First draft — not in effect

An outline of what this policy must cover, written from an audit of what the application actually does. Nothing here is legal text and nothing on it is binding.

Privacy Policy

The short version: browsing requires no account, nothing tracks you between pages, and there is no analytics or advertising code anywhere in this application. The longer version, including what is not yet protected, is below.

In place today

Passwords are hashed, never stored: bcrypt with a cost factor of 12 — current practice. A stolen database does not yield usable passwords.
Sessions expire aggressively: A signed token with a 60-minute rolling idle window and a hard 8-hour cap. Most sites leave you signed in for weeks.
The session cookie is HTTPS-only: Marked secure, so it is never sent over an unencrypted connection, and not readable by page scripts.
Registration is closed: Account creation returns a refusal. Nobody can register, so there is no pool of user data to lose.
No analytics, no trackers, no tag manager: There is no Google Analytics, Plausible, PostHog, Meta pixel or equivalent anywhere in the application. Nothing follows you between pages.
Fonts are served from this domain: Typefaces are downloaded at build time and served locally, so your browser never contacts a font CDN and no third party learns you visited.
AI chat is self-hosted: Assistant messages are processed by a language model running on hardware owned by the operator, reached over a private network. They are not sent to OpenAI, Anthropic, Google or any other provider, and the web application does not store them.
Market data providers never see you: Quotes are fetched server-side. Your browser does not talk to any market data vendor, so they receive no information about visitors.

Not in place

The account store is not encrypted at rest: Account records live in a plain database file on the server. Anyone with access to that machine can read it. Encryption at rest is not in place.
There is no login rate limiting: Repeated failed sign-in attempts are neither throttled nor locked out. This matters little while registration is closed and one account exists; it must be fixed before opening sign-ups.
YouTube thumbnails are third-party requests: The Media page loads video thumbnails from Google's image servers, which reveals your IP address to Google. The player itself is only loaded if you click, and uses the no-cookie domain.
Server logs record requests: The web server records request details including IP addresses, as essentially all web servers do. Retention is not currently defined.

1.What this covers

This policy describes what information the platform collects from visitors and account holders, why, how long it is kept, and who it is shared with.

2.Information collected from visitors

Browsing the public pages requires no account and no personal information. The web server records ordinary request data — IP address, user agent, pages requested, timestamps — for operation and security. The ticker on the home page is served from this domain; it makes no third-party call.

3.Information collected from account holders

For an account: an email address, a display name, a bcrypt password hash, an optional profile image reference, a role, and the date the account was created. No payment details are collected because nothing is charged. No phone number, no address, no date of birth, no identity documents.

4.What is deliberately not collected

No behavioural analytics, no cross-site tracking, no advertising identifiers, no fingerprinting, no session recording, no email open tracking. The application contains no third-party analytics or advertising code of any kind.

This is a verified statement about the current codebase, not an aspiration.

5.Cookies

One session cookie, set only after signing in, used solely to keep you signed in. It is HTTPS-only and not readable by page scripts. There are no advertising or analytics cookies, so there is no consent banner to click through.

6.The AI assistant

Questions put to the assistant are processed by a language model the operator runs on their own hardware over a private network. Messages are not sent to any third-party AI provider and are not stored by the web application. Treat the conversation as you would any message to a service operator: do not paste credentials or anything you would not want read.

7.Third parties

Market data is retrieved server-side by the platform, so data providers receive no information about you. The Media page loads video thumbnails from Google's image servers; the video player loads only if you click it, and on a no-cookie domain. Links to external sites are governed by those sites' own policies.

8.How information is protected

Passwords are hashed with bcrypt and never stored in readable form. Sessions use a signed token with a 60-minute idle limit and an 8-hour absolute limit. The session cookie is restricted to HTTPS. Administrative pages are role-gated.

State the gaps alongside the protections — the account store is not encrypted at rest and sign-in attempts are not rate limited. A policy that lists only the good parts is the kind that gets disputed.

9.Retention and deletion

Account records are kept while the account exists. Describe how an account holder requests deletion and how long it takes.

Needs a decision: define a retention period for server logs, and a deletion route.

10.Your rights

Depending on where you live you may have rights to access, correct, delete or export your personal information, and to object to certain processing.

Scope depends on whether you intend to serve UK/EU (UK GDPR / GDPR) or California (CCPA) users. Decide before opening registration — it changes what this section must promise.

11.Children

The platform is not intended for anyone under 18 and does not knowingly collect information from children.

12.Changes and contact

Material changes will be posted here with a new effective date. A monitored contact address for privacy questions.

Prepared as a working brief from a code audit. Not legal advice, and not drafted by a lawyer.