Privacy policy — what data we store and why

In short

• We store only what GetHossa needs to work: your email address, a hash of your password, your transactions and your watchlist.
• We don't show ads, and we don't sell or share your data.
• We use no analytics or tracking cookies — only two cookies the service needs to work. We count visits anonymously, without cookies (Vercel Web Analytics).
• We never ask for the login, password or API keys of your brokerage account.
• If you use the AI assistant, your questions and the data needed to answer them (such as your holdings) are sent to Anthropic, the provider of the Claude model.
• You can download your data and delete your account with all its data yourself at any time (account menu → “Account and data”).

Who is responsible for your data

The data controller for your personal data is Maciej Kamieniak, who runs GetHossa as a private individual (contact details: see hello@gethossa.com). You can reach us the same way about anything related to your data.

What data we store

Data	Why
Email address	identifies your account and is used to sign in
Password hash	lets us check your password when you sign in — we never know or store the password itself
Transactions you import or enter	date, ticker, type of operation, number of shares, price, amount, currency, exchange rate and source (broker or manual entry) — the basis for your portfolio calculations
Watchlist	the tickers you've added and when you added them
Conversations with the AI assistant	your questions, the assistant's answers, the data fetched to answer them (such as your holdings and company data) and the number of tokens used — to keep your conversation history and enforce the daily question limit
Account settings	your portfolio's base currency and the date your account was created
Sign-in sessions	a hash of the session token and when the session was created and expires — so you stay signed in
Failed sign-in attempts	the email address someone tried to sign in with, the IP address the attempt came from and its time — protecting accounts against password guessing

Broker files. We read an uploaded statement at the moment of import and save only the transactions extracted from it. We don't keep the file itself. If it contains other information (such as an account number), we don't store it.

What we don't collect. Your name, postal address, phone number, broker login details or payment details.

Technical data. Like any website, our hosting provider (Vercel) processes the data needed to serve your requests, such as your IP address and browser information, and may keep it in server logs for a limited time.

Why we use your data and on what legal basis

Purpose	Legal basis (GDPR)
Creating and running your account, signing in, storing transactions and calculating your portfolio results	Article 6(1)(b) — performance of a contract, i.e. providing the service you want to use
AI assistant: answering your questions and keeping your conversation history	Article 6(1)(b) — performance of a contract (a feature you choose to use)
Security: limiting failed sign-in attempts and sign-ups, protecting sessions, technical logs	Article 6(1)(f) — our legitimate interest in protecting accounts and the service
Anonymous visit and page-speed statistics (no cookies)	Article 6(1)(f) — our legitimate interest in improving the service
Replying to your messages and reports	Article 6(1)(f) — our legitimate interest in communicating with users

Giving us your email address and a password is voluntary, but without them you can't create an account. We don't make automated decisions about you that have legal effects, and we don't profile you for marketing.

Where your data is stored and who processes it

We use four providers that process data on our behalf:

• Vercel — application hosting and anonymous statistics (Web Analytics and Speed Insights, described below),
• Turso — the database (libSQL) that holds your account data, transactions, watchlist and assistant conversations,
• Anthropic — the provider of the Claude model behind the AI assistant. Only when you ask the assistant a question, we send it the conversation and the data needed to answer (such as your holdings). Anthropic doesn't use data sent through its API to train its models. The assistant can also search the web (with Anthropic's search) — the search engine receives the query the assistant writes (usually a company name and a topic).
• Resend — sends our emails: the welcome message after sign-up and password-reset links. It receives only your email address and that message.

These providers may also process data outside the European Economic Area, for example in the US. In that case the transfer must be covered by the safeguards required by the GDPR, such as standard contractual clauses approved by the European Commission.

Market data comes from Yahoo Finance and SEC EDGAR. We send them only requests for prices and company data (tickers and date ranges) that aren't linked to your account — never your personal data.

We don't sell, rent or share your data with anyone else, unless the law requires it, for example at the request of a competent authority.

How we protect your data

• Passwords are stored only as scrypt hashes with a random salt — not even we know your password.
• Session tokens are random, and the database stores only their SHA-256 hash. Even if the database leaked, nobody could use it to sign in to your account.
• The session cookie can't be read by scripts on the page (httpOnly) and is valid for 30 days.
• We limit failed sign-in attempts, both per account and per IP address.
• Your connection to GetHossa is encrypted (HTTPS).
• Only you can see your portfolio pages, once you're signed in.

No security measure is ever 100% certain, but we take the protection of your data very seriously.

How long we keep your data

• Account, transactions and watchlist — until your account is deleted. You can delete manually added transactions and watchlist items yourself at any time.
• AI assistant conversations — until you delete the conversation (any time, in the assistant window) or your account.
• Sessions — the session record is deleted when you sign out, and a session expires after 30 days at the latest.
• Sign-in attempts, sign-ups and password-reset requests (email address or IP address, with the time) — counted in windows of 15 minutes to a day to protect accounts from password guessing and abuse; records older than a day are deleted automatically.
• Password-reset links — we store only a hash of the link; it works for 60 minutes and is deleted once used.
• AI assistant usage counter — the time of each question and the number of tokens and searches used, never the questions themselves. It enforces the limits and keeps costs in check; records older than 31 days are deleted. Deleting a conversation doesn't remove the counter.
• Hosting technical logs — for a limited period set by the hosting provider.

You can delete your account yourself in the settings (account menu → “Account and data”), where you can also download all your data as a JSON file. When your account is deleted, we erase all data linked to it: transactions, watchlist, assistant conversations, the assistant usage counter, password-reset links and sessions. Backups kept by our database provider may still contain it for a limited time before they're overwritten.

Cookies

Name	Purpose	Lifetime
hossa_session	keeps you signed in; not readable by scripts on the page	30 days or until you sign out
hossa_lang	remembers your chosen language (Polish or English)	1 year

Both cookies are needed for features you use: signing in and choosing a language. We use no analytics, advertising or tracking cookies. If that changes, we'll update this policy and, where required, ask for your consent first.

Visit statistics

To see which pages are read and whether the site is fast, we use Vercel Web Analytics and Vercel Speed Insights. They work without cookies and store nothing in your browser. We see only aggregated data: the pages visited, where visits come from (e.g. a search engine), country, device and browser type, page load times, and events such as "clicked Sign up", "created an account", "imported a file" or "asked the assistant a question" (never the question itself). Visitors are told apart only within a single day, using a hash that can't identify you or follow you across days. Your account ID is removed from page addresses before anything is sent.

You can delete cookies in your browser settings. Without hossa_session, however, you can't stay signed in.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (Article 15),
• rectification of inaccurate data (Article 16),
• erasure of your data (Article 17),
• restriction of processing (Article 18),
• portability of the data you gave us, in a structured, commonly used format (Article 20),
• object to processing based on our legitimate interest (Article 21),
• lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office, UODO (uodo.gov.pl).

To exercise any of these rights — including asking us to delete your account — contact us. We'll reply without undue delay and within one month at the latest, as the GDPR requires.

Changes to this policy

If we change how we process data, we'll update this page and its "last updated" date. We'll tell you about significant changes in the app.

Contact

Contact: hello@gethossa.com