Privacy and data handling

What the app stores

• From Google: your name, email address and profile photo. No Google tokens are kept after sign-in.
• Your portfolio: the operations and positions from the XTB files you upload, plus your settings.
• Optional: Slack or Discord webhook addresses, alert rules and the public page settings, if you use them.

How it is protected

• Your whole portfolio is compressed and encrypted with AES-256-GCM before it is stored. The encryption key is kept separately from the data.
• Webhook addresses are encrypted the same way and never shown again after you save them.
• Everything is stored on servers in Europe.
• Sessions use signed cookies, and every change to your data is checked for the same origin.

Your controls

• Download a full JSON backup of your portfolio at any time.
• Delete an account from the portfolio, or delete everything together with your user account.
• Signing out also clears the market data cached in your browser.

What happens in your browser

XTB files are read in your browser; only the parsed operations are sent to the server. Market data comes through the app's own server from Yahoo Finance, Stooq and NBP, so your browser does not talk to those services directly. Those services only receive instrument symbols and currency codes, never your positions or amounts.

This website

This landing page is a static site on GitHub Pages. It sets no cookies, runs no analytics and loads its fonts from its own address. GitHub, as the host, may keep standard server logs.