Privacy Policy

Polarix is a portfolio tracker. To do its job it holds a record of what you have bought and sold, which is information about your finances, so this page sets out exactly what is stored, why, and who else can see it. It is written to be read rather than to cover us.

Who is responsible for your data

Hisham Yafi, trading as Polarix, is the data controller for the purposes of UK GDPR, and can be contacted at info@polarixinvesting.com.

What we store

Your account

• Your name and email address.
• A hash of your password, never the password itself. It is hashed with bcrypt, and it cannot be reversed to recover what you typed.
• Your chosen base currency, and whether you have finished setting up.
• If you sign in with Google, the account identifier Google returns, and your profile picture if it provides one.

Your investments

• Every transaction you import or enter: date, instrument, quantity, price, fees and currency. This is the most sensitive thing here.
• The portfolios you group them into, and any watchlists you build.
• A record of each import, so a file you have already uploaded is not counted twice.

Anything you post

Posts, comments and likes on the Social tab, and who you are connected to. Treat these as public to other signed-in users of Polarix. Nothing about your portfolio is published there unless you write it yourself.

Private messages

The direct messages you send and receive on the Social tab, and who they are with. Unlike posts, these are private to you and the person you are messaging— no other user can see them. We store them so the conversation is there when you come back. They are held in our database as ordinary text, not end-to-end encrypted, so — like the rest of your data — they could in principle be read by someone with access to that database; we keep that access tight. They are included in a data export and are deleted when you close your account.

Keeping the door shut

When somebody signs in, asks for a password reset or creates an account, we record the IP address it came from and count the attempts. It is the only thing standing between a script and unlimited password guesses, and it is why you may be asked to wait after several failed tries.

These counts are not used for anything else. We do not build a picture of where you are or what you do from them, and they are deleted once they are more than a day old.

Why we are allowed to hold it

• To provide the service you asked for. We cannot calculate a return without the transactions it is calculated from. Lawful basis: performance of a contract.
• To keep the account secure and to answer you when you write in. Lawful basis: legitimate interests.

Who else sees it

Your transactions are never sent anywhere. To price them we ask public market-data sources about the instruments themselves, which involves sending a ticker symbol and nothing else. Those requests are made by our server, so your browser never contacts these companies and they never receive your IP address:

• Yahoo Finance for prices, company data and news headlines.
• SEC EDGAR for the published financial statements of US-listed companies.
• Financial Modeling Prep for company logo images.
• CNBC for news headlines.

One narrow exception, and only if you import a file from a broker the app has never seen before: the column headings of that file and up to three sample rows are sent to Anthropic’s API so it can suggest which column is which. A heading is not personal data; a transaction history is, and the rest of the file never leaves our server. If you would rather it did not happen at all, map the columns yourself using the form on the import screen.

If you share a link in a post or a direct message, our server fetches that page once to build the small preview shown beneath it. The request goes from us, not from your browser, so the site you linked to sees a request from Polarix and never your or the recipient’s IP address; any preview image is fetched and re-served by us for the same reason.

We do not sell your data, we do not share it for advertising, and there are no third-party trackers on this site.

The companies that store it for us

The section above is about who we ask things of. This one is about who actually holds your data, which matters more. Running this app needs a small number of suppliers. Under data protection law they process your data on our instructions only, and may not use it for anything of their own.

• Vercel serves the website. Every page you load is handled by them, so they necessarily see your IP address and which pages you asked for.
• Neon hosts the database. This is where your account, your portfolios and every transaction you have imported actually live.
• Stripe takes the payments. Your card details are entered on Stripe’s own pages and never touch our servers — we only ever store the identifiers Stripe gives us for your customer and subscription record.
• Sentry tells us when something breaks. Reports are stripped before they are sent: passwords, tokens, cookies, the contents of any request and your email address are all removed, leaving the error and the line of code it came from.
• Amazon Web Services delivers the few emails we send — password resets, and a note if you cancel — through Amazon SES in Ireland. They see your email address and the message itself.
• Google, and only if you chose to sign in with a Google account rather than a password. If you did not, Google is not involved at all.

Where your data is held

Your portfolio itself does not leave the country. The database holding your account, your holdings and every transaction you have imported is in London.

Email is sent from Ireland, which the UK recognises as offering equivalent protection, so nothing extra is needed for it. Some of the other suppliers above are based in the United States or may move data there while running their service; where that happens we rely on the safeguards UK data protection law allows — an adequacy decision where one exists, and otherwise the International Data Transfer Addendum to the standard contractual clauses.

If you want the specifics for any one of these companies, ask us and we will tell you.

If you email us an export

The import screen invites you to send us a file from a broker we do not yet support, so we can add it. That is entirely optional and nothing asks for it.

If you do: we ask you to delete your name, account number and address first, because we do not need them. We use the file to build and test the reader for that broker, and we keep it only as long as that takes. A redacted copy may be kept permanently as a test case - the columns and the numbers, with nothing identifying you - because that is what stops the reader breaking again later. It is never published, never shared, and never linked to your account.

Email us at info@polarixinvesting.com and we will delete anything you have sent.

Cookies

One, and it is strictly necessary: a session cookie that keeps you signed in. There is no analytics, no advertising and no tracking cookie, which is why you are not being asked to accept anything.

How long we keep it

For as long as you have an account. Delete a portfolio and its transactions go with it. Ask us to close your account and we will erase your data within 30 days, other than anything we are required to keep by law.

The sign-in counts described above are the exception, and they go much sooner: they are deleted once they are more than a day old, whether or not you still have an account.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of what we hold, or export it in a portable form;
• correct anything that is wrong;
• delete your account and everything in it;
• restrict or object to what we do with it.

Email info@polarixinvesting.com and we will act within one month. If you think we have got it wrong you can complain to the Information Commissioner’s Office.

Security, stated plainly

Passwords are hashed, the connection is encrypted, and if you ever connect a broker the credential is encrypted before it is stored, with the key held separately from the database. No system is perfect; if something goes wrong that affects you, we will tell you.

Children

Polarix is not for under-18s and we do not knowingly hold their data.

Changes

If this page changes in a way that matters, we will say so before it takes effect rather than quietly editing the date at the top.

See also our Terms of Service.