Security and privacy

What we hold, and what losing it would cost you.

StockIQ never connects to a broker or a bank. That single decision sets the boundary of everything on this page: it determines what is in the database, what an attacker would find there, and what they could not do with it. All three are set out below.

The boundary

What we never do

Positions arrive one of two ways: you type them, or software reads them from the account holding them.

A tracker that links to your broker

You Grant access once An Open Banking consent or a read-only brokerage API key.

The provider Holds a standing permission A token or grant that stays live until somebody revokes it.

Your broker Positions read automatically The link is per-institution, so which platform holds what is necessarily known.

StockIQ

You Enter your own holdings Ticker, share count, price paid, date. Typed in, one lot at a time.

StockIQ Analyses what you entered Scores, valuations and filings, computed from public data.

Your broker Never contacted No consent, no API key and no OAuth grant exists anywhere in the product.

The difference is the third box. Both approaches end up with a list of your positions; only one of them needs a standing permission on the account that holds your money. StockIQ still records which account a holding sits in — you type that too — but nothing is ever read from an institution or checked against one.

We never ask for credentials

Not a broker login, not a bank login, not a one-time code, not a recovery phrase. No screen in StockIQ asks for one, so anything claiming to be us that does is not us.

We do not sell or share portfolio data

The revenue is the subscription and nothing else: no advertising integration, no data-broker relationship, no analytics vendor holding a copy.

We run no trackers

These pages make zero third-party requests — no font CDN, no analytics script, no embedded video, no tracking pixel — and the build fails if one appears.

These are properties of the build, not policies. A policy can be changed on a Tuesday; there is no code anywhere in StockIQ that talks to a broker, and no credential store that would let any be written.

The inventory

What the database holds, itemised

15 categories are stored, and most are things you typed in. The exceptions are the two short-lived tokens the account system emails you, held only as hashes; the flag recording whether you used the confirmation link; and the address your browser came from, both on the account record and in the security log.

Everything below the line is a category of data a finance product is normally expected to hold and this one does not. The formal version of the table, with a retention period on each row, is in the privacy notice.

Data	Status	Detail
Email address	Stored	Your login, and the address we would write to about your account. It is the only contact detail we have.
Display name and avatar	Stored	Free text and an emoji you choose, shown back to you in the app. The name can be anything, including nothing recognisable. It is not a legal name and is never checked against one.
Password hash	Stored	A bcrypt hash. The password itself is never written to disk and cannot be read back out of the hash by us.
The IP address you signed up from	Stored	Recorded on the account when it is created, and used for one thing: refusing a run of accounts opened from the same network in a day. It sits on the account record, so it lasts as long as the account does. It is not joined to anything you enter.
Whether your address has been confirmed	Stored	A flag, set when you use the confirmation link. Confirming is not required to use StockIQ; an unconfirmed account works.
Your marketing preference	Stored	Whether you ticked the product-updates box at signup. It is unticked by default, and ticking it puts the address on a separate list with its own unsubscribe rather than turning your account into a mailing-list entry.
Email confirmation token	Stored	Stored as a SHA-256 hash, never as the value in the link we email you. It lasts 24 hours and works once. The row is kept for 30 days after it expires and is then deleted. Confirming the address is not required to use StockIQ.
Password reset token	Stored	Stored as a SHA-256 hash, never as the value in the link. It lasts one hour, works once, and using it signs out every session on the account. Kept for 30 days after it expires, for the same reason as above, and then deleted.
Tickers, share counts, prices and dates	Stored	Exactly what you typed into a buy lot or a disposal. Nothing here was fetched from an account, because there is no account to fetch it from.
Accounts, their labels and their type	Stored	Rows you create. You type the name and pick the type — ISA, SIPP, GIA and so on — from a short fixed list. Nothing is fetched from an institution and nothing you type is checked against one.
Cash balances you type	Stored	A figure you entered so a portfolio total adds up. It is never retrieved or reconciled from anywhere.
Watchlist entries	Stored	The tickers you asked to follow, and any notes you attached to them.
Alert rules	Stored	The conditions you asked to be told about, and the cooldown on each one. Alerts are delivered to a single Telegram channel the operator runs, not to a destination of yours, so the alert text is visible to the operator. Per-user delivery is not built.
Trading journal entries	Stored	Your own notes on what you did and why, including anything in a CSV you import into the journal. This is free text, so it is the most sensitive thing here — it holds whatever you chose to write.
Session and audit records	Stored	The only rows not typed by you. Sign-in and failed sign-in events, with the IP address and user agent your browser sent, kept for 12 months so repeated attacks can be blocked. They are never joined to portfolio data.
Legal name	Never collected	Not asked for, and not checked against anything. The display name above is free text and is not a legal name.
Postal address	Never collected	Never requested at any point in the product.
Date of birth	Never collected	Never requested. StockIQ is not a regulated firm and runs no identity check.
National Insurance number	Never collected	Never requested. We do not calculate your tax and could not if we wanted to.
Bank or brokerage account numbers	Never collected	Never requested. There is no field for an account number, a sort code, or a reference.
Balances you do not type	Never collected	The only figures in your account are the ones you entered. Nothing is retrieved, reconciled or inferred from a statement.
A connection to a broker or a bank	Never collected	No Open Banking consent, no brokerage API key, no OAuth grant, no aggregator. There is nothing to authorise, nothing to revoke and no credential store for one.

Server logs record requests in the ordinary way a web server does, and are kept for operational and security purposes only. They are not joined to portfolio data and are not used to build a profile of anyone.

Breach exposure

What a breach would and would not expose

Any system can be breached, this one included. The question that matters is what an attacker would be holding afterwards.

It would expose

Email addresses and display names.
bcrypt password hashes.
The password reset and email confirmation tokens, held as SHA-256 hashes rather than as the links themselves, so a stolen row cannot be turned back into a working link.
Every ticker, share count, price and date a user typed, the accounts they were filed under, and any cash balances entered alongside them.
Trading journal entries, which are free text and hold whatever the user wrote.
Alert rules, and the sign-in records in the audit log, including IP addresses.
The IP address each account was opened from, which sits on the account record itself rather than in the audit log.

A bcrypt hash is not a password, but it is not a dead end either. With enough time and hardware a weak or common password can be recovered from one. The real onward risk is reuse: an email address paired with a recovered password is worth something on every other site where you used the same two.

It could not do

It could not be used to place a trade, move cash, or sign in to an account anywhere else. Nothing in the database reaches one: no broker credential, no account number, and no token except our own reset and confirmation links, which open a StockIQ account and nothing beyond it.
It would not give an attacker a way into an institution. An account row is a name and a type someone typed; it is not a link, and it authenticates nothing.
It would not identify a user from our records alone. We hold no legal name, no address and no date of birth, and a display name is free text.

This is the practical benefit of refusing to connect to a broker. There is no linked account to drain and no token to replay, because the connection that would have made those possible was never built.

A smaller blast radius, not zero. The contents of a portfolio are sensitive on their own: they say what you own and imply roughly what you are worth, which is worth having even without an account to attach it to. Refusing the broker connection reduces what an attacker walks away with. It does not make the attempt pointless.

A phrase we do not use

Why this page never says zero-knowledge

Zero-knowledge means the server cannot read the data. The key stays on your device, the operator holds ciphertext, and there is no procedure by which they open it. That is not what StockIQ does. Our database stores tickers, share counts, prices and labels as ordinary rows, and the operator can read them. Off-site backups are encrypted before they leave the server; the live database is not.

The test, if you want to apply it elsewhere. Ask which key, held by whom, and what happens to your data when you lose it. If the provider can restore your account after you forget your password, the provider can read your data. That is not a criticism of them; it is just not zero-knowledge.

Roadmap

Two things that are not built

Not built

Two-factor authentication

There is no authenticator-app support, no TOTP and no SMS second factor in the product today. It is on the list and it is not built. Until it ships, an account is protected by its password alone, which is the reason to use one you have used nowhere else.

Not built

Hard account deletion

Closing an account today marks it inactive. It does not remove the rows. Deletion that actually deletes is on the list and is not built. In the meantime, email us and we will remove your rows by hand, within 30 days of the request.

For any of these, or for a copy or deletion of your data, write to [email protected].

One cookie, and it is the session

Signing in to the app sets a single session cookie. It is HttpOnly, so page scripts cannot read it; Secure, so it only travels over HTTPS; and SameSite=Lax, so it is not sent along with requests started by another site. It expires after seven days of inactivity, and after thirty days regardless of how active you have been.

There is no advertising cookie, no analytics cookie and no cross-site tracking cookie. These pages load nothing from another host — no font CDN, no script, no image, no embed — so nothing on the page is in a position to set one, and the build checks it. StockIQ itself sets no cookie at all on these public pages.

The site is served through Cloudflare's reverse proxy, which can set its own strictly necessary security cookies on this domain independently of anything the page does. That is a property of the proxy rather than of the page, and the cookie policy covers it.

Full detail on the cookies page. The privacy policy and terms of service set out the rest, and the platform page covers the analysis itself.