Privacy notice

Updated for version 1.14.3

Private use

This is a privately operated, self-hosted wealth tracker for its owner's personal use. It is not a public financial service and does not offer public registration. The owner of this deployment operates the application and controls its data and backups.

Information held

The application stores account and asset details entered or imported by the owner, balances, quantities, optional purchase prices, market observations and explicitly saved historical snapshots. It also stores login password hashes, essential session and security cookies, and login-throttling records. Server and reverse-proxy logs may contain request metadata such as IP addresses, requested URLs and timestamps, depending on the hosting configuration.

Purpose and sharing

Information is used to display current wealth and historical comparisons, support imports and exports, and protect access. The application does not include advertising or analytics trackers. Public instrument search text and symbols are sent to the configured market-data providers; their own privacy terms apply. Bank balances and the portfolio are not included in those market-data requests.

Native market-performance cards cache public five-minute Yahoo prices for active instruments alongside normal quote refreshes. No third-party chart iframe or script runs in the dashboard. The chart cache is replaced on a successful fetch and removed with its instrument or a full financial restore. It is excluded from financial JSON exports and historical snapshots but is included in database backups.

Visible homepage sessions request stock-price refreshes every five minutes through this server; hidden pages do not poll. This timer does not fetch bank balances or create snapshots. Latest verified pre-market/after-hours equity samples may be used for live valuations and manually confirmed snapshots. Daily automatic snapshots use separately cached completed regular-session equity closes, or intentional manual overrides; their source and reference date are retained. The closing cache is operational and excluded from financial JSON exports, but included in database backups. Provider requests contain public instrument symbols, not your share quantities.

Optional What-if price assumptions are processed transiently by this application's server against a signed copy of the displayed actual valuation, then rendered only on the current homepage. Assumptions are not written to financial records, sessions, caches, browser storage, exports or snapshots and are not sent to financial providers. Reset, Sync, reload or navigation clears the temporary view. Automatic captures continue using actual data independently.

Optionally linking an iHouse URL to a property authorizes server-side retrieval of that public listing during Sync and enabled daily captures, at most once per URL per 24 hours. iHouse receives the listing path, this server's network address and ordinary request headers, but no portfolio balances or login credentials. The selected Small Area median and source provenance are retained in property records, snapshots and exports. No iHouse iframe, browser script or cookies are used. Clearing the link stops automatic property requests; full financial restores clear the request cache.

Projection and mortgage estimates

Projection horizons, monthly EUR cash savings, non-cash category/asset growth overrides and optional mortgage terms are saved locally and included in financial JSON exports and database backups. Projection calculations contact no external providers and do not create history. Opted-in current mortgage estimates are derived rather than written over confirmed principal; subsequent snapshots and CSV/JSON exports retain their frozen anchor, terms, method and as-of date. Deleting an asset removes its current growth override/mortgage model, not existing snapshots or separate backups.

Stock-award projections

Optional monthly contributions per pension holding are local projection preferences, saved with their native currency and included in financial JSON/database backups. They do not create real pension payments, alter cash balances or update Current/snapshots. Deleting the holding removes its current contribution preference, not frozen history.

The saved Projection CGT-deduction choice and annual cash return are local planning preferences included in financial JSON/database backups. It changes projected values only, not Current, actual snapshots or stock-award vesting withholding.

Optional per-stock award programmes and confirmed grant/vesting schedules are retained locally for Projection and included in financial JSON/database backups. Uploaded stock-plan XLSX files are processed locally under size limits; names, employee IDs and original uploads are not retained. Only necessary schedule fields and hashed grant identities are stored. No workbook formulas/macros or external references are executed. A normalized owner-scoped import preview remains until expiry/cleanup and requires explicit confirmation. Forecast vesting/grants do not change real holdings, sessions, Current or historical snapshots and contact no providers. Deleting a receiving holding removes its current award planning data, not frozen snapshots or separate backups.

Bank connections

Optional multi-bank cash syncing uses Enable Banking to connect to accounts the owner has whitelisted in a restricted production application. The owner selects a bank and country from the provider's personal account-information directory, loaded only on explicit request. The tracker requests account information with balance access and requests no transaction access. It does not call transaction or payment APIs. The bank's actual consent screen determines the permissions granted; review it before accepting. Authentication is handled through the provider and bank, not by entering banking passwords here. Enable Banking and the bank process data under their own notices and terms.

