Privacy policy

Account data. Your email address and the preferences you set. Authentication is handled by Supabase; we never see or store your password.

What you enter. Watchlists, holdings, and saved screens you create are stored against your account so they are there when you come back. If you import a broker statement, the parsed positions are stored the same way. They are your data: we do not share them, mine them for anything beyond showing you your own portfolio, or keep them after you delete them.

Email captures. If you ask for a download or the email course, we store the address you gave and which resource you asked for, so we can send it and honour unsubscribes.

Analytics. Vercel Analytics, which is cookieless and counts page views in aggregate without building a profile of you. No advertising pixels, no fingerprinting.

Three, all first party. Supabase session cookies keep you signed in. A small counter cookie remembers how many free questions a signed-out visitor has asked the assistant. That is the lot; there are no tracking or advertising cookies. Your theme and layout preferences are stored in your browser's local storage and never leave your device.

In UK GDPR terms, and in plain English: we process account and portfolio data because you asked us to, that is the service (performance of a contract). We process security logs and aggregate analytics because a site has to be kept running and safe (legitimate interests). We send optional emails only where you opted in (consent), and every one carries a working unsubscribe. This is a summary of our approach, not legal advice.

Supabase stores the database and handles sign-in. Vercel hosts the site. Resend delivers email. Market data providers supply prices and fundamentals to us; we do not send them anything about you. Nobody gets your data for advertising, and we do not sell or rent it to anyone.

Account and portfolio data lives as long as your account does, and is removed when you delete the account or ask us to. Email-capture records last until you unsubscribe or ask for deletion. Server logs rotate on short schedules set by our hosts.

You can ask what we hold, get a copy in a usable format, correct it, or have it deleted. Email hello@steadyshares.com and we will action it within 30 days, usually much faster. If you are in the UK and unhappy with our answer, you can complain to the ICO.

If this policy changes materially, the date at the top changes and the previous wording remains available on request. We will not quietly weaken it.