Private by default.

• Passwords are hashed with bcrypt; sessions use short-lived, signed JWTs - never stored in plaintext.
• Every household's data is isolated. Access checks run on every single request, not just at login.
• The Ask-AI feature calls the AI provider server-side only - your browser never talks to it directly.
• Your data is stored to build your own portfolio view. It is never sold, and never used to train anything.
• Our application servers and database are hosted in the Asia-Pacific region (Singapore) - see the Privacy Policy for details.