Portfolio Analytics ("we," "us," or "our") is operated by Petru Ceciltan, based in Israel. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at portfolio.ceciltan.com.
When you create an account, we collect:
You provide the following data when using the service:
We automatically collect:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the portfolio tracking service | Contractual necessity |
| Account creation and authentication | Contractual necessity |
| Sending verification and password reset emails | Contractual necessity |
| Two-factor authentication and security | Legitimate interest (security) |
| Analytics and service improvement | Consent (via cookie banner) |
| Preventing fraud and abuse | Legitimate interest |
We use the following third-party services:
| Service | Purpose | Data Shared |
|---|---|---|
| Google Analytics (GA4) | Usage analytics | IP address, page views, device info |
| Google Tag Manager | Tag management | Page interactions |
| Google OAuth | Social sign-in | Email, name (from Google) |
| Gmail SMTP | Transactional emails | Recipient email, email content |
| Neon (PostgreSQL) | Database hosting | All user data (encrypted at rest) |
| Hostinger | Application hosting | Server logs, request data |
| Yahoo Finance API | Stock price data | Stock symbols (no user data) |
We do not sell, rent, or share your personal data with any third parties for marketing purposes.
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 7-day grace period |
| Portfolio & transaction data | Until account deletion |
| Authentication tokens | 24 hours (JWT), 30 days (trusted devices) |
| Email audit logs | 30 days (auto-deleted) |
| Analytics data | 14 months (Google Analytics default) |
| Server logs | 30 days |
When you delete your account, all associated data is permanently removed after a 7-day grace period. During this period, you can cancel the deletion by logging back in.
We implement the following security measures:
If you are located in the European Economic Area (EEA), you have the following rights:
To exercise any of these rights, contact us at the email below. We will respond within 30 days.
We use the following cookies and local storage:
Your data may be processed in:
Where data is transferred outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or the service provider's compliance frameworks.
Portfolio Analytics is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.
In the event of a data breach that poses a risk to your rights and freedoms, we will:
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the revised policy.
For privacy-related inquiries, data requests, or to exercise your rights:
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence.