Privacy Policy

This policy explains what data QuantStark collects, why we collect it, and how we handle it. We intentionally collect as little as possible and never sell, rent, or share your information for advertising.

1. Who we are

QuantStark Analytics Private Limited ("QuantStark", "we", "us") operates this service. The Service is accessible at quantstark.com and quantstark.ai (which redirects to quantstark.com). For any privacy question, contact [email protected].

2. What we collect

• Google account data (via OAuth): your email address, name, profile picture, and Google account ID. We do not request access to your contacts, calendar, or any other Google data.
• Email address and password: if you register with email and password instead of Google OAuth, we store your email address and a securely hashed password. We never store your plaintext password.
• Session cookie: a signed cookie to keep you logged in.
• Portfolio uploads: the contents of any holdings file you upload (tickers, shares, dates).
• Brokerage connection data: if you link a brokerage, an encrypted access token that lets us fetch your holdings on your behalf, and the holdings we sync (tickers, share counts, and cash balances). We never receive or store your brokerage login credentials.
• Brokerage cash-flow records: for linked brokerage accounts we also store cash-flow records (deposits, withdrawals, and transfers), specifically the date, signed amount, and transaction type, so we can compute time-weighted returns that properly account for money moving in or out of your account. These records are subject to the same retention, deletion, and security practices as your holdings data.
• Server logs: IP address, user agent, URL requested, timestamp.
• Website analytics: on the public website pages only (the home page, blog, Under the Hood and other pages you can read without signing in), Google Analytics records page views, how you arrived (for example from a search or a link), approximate location, and device and browser type, using its own cookies. It runs nowhere in the signed-in app, so it never sees your portfolios, holdings or account.
• Preferences and rules you set: view settings (such as date range and benchmark) and any standing target you choose to save (for example, keeping a sector below a percentage you pick) are stored per portfolio so we can remember and watch them for you.

The signed-in app uses no analytics cookies or third-party trackers, and we use no advertising pixels anywhere.

3. Why we collect it

• Authentication and displaying who is logged in.
• Running the attribution, risk, and optimizer calculations you request.
• Persisting your portfolios across sessions so you can review previous analyses when you log back in.
• Syncing holdings from connected brokerage accounts so we can run analytics on your current positions.
• Keeping the service secure and diagnosing problems.

4. How long we keep it

• Portfolio data: encrypted at rest and retained for as long as your account is active and your portfolios remain in use. Portfolios that have not been accessed or modified for 180 days are automatically deleted. You can also delete any portfolio manually at any time.
• Brokerage connection: the encrypted access token is kept until you disconnect the brokerage or delete your account, whichever comes first; disconnecting removes it immediately and revokes our access through SnapTrade. Holdings synced from a connected brokerage are stored like an uploaded portfolio and are deleted within 30 days of disconnecting the brokerage or deleting your account.
• Session cookie: until you log out, close your browser, or it expires.
• Account record (your email and display name): until you request deletion. When you delete your account, all associated portfolio data is hard-deleted from our database within 30 days.
• Server logs: up to 30 days, then rotated and deleted.

