it — the symbols, quantities and metrics the question touches. Nothing else in the product sends anything anywhere.

If that is not acceptable to you, do not use the copilot. Every metric, every chart, the reconstruction, the simulator, the builder and the import work without it, and they are the part that does the actual computing.

Market prices come in, they do not go out. Fetching a price tells the data provider that somebody asked about that symbol; it does not tell them who, how much you hold, or that you hold any.

Your email, an Argon2 hash of your password, your portfolios and your trades. That is the list.

Your password is not one of them. A hash is the result of a function that is easy to compute forwards and infeasible to reverse, so signing you in means repeating the operation and comparing results — the system checks a password it never knows. If this database were stolen, what would be stolen is hashes.

This is also why nobody can send you your password, us included. The only thing on offer is replacing it, and that is what the reset link does.

Only you. Ownership is part of the database query itself rather than a check performed afterwards, which means there is no code path that returns another account's portfolio — including by changing the number in a URL. There is an automated test that proves exactly that, and a second one proving the copilot acts as the person asking rather than as the server.

Your session lives in a cookie that is signed, marked HttpOnly so no script on the page can read it, and SameSite so another site cannot make your browser use it. The honest limit: a signed cookie cannot be revoked from the server, so a stolen one stays valid until it expires — two weeks. Signing out on every device would need sessions stored in a table, and that is the change to make the day real money is involved.

Everything you put in, you can take out as a CSV — the same shape the importer reads, so it goes into another tool or back into this one without editing.

Deleting your account deletes your trades and your portfolios. Not "marks them as deleted": removes the rows. What survives is what accounting law requires a business to keep about a payment, which is the payment record itself and not your holdings.

Both are in your account settings ›

• Anthropic — processes copilot questions and the portfolio figures needed to answer them. Only when you ask something.
• Yahoo Finance and SEC EDGAR — market prices and company filings. They receive symbol requests, never anything about you.
• Stripe — payments, if you buy a plan. Card details go to Stripe directly and never touch this server; what comes back is that a payment happened.

There is no analytics script, no advertising pixel and no third-party tracker on any page of this site. That is unusual enough to be worth stating, and it is checkable: open your browser's network tab.