Your strategy.
Your risk. Your rules.

Information the account service uses

Registration asks for your name, username, email, birth date, country, phone number, password, and security answer. The phone number is unverified profile information and is not used for sign-in or recovery. The service stores password and security-answer hashes rather than their plain text, encrypted authenticator material, one-use recovery-code digests, consent records, account settings, session information, and security events. Sessions and security checks can include an IP address and device or browser details.

If you connect Alpaca, StocksBob stores an encrypted OAuth token or, if you explicitly select the temporary API-key option, an encrypted API key ID and secret, together with the broker account identifier. The server uses these credentials to read balances, positions, portfolio history, and recent orders from Alpaca. API keys may also allow trading at Alpaca, but this dashboard uses only portfolio reads and connecting does not enable trading. Stored credentials are not returned to the browser or shown to the site administrator. Your private account details are tied to your signed-in account; shared market research is designed to exclude personal broker and profile data.

Why the information is used

The account service uses this information to create and protect an account, verify email and authenticator sign-in, send recovery messages, record your consent and preferences, display your own broker information, prevent abuse, and investigate account security problems. Essential cookies keep your session and pending registration flow. A local browser preference remembers whether your account menu is open.

Providers and hosting

When configured and used, Google or Apple receives the sign-in request and supplies an account identifier and verified email; Resend receives the email address and verification or recovery message for delivery; and Alpaca receives an OAuth authorization request or API-key authentication headers and supplies the broker data you choose to connect. API keys are sent over HTTPS from your dashboard to this server and from this server to Alpaca; they are not used as browser URL parameters or browser storage preferences. Cloudflare may process website traffic and related network information; the hosted Site uses Cloudflare D1, while the separate Linux account server uses its own private account database. These providers process information under their own privacy notices.

Logo display update, October 30, 2026: when a bundled company logo is unavailable, your browser may load it from Logo.dev. That service receives the public ticker requested, your IP address and request timing under its privacy notice. StocksBob does not send it your broker credentials, balances, quantities or account identity; logo requests suppress the referring page address.

Storage, retention, and choices

Pending registration flows expire after 24 hours; expired records may remain until cleanup runs. Account data is retained while your account is active. To request access, correction, or deletion, email [email protected]. StocksBob will verify account ownership before acting on a request. Limited information may be retained when needed for security, legal obligations, or resolving a request. Local backups may retain earlier records during recovery cycles.

You can disconnect a broker connection in StocksBob to remove its active saved credentials and revoke or regenerate the key separately in Alpaca. Earlier encrypted credential copies may remain in private recovery backups until those backups are removed; disconnecting does not erase old backups or revoke a key at Alpaca. The version and effective date of this notice appear above; questions about privacy can be sent to the same support address.