Privacy policy

Apertira is a personal-finance analytics tool for UK investors. “Apertira” is a trading name, and the operator of this service is the data controller responsible for your personal data under UK GDPR and the Data Protection Act 2018.

You can reach us at privacy@apertira.com. A postal address is available on request. Our registration with the UK Information Commissioner’s Office (ICO) is in progress; we will publish the registration number here once it is confirmed.

• Account: your email address, the first name you give us (used to greet you), and a hashed password. We never store your password itself, it is hashed with PBKDF2-SHA256 and cannot be reversed.
• Portfolio data: transactions you import from broker statements or CSVs, and the instruments, dates, quantities, prices, fees and taxes within them.
• Value history: periodic snapshots of your portfolio’s value (net worth and its parts) so we can show a trend over time. These are derived from the data above, not new information about you.
• Balance sheet: assets and liabilities you enter yourself, such as property values, pensions, savings and mortgages.
• Planning settings: your tax band and, if you provide it, your annual income, used to calculate your tax position. Also your own guardrails (position and cash limits) and any custom benchmark you set.
• Email summary preference (if you opt in): whether you’ve chosen a weekly or monthly email summary. It is off unless you turn it on, and every email has a one-click unsubscribe.
• Bank connections (if used): access and refresh tokens for accounts you connect via Open Banking. These are encrypted at rest. We do not store your banking credentials, you authenticate with your bank directly, never through Apertira.
• Broker credentials (if used): if you connect Trading 212, the read-only API key and secret you generate in their app are stored encrypted at rest so we can sync your holdings. They cannot place trades, and you can disconnect at any time.
• Technical logs: to keep the service secure and prevent abuse, our infrastructure records limited technical data such as your IP address and request timestamps (for example to rate-limit sign-in attempts). These logs do not contain your financial data.

• We do not sell or share your data with third parties for advertising.
• We do not use advertising or cross-site tracking cookies, and we run no analytics.
• We do not make automated decisions that produce legal effects about you.
• We never ask for, receive, or store your bank or broker login details.
• We never place trades, move money, or act on your accounts, access is read-only.

• To provide the service you asked for (performance of a contract, UK GDPR Article 6(1)(b)) — storing and analysing the portfolio and account data above is what makes the tool work.
• To keep the service secure (legitimate interests, Article 6(1)(f)) — the technical logs and rate-limiting that protect your account and prevent abuse.
• To send optional email summaries (consent, Article 6(1)(a)) — only if you opt in, and you can withdraw at any time using the unsubscribe link in every email or by turning them off in the dashboard.

We do not use tracking or advertising cookies. The only thing we store on your device is a small login token in your browser, which is strictly necessary to keep you signed in. Full details are in our cookies notice.

We use a small number of service providers (processors) who handle data on our behalf:

• Railway — hosts the database your data is stored in.
• Vercel and Cloudflare — serve and route the website.
• Resend — sends email (password resets, and summaries if you opt in), so it processes your email address and the figures in that email solely to deliver it.
• Market-data provider — prices are fetched by ticker only; the feed is never told who you are or what you hold in what size.
• Trading 212 / TrueLayer — only if you choose to connect them, and only to read the data you authorise.

Some of our providers are based outside the UK (for example in the United States). Where your data is transferred abroad, it is protected by appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement / Standard Contractual Clauses.

The site is served only over HTTPS. Passwords are hashed (PBKDF2-SHA256), and bank tokens and any broker API credentials are encrypted at rest. We rate-limit sensitive actions to resist abuse. No system is perfectly secure, but we take reasonable measures to protect your data and store as little as we need.

You have the right to access, correct, export (portability), delete, or restrict the use of your data, and to object to processing based on legitimate interests. Deleting your account from the dashboard removes everything we hold about you, transactions, value history, balance sheet, settings, any stored bank tokens or broker credentials, and the account record itself, permanently and immediately. If you would rather we did it, email the address above.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put things right first.

For as long as your account exists. Delete the account and the data goes with it; we do not retain a shadow copy. Technical logs, which do not contain your financial data, are retained by our hosting providers on their own short schedules.

Apertira is intended for UK residents aged 18 or over. It is not directed at children, and we do not knowingly collect data from anyone under 18.

If we change this policy we will update the date at the top, and for significant changes we will make it clear in the app before the change takes effect.