Privacy Policy

Who is responsible for your data

AlphaDesk is operated as a personal project by its author. Under India’s Digital Personal Data Protection Act, 2023, the operator is the data fiduciary for the personal data described here, and you are the data principal. Your data is processed for one stated purpose only: computing and showing you your own portfolio analytics. It is not processed for advertising, profiling, resale, or any purpose you have not asked for.

What we read, and why

When you connect IND Money, you authorize AlphaDesk, through IND Money’s own OAuth screen, to read, and only read:

• your holdings across stocks, mutual funds and other assets;
• their current values and, where the source provides it, your invested amount;
• your SIPs (systematic investment plans);
• your net-worth totals and allocation breakdowns.

We read these so we can compute and display your dashboard, your allocation and concentration metrics, and your daily net-worth history. We never receive your IND Money password: authentication happens on IND Money’s site, and we hold only an OAuth token.

Alongside the portfolio data we store the minimum needed to run an account: the user id and email address your sign-in provider gives us, and the paper watchlist entries you approve in the Lab.

Consent, given at link time

Before you are sent to IND Money’s OAuth screen, AlphaDesk shows you a consent screen that names exactly what will be read and what will never happen. You cannot skip it, and linking does not begin until you accept it. Your consent covers the read access described above and nothing else. You can withdraw it at any time by disconnecting IND Money, which stops all further reads, or by deleting your data, which also erases what was already read.

What we never do

• No trading. AlphaDesk cannot place, change or cancel an order. Access is strictly read-only and no real order is ever placed, in the dashboard or in the Lab.
• No credentials. We never see or store your broker password.
• No advice. Everything shown is descriptive analytics, not a recommendation.
• We never sell your data, and we never share it except with the processors below.

The daily snapshot

Once a day, after the Indian market closes and mutual fund NAVs publish, AlphaDesk captures one snapshot of your portfolio: the normalized holding rows and the day’s totals, stamped with an IST calendar date. That snapshot is what draws your net-worth history, and it is the only reason we keep portfolio data at all beyond the moment you are looking at the screen. The broker feed is point-in-time, so a day that was not captured cannot be reconstructed later. Capture stops when you disconnect IND Money.

Where it is stored, and for how long

Your data is stored in a PostgreSQL database hosted by Neon, in a managed cloud region. We keep the normalized daily snapshots, the per-day totals and holding rows that draw your net-worth history, for as long as your account exists, because a point-in-time snapshot cannot be recreated later. The raw broker payloads those snapshots are derived from are kept only for forensics and are pruned after 90 days.

Your broker tokens are encrypted at rest in that database with Fernet symmetric encryption, under a key held only in the backend’s server environment and never stored beside the data. A token is decrypted only in memory, only to call IND Money on your behalf, and is never returned to your browser and never written to logs. Lab runs are held in memory only and do not survive a backend restart.

What the AI models receive

The portfolio overview is written by a language model from figures AlphaDesk has already computed in code. The prompts carry aggregates and instrument symbols only: totals, weights, concentration measures, sector splits and ticker symbols. They never carry your account numbers, broker ids, email address, or your user id. A redaction step in the backend enforces this, and it is covered by tests. Your holdings are also kept out of request tracing: the portfolio pipeline runs with tracing disabled at the graph level, not by an environment switch someone can flip back on.

Who processes your data (subprocessors)

We use these services to run AlphaDesk. Each processes only what its function needs:

• OpenRouter (LLM routing) is the inference provider AlphaDesk currently routes to, for both the Lab’s research agents and your portfolio overview. OpenRouter forwards each prompt to the underlying model it serves; where that model is an unattributed preview model, the identity of the operator running it is not disclosed to OpenRouter’s customers, and so is not known to us. It receives only what the two entries below describe — for the overview, aggregates and instrument symbols, never account numbers, broker ids, your email, or your user id.
• Groq (LLM inference) runs the Lab’s research agents when the Lab is configured to route to Groq. Those prompts are public market-data prompts and do not contain your holdings.
• OpenAI (LLM inference) narrates your portfolio overview from the aggregate figures described above, when the overview is configured to route to OpenAI. By default your inputs are not used to train models, and are retained for up to 30 days for abuse monitoring before deletion. We send OpenAI aggregates and instrument symbols only, never account numbers, broker ids, your email, or your user id.
• LangSmith (tracing) records the Lab’s research runs for debugging, and only when a LangSmith API key is configured. It never receives your portfolio: your holdings, net worth and overview are explicitly kept out of tracing.
• Clerk (identity) handles sign-in and holds your email address and user id.
• Neon (database) hosts the PostgreSQL database that holds everything described above.
• Hugging Face (hosting) runs the backend container that talks to your broker and the models.
• Vercel (hosting) serves the frontend.

Some of these process data outside India. IND Money itself is your broker platform, not our subprocessor: it is the source you authorize us to read. We use no advertising, analytics or error-tracking third parties.

Your rights, and deleting your data

Under the Digital Personal Data Protection Act you can access, correct and erase your data, withdraw consent, and raise a grievance. Your dashboard already shows you everything we hold about your portfolio.

To erase it, use “Delete my data” in the account menu. It first revokes your broker token upstream at IND Money, so access ends at the source, and then permanently cascade-deletes every row we hold for you: your account, your broker link, any pending link attempt, your snapshot days, holdings and raw payloads, and your paper watchlist. It is a single atomic deletion, so a half-deleted account is not possible, and it cannot be undone. You can also disconnect IND Money on its own at any time, without deleting your account.

For a rights request or a grievance, open an issue on the project’s public GitHub repository. We will respond within the timelines the Act requires.

Changes to this policy

If this policy changes in a way that affects what is read, who processes it, or how long it is kept, we will update the date at the top of this page and, for material changes, ask for your consent again before the change applies to you.