Privacy Policy

1. Information We Collect

Depending on how you interact with our platform, we may collect the following information:

• Account Authentication Data (Optional): If you choose to log in, we authenticate via Google OAuth. We receive your name, email address, profile picture URL, and a unique Google ID. We do not receive or store your Google password.
• User-Uploaded Trade Records (Optional): If you save your trades to your account, we store your normalized trade records (Stock ticker, transaction date, buy/sell action, quantity of units, price per share, and brokerage fees) in an encrypted edge database.
• Direct Communications: When you send us a message via our Contact form, we collect your name, email address, message category, and feedback text to assist you.
• Technical Usage & Analytics: Standard non-identifying telemetry (browser type, device category, pages viewed) via Google Analytics 4 to monitor platform uptime and improve performance.

2. How We Use Your Information

We use the collected information solely for legitimate platform operations:

• To compute Capital Gains Tax (CGT) FIFO schedules and financial year summaries.
• To sync and restore your trade history across devices when you are logged in.
• To respond to your support queries, bug reports, or feature suggestions.
• To diagnose infrastructure errors and prevent abuse or security breaches.

3. Data Storage & Security

Our web application and edge API worker are hosted on Cloudflare. All traffic between your browser and our services is encrypted via Transport Layer Security (TLS 1.3).

Cloud-synced trade data is persisted in isolated Cloudflare D1 databases with strict row-level authorization: every request verifies a cryptographically signed JSON Web Token (JWT) ensuring users can only read or edit their own trade records.

4. Cookies & Local Storage

We use minimal browser storage:

• Session & Selection State: LocalStorage / SessionStorage is used to remember your active stock selection, strategy parameters, and theme preference (dark/light mode).
• Authentication Token: An encrypted session JWT is stored in your browser to maintain your signed-in state.

5. Disclosure of Personal Information

We do not disclose your personal information or financial records to third parties, except in the following limited circumstances:

• Service Providers: Cloudflare (serverless compute & database hosting) and Google (OAuth identity provider) acting as data processors under contractual privacy obligations.
• Legal Compliance: If required by Australian law, court order, or regulatory authority (e.g., Australian Taxation Office or ASIC) in response to a lawful warrant or subpoena.

6. Your Rights & Data Deletion

Under the Australian Privacy Principles, you have rights regarding your personal information:

• Access & Correction: You can inspect and update your trade history at any time through the review interface.
• Instant Complete Deletion: You can delete all your stored trades with one click via the “Delete All” button in the CGT review screen, which immediately purges your trade records from our database.
• Account Removal: You can request complete removal of your user account profile by contacting us at [email protected].