How accounts, data and money are handled

This page says exactly how accounts, data and money are handled, taken from the code. Where something is not built, it says so. It is a description of how the product works, not a certification: we have not had an outside security audit and we hold no compliance attestations.

Your money#

• There is no brokerage or bank connection. The product has no integration with any broker, bank or account aggregator. We never ask for brokerage credentials.
• There is no trading. No part of the app, the API or the agents can place, change or cancel an order.
• Your holdings are numbers you typed. They are stored as a ticker, a share count, a cost and optionally a market value. They are not linked to any real account.
• The practice account is pretend money. It is a ledger of paper trades and cannot become a real order.

Signing in#

• Sign-in is with Google only, through Firebase Authentication. There is no stocksbrew password, so there is none for us to store or leak.
• From Google we receive your name, your email address and your profile picture. We do not request access to your Gmail, Drive, contacts or calendar.
• After Google confirms who you are, our server checks the sign-in token, including whether it has been revoked, and sets a session cookie.
• The session cookie is HTTP-only, so page scripts cannot read it. It is marked Secure in production and SameSite=Lax, and it lasts five days. Signing out clears it.
• Two-step verification is whatever you have set on your Google account. We do not add a second factor of our own.

What we store about you#

We do not store: brokerage credentials, card numbers, bank details, government identifiers, your address or your phone number. We do not ask for any of them.

Where it lives#

• Account data is kept in a document database that we run on our own server. The app reaches it over HTTPS with a server-side credential that is never sent to your browser.
• An earlier copy of account data remains in Google Cloud Firestore, where the product used to keep it. We are keeping it for rollback while we finish moving off it.
• The app is hosted on Vercel. Sign-in is handled by Google Firebase Authentication.
• Individual fields are not encrypted inside the database. Protection is at the level of the server, the disk and the network connection.
• Your portfolio is private to your account. Pages and API routes that return it check your session first.

Payments#

• Payment is handled by Dodo Payments, on their checkout page. Card details go to them and never reach our servers.
• From them we store: a customer id, a subscription id, the plan (monthly or yearly), the status, and the times of activation, last payment, payment failure and cancellation.
• Plan changes reach us as signed messages from the payment provider. We verify the signature before acting on one whenever the signing secret is configured, which production needs.
• Cancelling from Account tells the payment provider to stop at the next billing date. You keep Pro until then. We ask for a reason, which is stored with your account.
• We do not store the date of your next charge. It is on the receipt the payment provider emails you.
• There is no refund button in the app. For a billing problem, email tomartarun2001@gmail.com.

Who else receives data#

We do not sell or rent personal data, and we do not run advertising.

Developer tokens and connected agents#

• A personal token is shown once when you create it. We keep a SHA-256 hash of its secret and compare hashes in constant time. We cannot show you the token again.
• You can have up to five active personal tokens and revoke any of them from Account. A revoked token fails on its next call.
• Agents that connect through OAuth get an access token that lasts one hour and a single-use refresh token that lasts 30 days. The flow requires PKCE.
• Every token is limited by scope, and every call is checked against an active Pro plan and the daily and per-minute limits.
• A token can read your portfolio and alerts, add or remove a stock, and create or deactivate a price alert. It cannot trade, pay, change your plan or delete your account.
• Revoking a connected OAuth agent from Account is not built yet. To cut one off today, email us, or let its tokens expire: access ends within the hour and renewal ends when the refresh token is used or expires.

Exporting your data#

Account has a Download my data button. It returns one JSON file with your profile, portfolio, email settings, followed investors, tracked strategies, watched markets, alerts, agents and their recent runs, your practice account and the names of your developer tokens. It lists your active alerts, up to 100, and your most recent agent runs. It does not include Ask conversations, briefing item state, feedback messages or analytics events yet. Email us if you need those.

Deleting your account#

Account has a Delete account button. It asks you to confirm, then does the following straight away.

• Schedules any paid subscription to cancel at the end of its period.
• Deletes your account record: identity, portfolio, followed investors, tracked strategies, watched markets, email settings and plan fields.
• Deletes your portfolio views and history, your portfolio inbox, your fired-alert flags, your developer tokens, their usage counts and any pending agent sign-in codes.
• Deletes your Google sign-in from our Firebase project and clears the session cookie.

What is not built#

• No outside security audit, penetration test or compliance attestation.
• No bug bounty. We still want to hear about problems: see below.
• No field-level encryption of account data.
• No second factor of our own beyond your Google account's.
• No list of active sessions, and no way to sign out other devices except waiting for the five-day session to end.
• No self-serve revoke for OAuth-connected agents.
• No automatic deletion of inactive accounts.

Reporting a security problem#

Email tomartarun2001@gmail.com with what you found and how to reproduce it. Please do not test against other people's accounts or data. We will reply, fix what is confirmed and tell you when it is fixed.