The tracker requests consent for up to 30 days, subject to the bank's limits, and requires reauthorization after expiry. Clicking the homepage Sync icon authorizes fetching and automatically applying eligible mapped cash balances with valid recent reference dates. The owner can also opt in to a daily scheduled refresh and snapshot, using the same protections. Old or undated balances require review instead. The Bank sync page retains the separate preview and confirmation flow. Manual Sync alone does not create history. The daily scheduler records a complete valuation with explicit notes when provider failures require retained values; missed days are not backfilled.

For a connection, the application retains the bank name and country, an encrypted provider session identifier, account API identifiers, hashed account-identification values, currency, a masked account suffix where available, mappings to local cash assets, consent expiry and sync status. It does not retain the full account-holder name or IBAN returned during authorization. The provider response is processed in memory to extract the required fields. Preview records contain the old and fetched amounts and are valid for confirmation for 10 minutes; expiration does not itself erase a preview. A new bank preview from any connected bank replaces that user's previous bank preview, and disconnecting removes it.

If an authorization is invalidated while the provider is responding, the application attempts to revoke the returned session. An encrypted recovery handle and bank name/country are retained if revocation fails or processing is interrupted, allowing a later retry. Pending authorization records contain the selected bank name/country, hashed state and browser-session bindings and expire after 15 minutes. Only one attempt can run at a time. Records are removed after completion, cancellation or terminal failure, when an expired attempt is replaced, upon disconnection of the matching bank, or during full JSON restore. A full financial JSON restore clears all mappings and pending attempts but retains connections and recovery handles for explicit revocation or remapping.

The owner can cancel a stuck pending attempt locally and retry without waiting for expiry. Late callbacks from that attempt are rejected. This does not remove existing connections or revoke consent already granted at the bank; a session exchange already in progress is rechecked and its returned session may require remote revocation or recovery.

Homepage sync runs store owner-scoped work identifiers, progress, outcomes and necessary input guards so the browser can resume a run already explicitly started. Old or undated fetched balance candidates can be reviewed for ten minutes without fetching again; their records may remain after expiry. Completed or expired run records are removed after seven days when the operator runs transient cleanup. Financial JSON exports exclude these operational records; database backups include them. A full restore invalidates outstanding runs and candidates. Closing the browser pauses further steps, though a request already in flight may finish; reopening the homepage may resume that same run.

The RSA private key remains a separate server file and is not included in the Docker image or financial JSON exports. Session identifiers are encrypted using a key derived from the deployment's SECRET_KEY. This protects a database copy without that secret, not a compromised running server. Bank connection records are excluded from financial JSON exports but included in database backups. Applied cash values are included in normal financial exports and any subsequently confirmed snapshots.

Storage and retention

Application records are stored in the database on the owner's server. Hosting administrators with access to the server, Docker environment or backups may be able to access them. Records remain until the owner deletes them or replaces the dataset. Deleting a current account or asset does not delete its frozen historical snapshots; archiving does not delete data. A snapshot can be permanently deleted through its separate explicit confirmation, removing it from application history and future exports. Exports and backups are separate copies that must be removed separately. Log retention is controlled by the hosting operator.

Access, deletion and contact

Disconnect requests deletion of the selected bank's Enable Banking session, then removes that local connection and mappings, not other bank connections. Confirmed provider session expiry also permits local removal; other failures retain the handle for retry. Consent may also be revoked through Enable Banking's consent portal or the bank. Recovery removal requires confirmation of external revocation, or an explicit acknowledgement of local-only removal when the connection is marked expired. Local-only recovery does not contact the provider or verify remote revocation. Previously synced balances, snapshots and separate backups remain.

The application does not log provider response bodies or authorization codes, and its packaged application server disables access logging. Hosting operators must also prevent reverse proxies and monitoring tools from recording callback query strings, which contain temporary authorization codes. The callback uses a no-referrer policy. Form pages use a same-origin policy to preserve CSRF protection without sending referrers to other sites; the external bank continuation link also explicitly suppresses its referrer.

The owner can inspect, edit and export financial records after signing in. Removing all stored information also requires dealing with historical records, the database, exports, backups and applicable logs. For privacy questions, contact the person who operates this deployment. For an application registered with an Open Banking provider, use the data-protection contact email shown in that application's provider registration or consent details.