Privacy policy

1. Core privacy principles

At EquiTrack, we believe personal financial data requires the highest standard of confidentiality. We do not sell, broker, or monetize your portfolio activity, and we process all personal information in full compliance with the European General Data Protection Regulation (GDPR).

• You own your data: Your portfolio, holdings, and transaction ledgers belong exclusively to you.
• Zero monetization: We never sell, rent, or broker your financial trades to hedge funds or advertisers.
• Encrypted at rest: Institutional AES-256 database encryption and zero-knowledge telemetry scrubbing.

2. Information we collect

We collect only the minimal data required to provide accounting-grade portfolio tracking:

• Identity & Account Data: Your email address, cryptographically hashed password, or OAuth identification token provided if you sign in using Google.
• Portfolio Ledger Data: Information you explicitly input or import, such as asset tickers, transaction dates, purchase quantities, execution prices, dividend records, cash transfers, and personal notes.
• Essential Technical Metadata: IP address (used strictly for rate limiting and network defense), browser type, and operating system required to maintain session security.

We do not collect your bank login credentials, social security number, brokerage account passwords, or personal payment card details.

3. Zero-monetization guarantee

EquiTrack will never sell, rent, license, or monetize your individual or aggregate trade history, transaction ledgers, or net worth statistics to third parties, market makers, hedge funds, or data brokers.

Our business model is transparent and straightforward: EquiTrack is designed to be funded directly by users through optional premium features, not by selling or monetizing financial activity. We are funded by users, never by advertisers or data brokers.

4. How we use your data

We process your data strictly for legitimate operational purposes:

• Calculating accurate net worth, time-weighted returns, and cost-basis ledgers;
• Tracking corporate action event lineage (stock splits, mergers, and dividend distributions);
• Sending critical account notifications, security alerts, and password reset instructions;
• Enforcing rate limits, preventing brute-force authentication attacks, and defending against fraud.

5. Cloud infrastructure & processors

To deliver accounting-grade performance, EquiTrack partners with vetted, SOC2-certified enterprise cloud providers. We operate on a principle of least privilege, engaging sub-processors strictly across these functional categories:

• Encrypted cloud database storage: Managed relational database storage with institutional encryption at rest (AES-256) and disaster recovery redundancy.
• Cloud hosting & content delivery: Globally distributed infrastructure enforcing modern Transport Layer Security (TLS/HTTPS).
• Application performance & security caching: Temporary security and performance caches designed to optimize page load times and protect our network against automated abuse.
• Transactional email delivery: Secure email relay infrastructure for authentication verification, password resets, and critical account security alerts.

All sub-processors are bound by strict Data Processing Agreements (DPAs) that prohibit them from accessing, selling, or using your data for any purpose other than providing contracted infrastructure services.

6. Cookies & authentication tokens

EquiTrack uses only essential, security-mandated cookies. We do not load advertising trackers, social media pixels, or third-party marketing beacons.

• Session Authentication Token: An encrypted session cookie used exclusively to validate your active authenticated session securely across our application.
• UI Display Preference: A client-side cookie used solely to preserve your selected Dark or Light mode interface appearance.

7. Zero-knowledge telemetry & diagnostics

We maintain platform reliability, trace calculation errors, and diagnose server bottlenecks using automated error monitoring and runtime diagnostic tools. Our telemetry pipeline is engineered with strict zero-knowledge privacy filters.

What our telemetry captures:

• Application error logs and unhandled software exceptions;
• Anonymous device metadata (browser type, device category, and operating system);
• Aggregated system performance and response latency metrics.

What is strictly scrubbed & never logged:

• Zero Portfolio Values: Dollar balances, total net worth, and portfolio market values are never sent to telemetry collectors.
• Zero Transaction Amounts: Share quantities, execution trade prices, and purchase history are stripped prior to error transmission.
• Zero Personal Notes: Custom transaction labels and trade journals remain private to your database record.

This zero-knowledge telemetry architecture ensures our engineering team can identify and resolve system defects without ever having visibility into your financial wealth or investment allocations.

8. Data retention & right to deletion

We retain your portfolio data only for as long as your account remains active. You maintain full control over your personal data in accordance with the European General Data Protection Regulation (GDPR):

• Data Portability: You can export your entire transaction history and portfolio valuation data at any time in open CSV formats.
• Right to be Forgotten (Account Deletion): When you delete your account, EquiTrack permanently erases your user account, portfolio holdings, and transaction records.

9. Security & encryption standards

EquiTrack implements industry-grade technical safeguards to protect your data from unauthorized access, breach, or disclosure:

• Transport Security: Modern HTTPS and TLS encryption enforced for all data in transit.
• Storage Encryption: Database records and backups encrypted with AES-256 at rest.
• Credential Protection: Industry-standard cryptographic and salted password hashing.
• Domain Isolation: Authentication cookies are strictly isolated and restricted to the official equitracking.com domain network.

10. Privacy inquiries & contact

If you have questions regarding your personal data or wish to exercise your statutory privacy rights under the European General Data Protection Regulation (GDPR), please contact us directly: