This policy explains what information PositionMgr collects, why, and what we do with it. The short version: we collect what the product needs to run, we don't sell your information, we don't fund the product by sharing anyone's trading data, and your book is visible to you and the people you invite — no one else.
Information we collect
- Account information. Your name and email address, provided when you sign up or are invited. Sign-in is handled by Auth0; we never see or store your password. Each sign-in is recorded (time, IP address, device) to protect your account.
- Your trading data. Positions, plans, ideas, fills, journal entries, reviews, notes and settings you create in the product. Notes and journal fields are free text; they are stored like everything else here.
- Brokerage data you connect. If you link a brokerage account, transactions, holdings and balances are imported read-only through SnapTrade, our aggregation partner. You authorize the connection at your broker or in SnapTrade's own portal — your brokerage login never passes through us, and nothing we do can place, change or cancel an order or move money. Full brokerage account numbers are truncated on arrival; we store only the last four digits. The connection credential is held encrypted and is revoked when you disconnect.
- Billing. Payments are processed by Stripe. Your card details go to Stripe directly and never touch our servers. We keep a reference to your Stripe customer record, your plan and its status.
- Notifications. If you turn on alerts for a device, we store that device's push address. Alerts travel through the push service of the device's platform (Apple, Google or Mozilla), encrypted so that the service sees where and when, never what.
- People you invite. When you invite someone to your workspace, you give us their email address so we can send the invitation.
- How the product is used. We record which features are used and when, under a random token that is kept apart from your identity. We use this to see which parts of the product people use and keep coming back to, and to improve it. We look at it only in totals by plan and never try to work out who is behind a token.
- Contact form. Name, email and message when you use the join or information form on this site. We send you an acknowledgement and a copy to our own mailbox.
- Website visits. This site keeps a count of page views: the page, the referring site, and a token derived from your connection that changes every day and cannot be turned back into your IP address. No cookie is set and visits cannot be linked from one day to the next.
- Technical data. Standard server logs (IP address, request times) kept for security and operations.
How we use it
- To run the product: maintaining your book, reconciling imported transactions, computing analytics, and showing you your own data.
- To bill you for the plan you chose.
- To send notifications you have turned on and the emails the service needs to send (invitations, receipts, replies to your messages).
- To keep the service secure, investigate abuse and support you.
- To understand how the product is used and improve it.
We do not sell personal information, share it for advertising, sell or share aggregated trading or order data, or use your trading data for any purpose other than providing the service to you. We do not send your data to AI services; if that ever changes we will say so here first.
Who else touches the data
A small set of service providers, each doing one job, all in the United States:
- Auth0 (Okta) — sign-in and multi-factor authentication.
- SnapTrade — the read-only pipe between your broker and your book, authorized by you.
- Amazon Web Services — our servers and encrypted backups.
- Stripe — payments and invoices.
- Resend — sending the emails described above.
- Apple, Google and Mozilla push services — delivering alerts to devices you registered.
- Market data providers — price lookups send ticker symbols only, never anything about you.
Each provider is bound by contract to use the data only to do its job for us. No provider receives usage data. If we add a provider that handles your data we will update this list.
How it's protected
All traffic is encrypted in transit. Stored credentials are encrypted at rest. Customer accounts require multi-factor authentication. Each customer's data is isolated at the database layer, and every edit is recorded in an audit trail. Backups are encrypted and copied off-site. If a security incident affects your data, we will tell you. No security is absolute, but protecting this data is a design requirement of the product, not an afterthought.
The demo workspace
The demo is a shared workspace with a shared login. Anything you type there can be seen by other people using the demo and is wiped every night. Do not put real account information in it.
Cookies
The application uses essential session cookies to keep you signed in, and your browser's local storage for on-device preferences such as the last sizing you used — nothing else. This marketing site sets no cookies. We honor the Global Privacy Control signal from your browser; since we do not sell or share personal information, there is nothing it needs to switch off.
Retention and deletion
We keep your data while your account is open. When you close your account, or ask us to delete your data, we delete your account details, positions, trades, history, plans, notes, sign-in records and audit trail within 30 days, and encrypted backups roll off on a fixed schedule after that. Billing records stay with Stripe for as long as tax and accounting law requires. Usage records are kept as statistics: when your account closes, the link between you and your token is destroyed, and what remains cannot be tied to you. To get a copy of your data or close your account, email info@positionmgr.com.
Your choices
- Disconnect a brokerage at any time — imports stop immediately and the connection is revoked.
- Turn notifications on or off per device.
- Ask us what we hold about you, correct it, get a copy, or have it deleted.
Residents of California and other states with privacy laws
You may have the right to know what personal information we hold, to have it corrected or deleted, and to be free from discrimination for exercising those rights. We do not sell or share personal information, so there is nothing to opt out of. Email info@positionmgr.com and we will handle it within the time the law allows.
Where the data lives
PositionMgr is operated from the United States and your data is stored there. If you use it from elsewhere, you are sending your data to the United States.
Children
PositionMgr is not directed at anyone under 18, and we do not knowingly collect information from children.
Changes
If this policy changes, we will post the update here with a new effective date. If the change matters to how we handle your data, we will also email account holders.
Contact
Questions about privacy: info@positionmgr.com