PRIVACY POLICY

WStonks is operated by a solo developer. This policy explains what data we collect when you use WStonks or Ledger, how it is stored, and what rights you have over it. We have written it in plain language intentionally.

// 01 — WHAT WE COLLECT

When you create an account:

• Email address — used to identify your account. Stored in plaintext in our database. We do not send marketing email.
• Password — never stored in plaintext. We derive a one-way hash using PBKDF2-SHA256 with a random salt and 100,000 iterations. We cannot recover your password.

When you use Ledger (cash flow tracking):

• Financial transaction data you import or enter manually: date, description, amount, category, type.
• Investment positions: ticker symbol, number of shares, cost basis.

Automatically, when you use the service:

• Session token — a random 32-byte hex token stored in an HttpOnly cookie. Used to keep you logged in. Expires after 30 days.
• IP address — used only for rate limiting on login and registration endpoints. Stored temporarily and purged automatically within 5 minutes. Not logged or retained elsewhere.
• Page view data — we use Cloudflare Web Analytics. This is cookieless, does not track you across sites, and collects only aggregate data (page views, referrers, country, browser type). No advertising profiles are built from this.

What we do not collect:

• We do not track what market briefs or signals you view.
• We do not collect payment information (no Stripe integration is live yet).
• We do not use third-party analytics, advertising pixels, or tracking cookies.

// 02 — WHERE YOUR DATA IS STORED

All account and financial data is stored in Cloudflare D1 — a managed SQLite database hosted on Cloudflare's global network. Cloudflare encrypts all D1 data at rest and in transit.

We do not store your data on personal computers or local servers. We do not back your data up to third-party services beyond Cloudflare's own redundancy.

// 03 — HOW WE USE YOUR DATA

• To provide the service — your email and password hash are used to authenticate you. Your financial data is synced across your devices when you are logged in.
• To improve the service — aggregate page view counts help us understand what is being used. We do not perform individual-level behavioral analysis.

We do not sell your data. We do not share your data with third parties except Cloudflare as our infrastructure provider. We do not use your financial data to train AI models or for any purpose other than displaying it back to you.

// 04 — DATA RETENTION

• Account data — retained until you delete your account.
• Financial data (Ledger) — retained until you delete your account. Deleted transactions are soft-deleted and fully removed when you delete your account.
• Sessions — expire automatically after 30 days. Expired sessions are purged nightly.
• Rate limit records — purged automatically within 5 minutes.

// 05 — YOUR RIGHTS

If you are located in the European Economic Area or United Kingdom, you have rights under the GDPR. If you are in California, you have rights under the CCPA. In practice, we extend these rights to all users regardless of location.

• Right to access — you can export all your Ledger data at any time using the Export button in the app. Your data is returned as a JSON file containing all transactions and positions.
• Right to erasure — you can permanently delete your account and all associated data by clicking your email chip in the top bar, then Delete Account. This permanently removes your user record, all sessions, all transactions, and all positions from our database in a single operation. It cannot be undone.
• Right to data portability — the Export function provides your data in machine-readable JSON format.
• Right to rectification — you can edit transaction descriptions and amounts directly in the Ledger app.
• Right to object or restrict processing — contact us at the address below. For a product this small, we will respond directly.

We do not make automated decisions that have legal or similarly significant effects on you. The AI-generated market briefs are explicitly not financial advice and do not evaluate or score individual users.

// 06 — SECURITY

• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, random salt). We use a constant-time comparison to prevent timing attacks.
• Session cookies are HttpOnly, Secure, SameSite=Strict, and scoped to Domain=wstonks.app.
• All traffic is served over HTTPS.
• Data endpoints enforce authentication and scope all queries to the authenticated user's ID.
• Login and registration are rate-limited by IP address.

No security system is perfect. If you discover a vulnerability, please contact us privately before disclosing it publicly.

// 07 — CHILDREN

WStonks is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has registered, contact us and we will delete the account.

// 08 — CHANGES TO THIS POLICY

If we make material changes to this policy, we will update the effective date above. For significant changes, we will add a notice on the site. Continued use of the service after a policy update constitutes acceptance of the revised terms.

// 09 — CONTACT

For privacy questions, data requests, or to report a security issue: