Privacy Policy

Who We Are

Gainzkeeper is operated by Scott Wever. For questions about your data, contact us at scott.wever@gmail.com.

Data We Collect

When you sign in with Google, we receive your email address and a unique identifier from Google. We do not receive your name, profile picture, or any other Google account data unless you explicitly grant permission.

Any portfolio data you enter (holdings, transactions, cost basis, and notes) is stored in your account and isolated from other users via row-level security.

We may log basic request metadata (IP address, timestamp, page path) through Vercel's infrastructure for debugging and security purposes.

If you send a message through the contact form, we store the name and email address you enter, the message itself, and a salted hash of your IP address that we use to limit abuse. The hash cannot be reversed into your IP address.

Why We Collect It

We collect your email address to identify your account. Signing in works through Google only, so there is no Gainzkeeper password to store or reset. We do not use your data for marketing, advertising, or profiling.

Selling and Sharing

We never sell your data and never show it to anyone else. Your portfolio is visible to you alone. The only parties that touch your data are the processors listed below, which we need to run the service.

Third Parties

We use the following services, each governed by its own privacy policy:

• Supabase (supabase.com): Authentication and database hosting on servers in the EU (Ireland). Your email and portfolio data are stored here.
• Vercel (vercel.com): Hosting. Your requests pass through Vercel's infrastructure.
• Cloudflare Workers (cloudflare.com): A price-proxy we operate. No personal data is sent to Cloudflare through this service.
• Yahoo Finance: Used to fetch live market prices. No personal data is sent to Yahoo Finance.
• PostHog (posthog.com): Cookieless product analytics on EU servers, which we use to count feature usage. Your portfolio data is never sent to PostHog.
• Groq (groq.com): Runs the AI model behind the optional analysis feature. Used only if you switch AI recommendations on. It receives a summary of your holdings (ticker, name, weight, return, value), never your name or email address.

Retention

We retain your data for as long as your account exists. If you delete your account, your portfolio data and your account are deleted immediately. Server logs are retained for approximately 30 days.

Messages sent through the contact form are kept so we can answer them and recognise abuse. After you delete your account they are no longer linked to it.

Your Rights

Under GDPR you have the right to access, correct, export, or delete your personal data. To exercise these rights, email scott.wever@gmail.com. We will respond within 30 days.

Cookies

We use cookies for authentication and session management only. See our Cookies and Local Storage page for details, including the browser storage a few features use instead of a cookie.

Changes to This Policy

We may update this policy from time to time. The date of the most recent update is shown at the top of this page.