Privacy Policy

Last updated: August 31, 2026

Sharpe is a small, personally-operated service. The short version: we collect only what the features need, we don't sell your data, and we don't run ads.

What we collect

Google account basics — name, email, and avatar, used to sign you in and identify your data.
Data you enter — positions, cash balance, watchlist, notes, research documents, and preferences.
Brokerage holdings, if you link one — via Plaid Investments, read-only. Your brokerage credentials go to Plaid, never to us; we receive holdings (tickers, quantities, cost basis) and store the Plaid access token encrypted (AES-256-GCM). Unlinking removes the connection at Plaid.
API keys you add — e.g. an Anthropic key, stored encrypted (AES-256-GCM) and used only to make requests on your behalf.
Aggregate usage analytics — page views via Vercel Analytics, without cross-site tracking.

What we never collect

Card numbers (payments are handled entirely by Stripe), brokerage passwords (handled entirely by Plaid), and we never sell or rent personal data to anyone.

How your data is used

To run the features you use: showing your portfolio, generating AI summaries (your holdings and relevant market data are sent to the AI provider to produce summaries you request), sending the emails you opted into, and processing your subscription if you have one.

Service providers

Your data touches the infrastructure that runs the Service: Vercel (hosting, analytics), Neon (database), Google (sign-in; Gemini for AI features), Anthropic (Claude, only if you add your own key), Stripe (payments), Plaid (brokerage linking, only if you link one), Resend (email, only if you opt in), and market-data sources (Finnhub, Yahoo Finance, SEC EDGAR, FRED). Each receives only what its role requires.

Security

All traffic is encrypted in transit (TLS), database connections are certificate-verified, secrets and access tokens are AES-256-GCM encrypted at rest, and connector tokens are stored only as SHA-256 hashes. No system is perfectly secure, but this one is built carefully.

Retention and deletion

Your data is kept while your account is active. To delete your account and its data, contact us (below) and we will remove it. Unlinking a brokerage or removing an API key deletes the associated token immediately.

Your choices

You can unlink Plaid, revoke MCP connector tokens, remove API keys, and turn off all email in Settings at any time. Every email we send includes an unsubscribe link.

Changes and contact

We'll announce material changes to this policy in the app. Questions or deletion requests: the in-app Suggestions page, or thomaslu0328@gmail.com. See also the Terms of Service and Disclaimer.