Privacy

Apertira is a personal-finance analytics tool for UK investors. For UK GDPR purposes the operator of this site is the data controller. Contact: jamesmoth66@gmail.com.

• Account: your email address and a hashed password. We never store your password itself — it is hashed with PBKDF2-SHA256 and cannot be reversed.
• Portfolio data: transactions you import from broker statements — instruments, dates, quantities, prices, fees and taxes.
• Balance sheet: assets and liabilities you enter yourself, such as property values, pensions, savings and mortgages.
• Planning settings: your tax band and, if you provide it, your annual income — used to calculate your tax position and rank where money should go.
• Bank connections (if used): access and refresh tokens for accounts you connect via Open Banking. These are encrypted at rest. We do not store your banking credentials — you authenticate with your bank directly, never through Apertira.

• We do not sell or share your data with third parties for advertising.
• We do not use advertising or cross-site tracking cookies.
• We do not make automated decisions with legal effects about you.
• We never ask for, receive, or store your bank login details.

We process this data to provide the service you asked for — performance of a contract with you under UK GDPR Article 6(1)(b). You can withdraw by deleting your account at any time.

Your data is stored in a Postgres database hosted by Railway, and the site is served by Vercel. Market prices are fetched by ticker only — the price feed is never told who you are or what you hold in what size. If you connect a bank, TrueLayer acts as the Open Banking provider for that connection.

You can access, correct, export or delete your data. Deleting your account from the dashboard removes everything we hold about you — transactions, balance sheet, settings, any stored bank tokens, and the account record itself — permanently and immediately. If you would rather we did it, email the address above.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

For as long as your account exists. Delete the account and the data goes with it; we do not retain a shadow copy. Server logs, which do not contain your financial data, are retained by our hosting providers on their own schedules.