How we handle your data
This page lists only things that really work this way now. If anything changes, we update this page first.
Can Kapitaaltrackr access my broker or bank?
No. There is no connection to a bank or broker. You download an export yourself and upload it. Kapitaaltrackr cannot trade and cannot move money.
What happens to the file I upload?
The file is read and processed in the server's memory and stored nowhere. The temporary file the web server makes for every upload is removed automatically after the request. What we keep are the rows that come out of it: your transactions, credits and debits, and dividends.
What do you store?
- Your account: name, e-mail address, a hashed password, and if you use two-step verification its encrypted secret.
- Your accounts and what you import or enter: transactions, your account's cash ledger (with DEGIRO's description), dividends, savings movements, goals and settings.
- For each signed-in session: the IP address and browser you signed in with, so your profile shows where you are signed in and lets you end sessions.
Is everything encrypted?
No, and we would rather say so honestly. The connection is encrypted (https), your password is hashed and your two-step verification secret is encrypted. Your other data is not separately encrypted in the database. There is no end-to-end encryption: the administrator can technically access the database.
Do you store my IBAN?
No. There is no field for an account number, and the exports Kapitaaltrackr reads do not contain one.
What do you measure?
Nothing. No analytics, no trackers, no ad networks. Like every server, the web server keeps a technical log (see the privacy statement).
Do you use cookies?
No. Signing in works with a key in your browser's storage, not with a cookie. What we keep in your browser is listed on Cookies.
Is my data ever sold?
No. We do not trade in data, show no ads and receive no commissions.
Can I download or delete my data?
A button to download everything and a button to delete your account are still to come. Until they are there, we do it on request: get in contact.
Where is the server?
With a hosting company in the European Union. Which company exactly is in the privacy statement.
I found a security problem.
Thank you for reporting it. E-mail us using the details on Contact. Do not try to access other people's data.