Privacy policy

Effective October 6, 2026

This policy explains what information ShinyPortfolio (“we,” “us”) collects when you use shinyportfolio.com, what we do with it, who helps us process it, and how you can see or delete it. The short version: we collect what we need to run the tools you use, we never sell your information, and you can delete your account and the brokerage data stored with it yourself at any time.

Information we collect

Without an account. Most of the site works without signing in. When you use the public wheel tracker without an account, the file you choose (Fidelity or Tradier CSV, or Quicken QIF) is read and analyzed entirely in your browser. It is not uploaded to our servers, and it is gone when you close the page.

Usage analytics. We use Vercel Web Analytics to count page views. It does not use cookies and does not identify you; it records things like the page visited, the referring site, approximate country, and browser and device type.
Technical data. Like any website, our hosting provider receives your IP address and browser information with each request, and keeps short-lived server logs. We also briefly store IP addresses to rate-limit form submissions and data requests; those records expire automatically after a short window.
Launch list. If you join the launch list, we store your email address, which list you joined, and where on the site you signed up.
Contact form. If you send us a message, we receive your name, email address, subject, and message by email so we can reply. We don't store messages in our database.
Research tools. Tickers you enter in the research tools are used only to fetch public market data and are not linked to you.

With an account. When you sign in, we collect:

Account information. Your email address and standard sign-in records (such as when you signed in). If you sign in with Google, Google sends your email address, name, and profile picture to our sign-in provider. The product uses only your email address; the sign-in provider may keep the name and picture with your sign-in record until you delete your account. We never receive your Google password.
Brokerage data you choose to connect. If your account has broker connections enabled and you connect a brokerage, the connection runs through SnapTrade, a brokerage-data provider. You sign in to your broker on SnapTrade's or your broker's own pages; we never see or store your brokerage username or password. Connections are read-only: we cannot place trades or move money. Through the connection we receive and store your account identifiers (including account numbers), positions, and transaction history, plus notices from SnapTrade about your connection's status. We also keep the raw transaction data from each sync to diagnose import problems; a later sync deletes copies older than 90 days, so if syncing stops, the last copy stays until the next sync or until you delete your account.
Files you upload to your account. If your account has data storage enabled, broker CSV exports you import are stored as positions and transaction history in your account. Quicken QIF files are never stored, even when you're signed in.

Cookies and browser storage

We set a cookie to keep you signed in. Display choices, such as which sections are expanded and whether symbols without options are hidden, are saved in your browser's local storage and never leave your device. We do not use advertising cookies, and we do not track you across other sites.

Some third parties run in your browser on our pages: Cloudflare's bot check runs on sign-in and our forms (we also send it your IP address), and Google handles “Sign in with Google” if you choose it. These providers may set their own cookies and may recognize your browser across sites under their own privacy policies. We do not change how our site behaves in response to browser “Do Not Track” signals.

How we use information

To run the tools you use, including showing your positions, wheel campaigns, and roll analysis.
To sign you in, keep your account secure, and block spam and abuse.
To reply to your messages and send the sign-in emails you request.
To email the launch list about the product, if you joined it.
To understand which pages are used, in aggregate, so we can improve the site.
To fix problems, including diagnosing failed broker imports.

We access stored account data only to operate, secure, and fix the service, or when you ask us to. We do not sell your information, share it for advertising, or use your positions or trades to make trading decisions of our own. Other users never see your data.

Who processes your information

We use these service providers, each only for the purpose listed:

Vercel — website hosting and page-view analytics.
Supabase — sign-in and the database that stores account data.
Upstash — caching and rate limiting (IP addresses, briefly).
Resend — delivering sign-in emails and contact-form messages.
Cloudflare Turnstile — telling people from bots on sign-in and forms; Cloudflare receives browser and device signals for that check.
Google — only if you choose “Sign in with Google.”
SnapTrade — only if you connect a brokerage.

These providers handle your information under their own privacy policies and security practices. We may also disclose information if the law requires it, or to protect the rights or safety of our users or others. If the business is merged or sold, your information may transfer with it; we will post a notice on the site, and the new owner may then handle it under its own policy.

Our hosting and database providers operate in the United States. SnapTrade, Cloudflare, and Google may process information in the United States and in other countries where they operate.

How long we keep it

Account and brokerage data: until you delete it or your account.
Raw transaction data from broker syncs: deleted by a later sync once older than 90 days, or when you delete your account.
Launch-list emails: until you ask to be removed.
Contact-form messages: in our email inbox for as long as useful for correspondence.
Rate-limit records: a short window, then deleted automatically.

Your choices

Delete your account. The “Delete account” button on your account page removes your account, your stored positions and transaction history, and your SnapTrade connection. Copies in our providers' backups expire on their normal schedules.
Disconnect a brokerage at any time from your connections page, or revoke access from your broker.
Leave the launch list by contacting us. Every launch-list email we send will also include an unsubscribe link. Deleting your account does not remove a launch-list signup for the same email address.
See or correct your information by contacting us. We'll answer as soon as we reasonably can.

We don't sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

Security

Pages talk to our servers over encrypted connections. Browsers cannot query our database directly; only our servers can, and they are written to read and write only the signed-in account's data. The secret that links your account to SnapTrade is encrypted before it is stored. No system is perfectly secure, so we can't guarantee absolute security.

Children

ShinyPortfolio is intended for adults 18 and older and is not directed to children. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

When we change this policy, we'll update the effective date above. If a change materially affects how we use information we already have, we'll tell signed-in users by email or with a notice on the site before it takes effect.

Contact

Questions or requests about your information: contact us.