Early preview

Privacy at InvestmentOS

InvestmentOS is an early preview. Product features and availability may change. This page describes personal data the service processes during this preview.

Who is responsible

InvestmentOS is operated by Quim Barrera, Barcelona, Spain, contactable at quim.barrera@proton.me or through the Contact form.

What we process and why

When you use the preview, InvestmentOS stores data needed to run the account and the features you use:

Account details: username, email when provided, a password hash if you sign in with a password, last sign-in, whether the account is active, and how the account first joined (invitation, public signup, or administrator). While the preview is private, new public accounts require a valid invitation. Application administrators can also see role and authentication method.
Sign-in with Google, when that option is configured: Google receives the sign-in request. InvestmentOS stores Google’s stable account identifier and verified email so it can sign you in again. Google access tokens are not stored. A different Google identity is not attached automatically if you lose access to the original Google account.
The instruments you follow, swing-trade plans and executions, transactions, portfolio holdings, review notes, alert rules, in-app notification preferences, and other records you save, so the workspace can show them back to you.
A Tiingo API token, if you choose to connect one: it is stored encrypted and used only to request market data for your account from Tiingo.
Telegram connection details, if you connect the InvestmentOS bot: chat id and, when Telegram provides them, Telegram user id and username. Alert text (instrument, condition, levels and a link back into the app) is sent through Telegram’s API to that chat.
Contact messages: name, email address, message text, the Contact page as the source, and your account if you were signed in. These are stored so the operator can reply. Only application administrators can read them in Administration. Other users cannot see them. In-app product feedback is not implemented and is not collected here.
Access requests from the public Request access form: email, an optional one-line answer about intended use, date and status. Duplicate or already-known emails are not confirmed back to the visitor. Only application administrators can read them in Administration → Users. Submitting a request does not send email or Telegram.
Invitation records created by an administrator: intended recipient email, optional private note, expiry, send time, delivery failure note, status, and the account that accepted the invitation when that happens. The normal Invite action emails the create-account link from a configured mail server. Copying the link is a manual fallback. The signup form shows the invited email to someone who opened the link. Password invitations rely on that email delivery, not on typing the address into a form.
Password reset and, when public registration is enabled, email confirmation messages: the address you entered and a single-use link. The confirmation shown after submit does not say whether an account exists. Google-only accounts are asked to continue with Google instead of resetting a password they do not have.
Technical and security logs, job-run records and short-lived connect codes, to operate, protect and troubleshoot the service. Logs are written without passwords, tokens, invitation or reset URLs, or authorization headers.

Who else may receive data

Google, if you use Google sign-in (profile and email scope) or if your browser loads the Inter font from Google Fonts on public pages.
The configured email provider, when sending invitation, password-reset or email-confirmation messages.
Telegram, if you connect notifications: chat identifiers and alert message content.
Yahoo Finance, as the default server-side source of daily bars. Those requests identify instruments, not your login.
Tiingo, if you connect a token: that token and the instrument requests made with it.
Frankfurter (ECB-derived EUR/USD reference rates), as a server-side lookup when a euro equivalent is requested for a USD fill.

The application and its PostgreSQL database run in Docker behind Caddy for this preview. Contact messages and access requests stay in that database and are not emailed or sent to Telegram. Invitation, password-reset and email-confirmation messages are emailed only when mail is configured.

Legal basis and retention

Account, portfolio and related records remain stored while the account exists. An application administrator can deactivate an account so it can no longer sign in; deactivation does not by itself erase stored records. Contact messages remain stored until an application administrator deletes them. No automatic deletion schedule is configured.

Your choices and rights

You can sign out, disconnect Telegram, replace or remove a Tiingo token, and change in-app and Telegram alert preferences. There is no in-app control to delete an account or export a full personal-data file.

Where a data-protection law applies, you may ask for access, correction, deletion, restriction, portability or objection through the Contact form or at quim.barrera@proton.me, and you may complain to your data protection authority.

Cookies and local storage

The preview uses a CSRF cookie to protect form submissions and a session cookie after you sign in. Brief status messages may be stored in the session or a short-lived messages cookie. Signed-in instrument charts may keep moving-average overlay choices in the browser’s session storage. No analytics or advertising trackers were found in this application.

Last updated: 16 September 2026.