Privacy.

What is stored with your account

• Your email address, used to sign you in.
• Your password, stored only as a salted scrypt hash. Nobody can read it back.
• Your watchlist: the stocks you saved and any unfinished setup.
• Your preferences, including the optional display name you set in Settings.

These live in a Prisma Postgres database. The app runs on Cloudflare Workers.

What stays in your browser

• A signed session cookie that keeps you logged in. It is required for the app to work.
• A working copy of your watchlist and preferences in local storage, so the app works while it syncs.

Security records

To slow down password guessing and bulk sign-ups, Watchlist counts sign-in, registration, and password-confirmation attempts per email address and per network address. Only a one-way hash of the email or address is stored, and each count expires after 15 minutes, or an hour for registration.

Market data

Prices come from Twelve Data. The server requests them; nothing about you is sent. For a stock outside the tracked set, your browser may load that company’s logo directly from Twelve Data.

Deleting your data

You can delete your account at any time in Settings, under Account & security. That removes your account, watchlist, and preferences from the database at once. Signing out and clearing this site’s data removes the browser copy.

Questions? Open an issue on GitHub.