Privacy policy.

Last updated 29 September 2026

What we collect

If you only read the site

This site sets no cookies, and loads no fonts, scripts or images from any other company — every request your browser makes while rendering these pages goes to this server and nowhere else. There is no Google Analytics, no advertising pixel and no third-party tag of any kind.

We do measure our own pages, and this is what that means. Your browser generates a random identifier the first time you arrive, keeps it in its own local storage, and sends it back to us with a small number of events — a page was viewed, a button was clicked. If you arrived from an advertisement, the campaign labels in that link (utm_source and the rest, and the click identifier the ad network adds) are stored alongside it, once, on your first visit. We use this to know which advertisements are worth paying for.

That identifier is not a cookie and is never sent automatically. It is random and holds no name in itself. If you later create an account we record which arrival it came from, so from that point the two are connected. Clearing your browser’s storage for this site removes it, and you become a new visitor.

We also record your IP address, the full description your browser sends of itself, and which link or button you clicked — on every page, not only the ones we have singled out. These are stored with the events above and kept for the same period. We use them to measure advertising and to understand how the site is used.

Some of this is sent to Meta (Facebook) to measure advertising. When you create an account, begin a checkout or buy something, we tell Meta that it happened. Your email address and name are converted to a one-way hash before they are sent — we do not send the address itself — and your IP address and browser description are sent as they are, because that is the form Meta accepts them in. This is sent from our server rather than by your browser: no Meta code runs on this site, and no advertising cookie is set here.

You can ask us not to do this. Write to the address at the foot of this page and we will exclude your account from it and delete what has already been recorded about you.

The server also keeps ordinary request logs, which include IP addresses, for a short period, to diagnose faults and to detect abuse.

If you tell us what you want to run

Your email address, and anything else you type into that form — optionally a name, a note, and which portfolio you were looking at. We also store a one-way hash of your IP address, not the address itself: enough to notice one machine submitting the form forty times, not enough to reconstruct who visited.

If you have an account

• your email address;
• a hash of your password — never the password;
• which portfolios you follow, the allocation you set, and the sub-account label you chose;
• hashes of your session and feed tokens, plus a short non-secret hint so you can tell which token your instance is holding;
• your IBKR authenticator key, only if you save one for automatic IBKR sign-in: stored encrypted, never shown back — no page returns it or any part of it — and removable at any time from Settings. With it we keep a record of when a sign-in code was handed to your instance and what your instance reported about it, but never the code itself;
• your Telegram chat id, if you link Telegram;
• timestamps: when you signed up, last signed in, and when your instance last read its feed.

If you connect an instance in cloud mode

Your instance can report its state to this hub so you can see it from a browser — what it is holding, what it has ordered, and whether it is connected. That is your choice: an instance in local mode reads its signals and reports nothing back. When it is on, this hub holds a cached copy of what your instance told it. Managed-account records and enabled portfolio reports are retained as described below.

On a managed machine, and only while you leave hub visibility switched on, that report includes your brokerage account’s identity, balances and holdings — its account number, whether it is a company or an individual account, whether it may trade on margin, its cash and net value, and the positions it holds. We keep a copy as it was when the account was first connected and a copy as it is now, so we can answer questions about your account without asking you to look them up. Only an administrator of this service can see it; it appears on no public page and in no other customer’s view. Switching hub visibility off in your own settings stops any further reporting; the record we already hold is marked as out of date and stops changing.

What we deliberately do not collect

• Your broker username and password. We do not request or store them; they stay on your own instance. The one brokerage credential we can hold is the IBKR authenticator key described above, and only if you save it for automatic sign-in. An optional IBKR Flex reporting token can be entered through account settings: the hub relays it to your instance without retaining it. The token is stored on that instance and used to retrieve reports, not to place orders.
• Your password. Only a hash of it, which cannot be reversed into the original.
• Usable tokens. Feed, session and ingest tokens are stored as peppered hashes. Report unsubscribe links are stored separately in encrypted email requests, with one-way hashes used to process unsubscribe requests. A lost account token is replaced by rotating it rather than by looking it up.
• Third-party analytics or tracking scripts. There are none. No pixel, no tag manager and no advertising network runs any code in your browser on this site, and nothing your browser loads while rendering these pages comes from another company. We do report conversions to Meta from our own server, and exactly what that sends is described under “If you only read the site” above. This item said we sent nothing to any advertising network; that changed on 13 September 2026 and this page changed with it.
• Payment card details. Card numbers are entered on Stripe's own checkout pages and never reach this service. We store only what Stripe tells us afterwards: which plan, whether it is active, and the identifiers needed to cancel or refund it.

