Privacy Policy

1. Data Controller

The data controller for this service is the operator listed on the Imprint page. For any privacy-related questions, please contact us via the email address provided there.

2. Data We Collect

We collect and process the following personal data:

• Email address — Used for account creation and magic link authentication
• Display name — Optional, set by you in account settings
• Portfolio data — Positions, transactions, and simulation settings you enter into the Service
• Usage preferences — Language, currency, and display settings

We do not collect IP addresses for tracking, browser fingerprints, or any data beyond what is listed above.

3. Purpose & Legal Basis

Your data is processed solely for the purpose of providing the Service to you. The legal basis is contract performance (Art. 6(1)(b) GDPR) — processing is necessary to fulfill the service you signed up for.

4. Third-Party Services

We share limited data with the following service providers:

• Resend (email delivery) — Receives your email address to send authentication magic links. Privacy Policy: resend.com/legal/privacy-policy
• Railway (hosting) — Our application and database are hosted on Railway in the EU region. Your data is stored on Railway's infrastructure. Privacy Policy: railway.app/legal/privacy
• Financial Modeling Prep (FMP) — We send stock tickers and ISINs to retrieve price data. No personal user data is transmitted to FMP.
• European Central Bank (ECB) — We fetch public exchange rate data. No personal user data is transmitted.

5. Cookies

We use a single strictly necessary cookie:

• pf_session — An httpOnly, secure session cookie containing a JWT token for authentication. Expires after 30 days. This cookie is essential for the Service to function and does not require consent under GDPR/ePrivacy Directive.

We do not use analytics cookies, tracking cookies, advertising cookies, or any third-party cookies.

6. Data Retention

Your data is retained as long as your account exists. You can delete your account at any time from the Settings page, which will permanently remove all your data (positions, transactions, settings, and snapshots) from our systems.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data via your Settings
• Erasure — Delete your account and all associated data
• Portability — Receive your data in a machine-readable format
• Restriction — Request restriction of processing
• Objection — Object to processing of your data
• Complaint — Lodge a complaint with a supervisory authority (in Germany: your state's Datenschutzbehörde)

To exercise any of these rights, contact us via the email on the Imprint page.

8. Data Location

All data is stored and processed within the European Union. Our hosting provider (Railway) operates EU-region infrastructure. No data is transferred outside the EU/EEA.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will require you to review and re-accept the policy upon your next login.