5. Who we share it with

• Google, as your sign-in provider, receives only your authentication data (email, name, profile picture). Separately, the emails we send you (sign-in and password links, account notices and any alerts you turn on) are delivered through Google's Gmail service, so their contents pass through it.
• DigitalOcean provides the server infrastructure and managed database that runs QuantStark, both located in US data centers. Portfolio data is stored in a DigitalOcean managed database with encryption at rest enabled. DigitalOcean does not access, read, or process application-level data. This is an infrastructure relationship, not a data-sharing relationship.
• Cloudflare provides our domain registration and DNS, and operates as a reverse proxy and content delivery network (CDN) in front of the Service. Web traffic to QuantStark passes through Cloudflare's network, which provides TLS encryption, caching of static assets, and protection against denial-of-service attacks. As a proxy, Cloudflare processes connection data (such as IP addresses and request details) and traffic in transit, but does not store your portfolio holdings or use your data for any purpose other than delivering and securing the Service.
• SnapTrade (operated by Passiv Technologies Inc., a Canadian company) provides the technology that connects your brokerage account to QuantStark so we can retrieve your holdings. It is a service provider acting on your behalf: we do not send it your QuantStark data beyond an opaque account identifier needed to establish the link, and your brokerage login is entered directly with SnapTrade and never seen or stored by us. SnapTrade returns your current holdings (tickers, share counts, and cash balances), which we store and use exactly as we do a manually uploaded portfolio. The connection is optional, read-only (we cannot place trades), and you can disconnect it at any time, which revokes our access. SnapTrade processes this data in Canada under its own privacy policy.
• Google Analytics receives the website visit data described in section 2, from the public website pages only, and processes it under Google's privacy policy. It never receives your portfolio holdings, account details or any analytics output. You can block it with your browser's tracker protection or Google's opt-out add-on.
• Anthropic provides the AI model that writes the plain-language explanations in the app. It receives the figures each explanation needs (such as tickers, weights and returns our engine has already computed), not your login details.
• Formspree delivers what you send through the contact and request-access forms on this website: your name, email address and message.
• No one else. We do not sell data, run ads, or share it with data brokers.

Your portfolio holdings are never sent to any third-party data provider.

Brokerage-account holdings synced through SnapTrade follow the same retention, security, and non-sharing practices as uploaded portfolios described above. Disconnecting a linked brokerage stops further syncing and removes the stored connection.

6. Connected apps (MCP connector)

• When you approve a connection, the app you connected can read every portfolio on your account: holdings, performance, values in dollars, and which broker each portfolio syncs from.
• That data flows to the third-party app you connected (for example Claude). Their handling of it is governed by their privacy policy, not ours.
• You can revoke a connection at any time from Account, then Connections. Revoking takes effect within about a minute. Logging out of QuantStark does not revoke connections; changing your password revokes all of them.
• We record when each connection was created and last used, and nothing else about your conversations with the connected app.

7. Your rights

You can request access to, export, or deletion of your QuantStark account data at any time by emailing [email protected] from the address associated with your account. We will confirm receipt and complete the request within 30 days. You can also delete individual portfolios directly within the Service. You can disconnect any linked brokerage at any time from the brokerage-connection page, which removes the stored connection and revokes our access through SnapTrade. You can revoke QuantStark's access to your Google account at myaccount.google.com/permissions.

When you delete your account, all associated portfolio data is hard-deleted from our database within 30 days.

8. Security

Portfolio data stored in our database is encrypted at rest. All data in transit is encrypted with TLS. Session cookies are marked Secure, HttpOnly, and SameSite=Lax. The application accesses market-data tables through a read-only role and can write only to your own account's records. Brokerage access tokens are additionally encrypted at the application layer before storage, so they remain unreadable even with direct database access. Access to production data is restricted to authorized personnel for the purpose of operating and improving the Service. No system is perfectly secure, but we aim to follow reasonable industry practice.

For additional details on infrastructure and security practices, see our Security page at quantstark.com/security.

9. Children

QuantStark is not intended for users under the age of 18. We do not knowingly collect data from children.

10. Changes to this policy

If we make material changes, we'll update the effective date at the top of this page and, where appropriate, notify logged-in users. Continued use of the service after a change means you accept the updated policy.

11. Data location

Your data is stored and processed on infrastructure located in the United States. The one exception is our optional brokerage connection: if you link a brokerage, that connection and the holdings it syncs are processed by SnapTrade (Passiv Technologies Inc.) in Canada.

12. California privacy rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA): the right to know what personal information we collect, the right to request its deletion, and the right not to be discriminated against for exercising these rights. To exercise these rights, contact [email protected]. We do not sell personal information.

This Privacy Policy works alongside our Terms of Service at quantstark.com/terms.

QuantStark is for informational and educational purposes only. Nothing on this site constitutes financial, investment, legal, or tax advice. Past performance does not guarantee future results. Always consult a qualified professional before making investment decisions.