Why we hold it

To operate the service you asked for: to sign you in, to deliver the portfolios you follow to your instance, to notify you about your own orders where you asked to be notified, to keep the service secure and available, and to reply to you. When portfolio reporting is enabled for your managed account, we also email your account values, investment results, portfolio details and, when available, relevant official announcements.

Administrators record your initial/net investment and confirm later deposits or withdrawals used in reports. Detected movements do not change those records without confirmation. Your instance retains valuation history; the hub retains the reports generated for you, the capital records and their audit history. Report contents and encrypted email requests are retained for 13 months. Minimal unsubscribe and suppression records remain so older unsubscribe links and delivery preferences continue to work. You can unsubscribe from reports without disabling the rest of your account.

We do not sell personal data, and we do not use it to build a profile of you for anybody else's purposes.

How it is stored

In a PostgreSQL database on a server we operate, reachable only through this site over HTTPS. Account tokens are stored hashed as described above. Prepared reporting emails, including their unsubscribe links, are encrypted with a separate encryption key. A saved IBKR authenticator key is encrypted with a key held outside the database, so a copy of the database alone cannot open it. Backups are encrypted.

Who else sees it

Resend processes the email address and message contents needed to send service emails, including enabled portfolio reports and inline value charts. We use delivery, bounce and complaint events to maintain delivery preferences; portfolio reports do not use open or click tracking.

Official news sources receive requests for public issuer announcements and market releases. We do not send them your identity, account values, position quantities or portfolio list.

Stripe, our payment processor, when you buy something: it receives your email address and the card details you type on its own pages, and it tells us which plan you took and whether it is active. We never see the card.

Telegram, in two ways, and the second is worth stating plainly. If you link your own chat, it necessarily sees the messages sent to you. Separately, we are notified there when an account is created or a plan is bought — those notifications name the email address involved, so Telegram processes it. They go only to the operator's own chats, never to any customer's.

The infrastructure providers who host the server. Where we use a language model to read a published research document, that document is a public or subscribed source; your personal data is not sent to it.

We disclose personal data to a third party only where the law requires it.

How long we keep it

• Account data: while your account exists, and for a short period afterwards so that a deletion can be reversed if it was a mistake.
• Early-access requests: until we have replied and you have decided, and then no longer than is useful. Ask and we will delete yours immediately.
• Session records: a revoked session is marked revoked rather than deleted, because the record of a login is part of the security history of an account. An operator can open a time-limited support session on an account; it is not shown on your Sign-ins list, and it is still a session row.
• Server logs: a short period, then discarded.
• How you arrived, and what you did here: the random identifier your browser generates, the campaign labels from the link you followed, the page you landed on, your IP address, the description your browser sends of itself, and the links and buttons you clicked are kept for 396 days — thirteen months, which is the shortest window that lets a campaign be compared with the same campaign a year earlier. After that the record is deleted automatically. Ask us to delete yours sooner and we will.
• Brokerage account records, on a managed machine: we keep two pictures of each account — one as it was when it was first connected, which does not change, and one as it is now, which is replaced each time your machine reports. We also keep a short list of the times your account’s type changed — whether it is a company or an individual account, and whether it may trade on margin. That list is not balances and does not grow with time; it records a handful of events over the life of an account, and we keep it for as long as the account is with us. Switching hub visibility off in your settings stops any further reporting. Ask us to delete these records and we will.

Your rights

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict how it is used, and to complain to your data protection authority.

Ask, and we will do it. There is not very much to send you.

Contact

Write to privacy@autoportfolios.ai.