Your trade history is the most private thing here.

The big one is a question you ask the copilot. It travels to Anthropic's API together with the portfolio figures needed to answer it — the symbols, quantities and metrics the question touches — and the earlier messages of that conversation, the last 20 at most. Your browser holds that conversation, not our database: we do not keep your questions or its answers.

If that is not acceptable to you, do not use the copilot. Every metric, every chart, the reconstruction, the simulator and the import work without it, and they are the part that does the actual computing.

Email goes through Resend. When we send you one, your address and that message pass through Resend, the service that delivers our mail. There are four kinds: the password-reset link when you ask for it, the weekly summary if you turn it on (it carries the week's figures for your portfolios), a single reminder a week before the launch offer on your account ends and, if you connect an account, one reminder for each token in the last two weeks before it expires. We send nothing else.

Three more things leave only when you start them. A payment goes to Stripe; a connected account sends that platform the read-only key you pasted; and a market data key of your own sends Alpaca the symbols of your holdings. “Who else receives data”, below, says what each one gets.

Market prices come in, they do not go out. Fetching a price tells the data provider, Yahoo Finance, that somebody asked about that symbol; it does not tell them who, how much you hold, or that you hold any. The public sources our server reads — the SEC, the U.S. Treasury, the Federal Reserve, the European Central Bank and the US statistics offices BLS and BEA — get requests that say nothing about you either.

The site runs on Fly.io, which sees the IP address of everyone who opens a page: that is how a page reaches you. Our own server keeps no access log, so no line is written for each page you open. The limits that slow down password guessing and sign-up floods remember your address in memory only, for as long as their window lasts (an hour at most), and a restart empties them.

Your email, an Argon2 hash of your password, your portfolios and your trades. Beside those, the account keeps the name you may have set, your plan and when it ends, the payment provider's customer reference if you buy a plan, the date you last opened the home page or a portfolio, your weekly-summary setting with the language of our emails and, if you add one, your market data key, stored encrypted.

Your password is not one of them. A hash is the result of a function that is easy to compute forwards and infeasible to reverse, so signing you in means repeating the operation and comparing results — the system checks a password it never knows. If this database were stolen, what would be stolen is hashes.

This is also why nobody can send you your password, us included. The only thing on offer is replacing it, and that is what the reset link does.

Around those, the product also keeps, each tied to your account:

• The history of your ledger. Trades you removed stay in it, marked as removed, and a change log keeps one line for every trade recorded, imported or removed.
• The cash you record. If you track a portfolio's cash: its opening balance, money in and out, interest, fees and the cash side of each trade, with the notes you write. Stopping tracking keeps them marked, as removed trades are; deleting the portfolio or your account deletes them.
• Prices fetched with a key of yours. Whether it is your market data key or a connected platform's, they are stored under your name and used only for your portfolios.
• Each connected platform. Its read-only key, stored encrypted; the portfolio it feeds; when it last synced and how that went; and when its token ends, if the platform says.
• Payments. The plan and when it ends on your account, and a number for each notice we have handled from the payment provider, so a repeated notice changes nothing; never a card number.
• How you use it. The day you signed up, when your launch offer ends if you had one, when each reminder last went out so none is sent twice, and how many copilot questions you asked this month — a count, not the questions.

The tickers you choose for ISINs. When a file you upload names a security only by its ISIN, the ticker you type for it is remembered for your account only, so the next file does not ask again. It goes when you delete your account.

The shape of a file we do not read yet. If you choose to, when a file is not recognised we keep its column names and, if they are plain words such as Buy or Dividend, its transaction types — never its rows — to learn that broker's format. You see the exact list before you send it, it is not linked to your account, and nothing is kept unless you tick the box.

Visits are counted, not people. Each time a page is opened, one counter goes up for that day: which page, in which language, which site the visitor came from (the domain only, never the full address) and whether they were signed in. No cookie is set for it, no IP address or browser detail is kept, and nothing in it is linked to an account or to anyone's trades.

In your browser there are two cookies — a signed one that keeps you signed in (two weeks) and one that remembers the language you chose (a year) — and two settings in the browser's own storage: light or dark, and whether you closed the launch-offer banner. A third note, which tab you just pressed so that keyboard focus can go back to it, is kept only until the next page loads. Nothing else is kept there.

Optional, and read-only. You paste a read-only key you create at the platform. We never ask for a password, and nothing here can place an order or move money.

Platforms we connect to

• Binance Beta in testing, not open yet Your spot trades, deposits, withdrawals, Convert trades and Simple Earn rewards, for the 21 coins we measure. Your balances (Spot, Funding and Simple Earn) to check the ledger against. Cash balances, margin, futures and options are not read. A deposit or a withdrawal is recorded as a move, not as a purchase or a sale of yours.
• Bitget Beta in testing, not open yet Your Bitget spot trades of the last 90 days (Bitget gives an API key nothing older), your deposits and withdrawals since then, and the balances of your spot and funding accounts. Coins in Earn, bots, margin or futures are not counted. What you held before comes in as one opening row per coin, worked out from your balances, dated the first day read and valued at that day's market price, not at what you paid. A deposit or a withdrawal is recorded as a move, not as a purchase or a sale of yours. The passphrase you chose is stored encrypted with the key and deleted with it.
• Interactive Brokers Beta Trades, open positions, daily prices and splits, from the Flex report you create.
• KuCoin Beta in testing, not open yet Your KuCoin spot trades of the last 7 days (KuCoin gives an API key nothing older), your deposits and withdrawals since then, and the balances of your main and trading accounts. Earn, margin and futures accounts and staking rewards are not read. What you held before comes in as one opening row per coin, worked out from your balances, dated the first day read and valued at that day's market price, not at what you paid. A deposit or a withdrawal is recorded as a move, not as a purchase or a sale of yours. The passphrase you chose is stored encrypted with the key and deleted with it.

