The short version: it holds what you type, and nothing else.

An email address and a password, or a Google account if you sign in that way. A display name, if you set one. And the trades and transactions you record: asset, direction, leverage, prices, amounts, dates, notes and subtags.

That is the whole list. There is no import, no bank connection and no exchange integration, so nothing arrives here that you did not type.

In a Postgres database, under your account id:

You. Every request is authenticated on the server before it touches data, and every query is scoped to your account id - the browser never talks to the database directly. The person who runs the service can technically reach the database, as with any hosted app; nobody reads your rows as a matter of course, and no third party is given access to them.

Stated plainly, because it would be easy to imply more than is true:

End-to-end encryption - where the server holds only ciphertext it cannot read - is deliberately not used here. It would make it impossible to calculate your P&L, win rate, recovery or chart on the server, and a forgotten password would mean the data was gone for good, with no reset possible. If that trade-off matters more to you than those features, this is the wrong tool, and you should know that before you type anything in.

Five providers, each doing one job:

A session cookie, set when you sign in, so the server knows it is you on the next request - plus the short-lived ones the sign-in library uses to complete a Google handshake. No analytics or advertising cookies, because there is no analytics. Your theme choice is stored on your account rather than in the browser, which is why it follows you to another device.

Handled by the authentication library, never stored in a readable form. Sign-up requires at least twelve characters and refuses any password found in a known public breach. That check sends only the first five characters of the password's SHA-1 hash to the breach service, which answers with every hash sharing that prefix; the comparison happens here, so neither your password nor its full hash ever leaves the server. If the service is unreachable, sign-up still works.

Five sign-in attempts per five minutes, and five sign-ups, reset requests or resets per hour, counted in the database rather than per server - so the limit holds however the app is scaled. A new address must be verified by email before it can sign in at all.

Counting them means briefly storing the IP address a request came from, against the endpoint it hit. That is the only place an IP is kept, it is never linked to your account, and it is deleted automatically once it is older than the longest limit window - so it lives hours, not indefinitely. Deleting your account does not remove these rows, because they were never attached to it in the first place; they age out on their own.

If this policy changes, the date at the top changes with it. Anything unclear, or a request about your data: reply to either of the two emails the app sends, and it reaches the person who runs it.