Privacy Policy

This page is a working draft, not a finished legal document. It has not been reviewed by a lawyer. It describes, honestly, what FlowDesk's code actually stores today — not a generic template.

If you create an account:

• Email and a hashed password — the password itself is never stored, only a one-way hash
• A display name, if you set one
• Your watchlist and preferences — the symbols and settings you choose
• Portfolio positions you enter manually — symbol, share count, cost basis
• Sign-in timestamps, for security purposes

If you generate a FlowDesk API key (for programmatic access, under Account → API keys), we store a one-way hash of it, never the key itself — the same way we handle your password.

FlowDesk does not store brokerage credentials per user. Auto-trade, where enabled, connects through a single Trading212 API key configured at the application/server level by the operator — your individual account never asks you for, or stores, a brokerage API key of your own.

Account data is used to run the site: showing your watchlist, tracking the portfolio positions you enter, and personalizing what you see. We do not sell your data. We do not share it with third parties except where a third-party service is directly involved in providing the feature you're using (for example, placing an order through Trading212, only when you've explicitly enabled auto-trade).

Signing in sets a session cookie so you stay signed in between visits. It is used only for authentication — not for tracking or advertising.

To request a copy of your data or account deletion, contact us at the support address on the About page. This process is manual today; a self-service option is planned.

This policy may change as FlowDesk's data handling evolves. Material changes will be reflected here with an updated date.

Draft — last edited alongside the codebase, no formal version yet.