Privacy policy

What we collect

Everything below is data you provide or ask Bitnora to import. There is no advertising network, no third-party analytics script, and no tracking pixel on this site or in the app.

• Account details. Your email address, an optional display name, and a bcrypt hash of your password. The password itself is never stored and cannot be recovered from the hash.
• Portfolio data. The positions, trades, dividends, cash movements, targets, and rebalance order drafts you enter or import — plus the daily valuations and snapshots Bitnora derives from them.
• Brokerage statement data. When you connect Interactive Brokers or upload a Flex report, Bitnora stores the positions, transactions, and cash activity in that statement, along with the account identifier it carries.
• Your IBKR Flex token and query ids. Encrypted at rest with AES-256-GCM when the deployment has an encryption key configured. The token is read-only (see below) and you can revoke it in IBKR at any time.
• Notification preferences and push subscriptions. Which alerts you want, at what drift threshold, and the browser push endpoint if you enabled push notifications.
• Anything you send us. The contact and invite-request forms deliver your name, email address, and message to the operator's inbox. Nothing from those forms is written to the database.
• Ordinary server logs. The hosting platform records requests, including IP addresses, for operations and abuse prevention. The public forms also keep a short-lived in-memory count per IP address to rate-limit submissions; it is discarded within the hour and never stored.

Broker access is read-only

Bitnora connects to Interactive Brokers through a Flex query — a report you generate in your own IBKR account and authorize with a token. That token can fetch statements and nothing else. It cannot place or cancel trades, move cash, change account settings, or see anything the report does not include. Revoking it in IBKR ends Bitnora's access immediately, and the data already imported stays in your account here until you delete it.

Who else processes your data

Bitnora is a small operation built on other people's infrastructure. These are the services involved and what each one actually sees:

• Vercel — hosting and serving. Sees requests to the app, including IP addresses, and runs the code that touches everything else.
• Neon — the managed PostgreSQL database where your account and portfolio data are stored.
• Financial Modeling Prep (FMP) — market data. Receives tickers and date ranges so prices, profiles, and fundamentals can be fetched. It is never told whose portfolio a ticker belongs to, or how much of it you hold.
• OpenRouter, and through it Anthropic — the models behind AI portfolio reviews and portfolio chat. This one is different from the others: a review sends your holdings, weights, drift, income, and performance figures in the prompt, because that is what it is reviewing. It is sent without your name or email address, and only when you ask for a review. If you never run one, nothing about your portfolio ever reaches a model.
• Resend — transactional email: alerts, digests, and the messages sent through the forms on this site. Sees your email address and the contents of those emails.
• Interactive Brokers — the source of imported statements, at your instruction.

Each of these has its own privacy policy and its own sub-processors, which Bitnora does not control. A self-hosted deployment may use a different set; the operator of the instance you are using is the one who decides.

What we do not do

Your data is not sold, rented, or shared for advertising, and it is not used to train anyone's models. It is not pooled into a product for third parties, anonymized or otherwise. The processors above are used to run the service, not to monetise you.

How long it is kept, and deletion

Your data stays for as long as your account exists, because a portfolio tracker with no history is not a portfolio tracker. Ask for deletion through the contact form and your account, portfolios, holdings, transactions, snapshots, connections, and stored tokens are removed. Backups roll off on the hosting provider's own schedule, so a copy may survive in a backup for a short period after deletion.

You can also disconnect Interactive Brokers on its own — that deletes the stored token and stops future syncing while leaving the imported history in place.

Security, honestly stated

Passwords are hashed with bcrypt. IBKR Flex tokens are encrypted at rest with AES-256-GCM when the deployment has an encryption key set. Traffic is served over HTTPS, sessions are signed cookies, and every private route is checked both at the edge and again on the server.

That is a reasonable baseline, not a guarantee. Bitnora is a beta run by a very small team, it has not had a third-party security audit, and no service can promise it will never be breached. Use a unique password, and if a breach affects your data you will be told.

Cookies

One session cookie, set when you sign in, so the app knows who you are. Some preferences (such as your theme) are kept in your browser's local storage. There are no advertising or analytics cookies, so there is no consent banner to dismiss.

Changes to this policy

Bitnora is in beta and this document will change as the product does. The date at the top is the last revision. Material changes — a new processor, a new category of data — will be announced by email to registered users rather than quietly edited in.

Getting in touch

Questions about any of this, requests for a copy of your data, or a deletion request: use the contact form. It reaches a person, not a queue.