Privacy Policy

Tickline (“we”, “us”) is a portfolio tracking and market data application. This policy explains what personal data we process when you use Tickline, why, and the choices you have. Questions or requests: our GitHub issue tracker.

• Account data — your name and email address. If you sign up with email, a salted hash of your password (we never store it in plain text). If you use Google, Apple or Microsoft, the provider's account identifier and the profile details they share (name, email).
• Profile answers — the optional country, investment goal, risk tolerance and preferred industry you give at sign-up, used to personalise emails.
• Portfolio data you enter — transactions (symbol, quantity, price, fees, date, notes), watchlist symbols and price alerts.
• Session and security data — session tokens, and the IP address and browser user agent recorded with each session, used to keep your account secure and to rate-limit abuse.
• Operational logs — errors and request metadata kept by our hosting provider for a limited period.

We do not collect payment details, government IDs or brokerage credentials, and we do not connect to your brokerage accounts.

• To provide the service: authenticate you, store and value your portfolio, evaluate alerts and show market data.
• To send the emails you expect: a welcome email, price-alert notifications and, if enabled, a daily market digest.
• To keep Tickline secure and reliable: rate limiting, abuse prevention, debugging.

Legal bases (where GDPR applies): performance of our contract with you (running your account), our legitimate interests (security, service improvement) and, where required, your consent.

We share data only with providers that help us run Tickline, under their own privacy and security terms:

• Vercel — application hosting and logs.
• MongoDB Atlas — database storage for your account and portfolio data.
• Inngest — background jobs (alert checks, emails); receives event data such as your email and profile answers.
• Google Gemini — generates the text of personalised welcome emails and news digests from your profile answers and market news.
• Email provider (SMTP) — delivers alert and digest emails to your address.
• Finnhub — market data. We send ticker symbols, never your identity.
• TradingView — charts and widgets loaded in your browser; TradingView may collect technical data under its own policy.
• Google, Apple, Microsoft — only if you choose to sign in with them.

We do not sell or rent personal data and do not share it for advertising.

Tickline uses strictly necessary cookies only: a secure, HTTP-only session cookie that keeps you signed in. Your browser's local and session storage hold interface preferences and today's live portfolio chart; they never leave your device. We use no analytics, advertising or cross-site tracking cookies, so no consent banner is needed.

• Account and portfolio data: kept while your account exists; deleted immediately when you delete your account.
• Demo workspaces: deleted automatically after 24 hours.
• Sessions: expire after 7 days of inactivity.
• Hosting logs: retained by our providers for a limited period according to their policies.

Depending on where you live (for example under GDPR or CCPA), you may have the right to access, correct, export, delete or restrict the use of your data, and to object to processing. In Tickline you can:

• Export all of your data as JSON from the account menu (Export my data).
• Delete your account and all associated data from the account menu (Delete account).
• Edit or delete individual transactions, watchlist items and alerts at any time.

For anything else, contact us at our GitHub issue tracker. You may also complain to your local data protection authority.

Data is encrypted in transit (HTTPS with HSTS). Passwords are hashed, sessions use secure HTTP-only cookies, inputs are validated and requests are rate limited. No system is perfectly secure, but we work to protect your data and will notify affected users of a breach as required by law.

Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Tickline is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as Tickline evolves. Material changes will be highlighted in the app; the effective date above shows the latest version. See also our Terms of Service.