Privacy Policy

Version 1.0 Last updated 2026-07-27

What we collect

Data	Why	Kept
Email address	Account identity and essential notices	Until you delete your account
Password	Authentication — stored only as an Argon2id hash, never in plaintext	Until you delete your account
Which weeks you viewed the list	Knowing whether the Service is being used	24 months
Positions you record	Your own performance tracking — self-reported, not read from any account	Until you delete them
Security audit log	Fraud and abuse investigation	24 months
Truncated IP address	Rate limiting and abuse prevention	90 days

We store your IP address only in truncated form — the final octet of an IPv4 address is discarded, and IPv6 is reduced to its /48 prefix. That is enough to stop someone brute-forcing logins and not enough to locate you.

Not on this list, and never will be: brokerage credentials, account numbers, balances, bank details, payment methods, your legal name, address, phone number, or date of birth. The Service has no feature that needs any of them.

What we do not do

We do not sell or rent your data. Not to anyone, for any price.
We run no advertising, analytics, or tracking services. There are no third-party scripts on this site — no Google Analytics, no pixels, no CDN. A third-party script on a page you are signed into is a third party reading your session.
We set no advertising or tracking cookies. The only cookies are your session and a CSRF token, both strictly necessary.
We do not build behavioural profiles. List views are recorded once per week, not per click.
We do not email you marketing.

Who else sees your data

Only what is unavoidable to run the Service:

Our hosting and database provider — stores the data at rest, encrypted.
A market data provider — we request public stock prices using our own credentials. It receives no information about you, and does not know you exist.

We disclose data to authorities only where legally compelled. There is nothing here that would let anyone access your money, under a court order or otherwise.

Your rights

Regardless of where you live, you can:

Access everything we hold — your dashboard and access log show it live.
Delete any recorded portfolio instantly, from your dashboard.
Delete your entire account and all associated data by emailing hello@nurbon.com. We action this within 30 days.
Export your data in machine-readable form on request.
Object or withdraw consent by ceasing to use the Service.

If you are in the EU/UK, our lawful basis is contract performance for account and trading data, and legitimate interest for security logging. You may complain to your local supervisory authority. If you are in California, we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA.

Security

Described in detail, including its limits, on the Security page. Summary: passwords are hashed with Argon2id, sessions are revocable, all traffic is TLS, and there is nothing financially sensitive stored to protect in the first place.

Data location and retention

Data is processed in the United States. If you are outside the US, you consent to that transfer by using the Service. Deleted accounts are purged within 30 days, except audit records required for fraud and security investigation, which are retained for 24 months and then deleted.

Children

The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, email hello@nurbon.com and we will delete it.

Breach notification

If we discover a breach affecting your data, we will notify you by email without undue delay and, where required, within 72 hours of becoming aware. Because we hold no brokerage access, no payment details, and no government identifiers, the realistic worst case is disclosure of your email address and the tickers you were tracking — change your password here, and anywhere you reused it.

Contact

hello@nurbon.com