What we store
- Your account: your email address and, if you set one, a hash of your password (Argon2id — the password itself is never stored). If you sign in with Google we receive your Google account identifier, name, email address and profile picture. Any profile details or photo you add.
- What you create: watchlists, notes on stocks, saved screens and table layouts, and the alert rules you set.
- Your portfolio, if you use it: the shares, dates and amounts you type in or approve from an uploaded file. The file itself is read and discarded; only the rows you confirm are saved. Only you can see these entries — no staff screen shows them. Each weekday evening we check them to write notices for you (such as a dividend coming up or a large move); notices are deleted after six months. We count how often you open the page, upload a file or add an entry, without recording any of the contents.
- Security records: each sign-in session and security event (a sign-in, a password change, a failed attempt) records the IP address and browser details it came from, so that misuse can be detected and investigated.
Where it is kept, and who else handles it
Account data is stored on our own server, hosted by Hostinger, and we do not sell, rent or share it with advertisers or data brokers. Two other services handle a small part of it:
- Email delivery (Resend): your email address and the message, to send sign-in emails, password resets and the alert emails you ask for.
- Google: only if you choose to sign in with Google.
Market-data providers are asked for prices only; they are never told who you are or what you hold.
Cookies and browser storage
One cookie keeps you signed in (HTTP-only, so page scripts cannot read it), and a short-lived one protects a Google sign-in while it is in progress. Your browser’s local storage holds display preferences, such as light or dark theme. There are no advertising cookies, tracking pixels or third-party analytics.
How long it is kept
- Account data and what you create: until you delete it or delete your account.
- Portfolio notices: six months.
- Expired sessions and sign-in links: removed automatically.
- Security records: kept after an account is deleted — with the account’s internal number, IP address and browser details, but not its email address — so that misuse can still be investigated.
- Backups: the database is backed up nightly and the last 14 backups are kept, so deleted data can remain in a backup for up to about two weeks (and in the hosting provider’s weekly server backup) before it is overwritten.
Your choices
- Correct or delete your profile, watchlists, alerts and portfolio entries at any time in the app.
- Delete your account from your profile’s security settings. This permanently deletes your account and everything you created — watchlists, notes, alerts, saved screens and portfolio.
- Ask for a copy of the data we hold about you, or for help with any of the above, by writing to compliance@equitywise.io. See Contact & grievances for how we handle a request.