Privacy policy

1. Data controller

Auralfa is an independent project based in Switzerland. For any question about your data: [email protected].

2. Data collected

We collect only what the service needs: your email address, your password (stored in derived and salted form, never in clear text), your first name, surname and date of birth if you provide them during the sign-up questionnaire, your preferences (theme, score weighting, watchlist), the portfolio positions you enter, and technical connection data (logs, IP address) kept for security purposes. The sign-up questionnaire can be skipped: these three items are optional, and an account works identically without them.

3. Purposes

This data serves only to provide the service: authentication, personalisation, sending alerts and email reports if you turn them on, and account security.

4. Cookies and analytics

A strictly necessary cookie (session token access_token, httpOnly) keeps you signed in. It is not used for advertising tracking.

With your consent only, we use analytics tools to understand how the site is used and improve it: Google Analytics 4 (anonymised IP address) and Microsoft Clarity (usage statistics). Neither fires before you have accepted the “Analytics” category.

An “Advertising” category appears in the consent banner. As of today no advertising cookie is active. Were that to change, nothing would fire without your agreement.

You can change or withdraw your consent at any time through the “Manage cookies” link at the foot of the page.

5. Data sharing

Your personal data is never sold. It may be processed by technical providers acting on our behalf: our host, the document analysis provider described in point 6, and, if you consent, the analytics tools mentioned above. No other sharing for commercial purposes takes place.

6. Subcontractors

To extract the rows of a statement you import as a screenshot or a scanned document, that document is sent to our analysis provider, Anthropic PBC (United States).

• Data concerned : the content of the document you upload, that is the security names, quantities, prices and dates it carries.
• Purpose : extracting the rows, once, to spare you manual entry.
• Retention : the document is never written to our servers. It is read in memory, transmitted, then dropped. No copy is kept on our side.
• Trigger : this transmission happens only if you click the corresponding button. It never happens automatically.
• An alternative with no transmission at all : CSV import, Excel import and the import of a document carrying a text layer, that is the vast majority of broker statements, are handled entirely on our European servers. Not one byte leaves them.

7. Security

Traffic is encrypted (HTTPS). Passwords are derived and never stored in clear text. Backups are encrypted.

8. Hosting and retention

The data is hosted on servers located in Europe (Hetzner, Germany). It is kept for as long as your account is active, then deleted on request.

9. Your rights

Under the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the European GDPR, you have a right of access, rectification, erasure and objection. To exercise them: [email protected].

10. Contact

For any question about the protection of your data: [email protected]