All the details

• Trades and prices are marked with where they came from, so they can be told apart from what you typed or uploaded yourself. The prices are stored under your name and used only for your portfolios.
• Splits are public facts about a company and are kept in a shared table, apart from your account.
• The opening row also covers shares that were moved into your account without a trade. It is dated the first day of the statement and marked as imported, like the rest.
• Deleting on disconnect removes the trades, their entries in the change log and the prices they brought that none of your other portfolios still needs. Keeping leaves them marked, to delete later from the same place.
• If deleting would leave a sell you typed larger than the purchases that remain, we list those sells first and remove them only if you leave the box ticked. Like any trade you delete, they stay in the change log until you delete your account.
• Where a platform's terms require it, deleting is not optional.
• Deleting your account deletes the key, the imported trades, the change log and the prices stored under your name.

Only you. Ownership is part of the database query itself rather than a check performed afterwards, which means there is no code path that returns another account's portfolio — including by changing the number in a URL. There is an automated test that proves exactly that, and a second one proving the copilot acts as the person asking rather than as the server.

The operator of Sphinx Risk can see the list of accounts. To run the service, a private page shows them, for each account, the email, the name (if you set one), the sign-up date, the last time the home page or a portfolio was opened, the plan and the number of portfolios, and it is shown to no one else.

The operator also sees weekly totals of sign-ups and use: how many accounts were created each week and how many of them added a portfolio, recorded a first trade, turned on the weekly email, asked the copilot or came back. They are counts, never a list of people, and they are shown to no one else.

Your session lives in a cookie that is signed, marked HttpOnly so no script on the page can read it, and SameSite so another site cannot make your browser use it, and it lasts two weeks. Other sessions can be ended from the server: changing your password, resetting it, or pressing “Sign out of other devices” in your settings ends every other session at once, so a cookie copied to another device stops working.

Everything you put in, you can take out as a CSV — the same shape the importer reads, so it goes into another tool or back into this one without editing.

Deleting your account deletes everything in it: your portfolios and their trades (the ones you removed from the ledger too), their change log, their shared pages, the keys of the brokers you connected and what they brought in, your market data key with the prices fetched with it, and the tickers you chose for ISINs. Not "marks them as deleted": removes the rows. If a subscription of yours still renews, nothing is deleted until you cancel the renewal in the billing portal; if Stripe cannot tell us whether it renews, nothing is deleted either, and you can try again. What survives is the record of what you paid, which Stripe keeps as the seller because accounting law requires it — not your holdings.

Backups keep a copy for a limited time. The database is backed up, encrypted, so the service can be recovered after a failure. Deleting your account does not reach into those copies: they expire on their own schedule, and until they do they still hold what the database held on the day each was taken.

Deleting one portfolio from your settings removes its trades, its change log, its shared page and the keys of the brokers connected to it, and leaves your other portfolios as they were.

Both are in your account settings ›

• Anthropic — processes copilot questions: your question, the earlier messages of that conversation (20 at most) and the portfolio figures the copilot reads to answer it. Only when you ask something; never your email, your password or your keys.
• Resend — delivers our email. It receives your address and the message, in the four cases described under “What leaves, and when”.
• Stripe — payments, if you buy a plan. Stripe is the merchant of record: it is legally the seller, charges the card, handles tax and issues your invoice. Card details go to Stripe directly and never touch this server. It receives your email the first time you pay and a number of ours that ties the payment to your account; what comes back is that a payment happened, for which plan, and until when. If you delete your account, we also ask it whether a subscription of yours still renews.
• Alpaca — only if you connect your own data key. It receives the symbols of your holdings, authenticated with your key; nothing else about you. Your key is stored encrypted, and disconnecting deletes it together with every price fetched with it.
• Binance — only if you connect your account. It receives the read-only key you give us, and sends back your trades and transfers; we send it nothing else about you. Disconnecting deletes the key.
• Bitget — only if you connect your account. It receives the read-only key you give us, and sends back your trades and transfers; we send it nothing else about you. Disconnecting deletes the key.
• Interactive Brokers — only if you connect your account. It receives your read-only token and your Flex Query ID, and sends back your statements; we send it nothing else about you. Disconnecting deletes the token.
• KuCoin — only if you connect your account. It receives the read-only key you give us, and sends back your trades and transfers; we send it nothing else about you. Disconnecting deletes the key.
• Yahoo Finance — prices, exchange rates and the basic details of a security. It receives the symbols and currency pairs our server asks about, and the ISIN of a fund or share you type so that its listings can be found, never who asked or what you hold.
• Public sources — the SEC (EDGAR), the U.S. Treasury, the Federal Reserve, the European Central Bank, the Bureau of Labor Statistics and the Bureau of Economic Analysis. Our server reads filings, rates, calendars and releases from them; the requests name a company, a fund or a date, never you.
• IndexNow — the notice board search engines share. When a public page of ours changes, such as a company's, we send it that page's address; it receives nothing about you.
• Fly.io — hosts the site, in Frankfurt, and the database with its encrypted backups. It sees the IP address of every visitor in order to serve the page.

There is no analytics script, no advertising pixel and no third-party tracker on any page of this site. That is unusual enough to be worth stating, and it is checkable: open your browser's network tab. Your browser talks to this site and to nobody else: the typeface, the charts and the page scripts are served from here.