Privacy Policy

1. About This Policy

FrostDeck ("we," "us," or "our") operates frostdeck.com, a self-hosted portfolio analytics and dividend tracking platform. This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

By creating an account or connecting a brokerage account, you agree to the practices described in this policy.

2. Information We Collect

Account Information

• Email address and display name (provided at registration)
• Password (stored as a bcrypt hash - we never store your plaintext password)
• Language preference

Financial Data via Plaid

When you choose to connect a brokerage account, we use Plaid Technologies, Inc. to establish that connection. Through Plaid we may receive:

• Account names, types, and balances
• Investment holdings (ticker symbols, quantities, cost basis, market value)
• Transaction history (buys, sells, dividends, margin interest)
• Institution name and account identifiers

We do not receive your brokerage login credentials. Plaid handles authentication directly with your financial institution. See Plaid's End User Privacy Policy for details on how Plaid handles your data.

Manually Entered Data

You may enter holdings, transactions, dividends, and options positions directly or by uploading a CSV file. This data is stored in your account and is not shared with third parties.

Usage and Technical Data

• Server-side logs (request timestamps, HTTP status codes, error messages)
• JSON Web Tokens (JWTs) for session management - stored in your browser's local storage

We do not use third-party analytics, advertising pixels, or tracking cookies.

3. How We Use Your Information

• Provide the service - display portfolio analytics, dividend history, P&L calculations, projections, and the dividend calendar.
• Sync financial data - re-fetch holdings and transactions from Plaid on a nightly basis so your data stays current.
• Authenticate you - verify your identity via password, TOTP (authenticator app), or passkey (WebAuthn).
• Communicate with you - send transactional messages (e.g., security alerts) if you opt in.
• Improve the platform - use aggregated, de-identified data to understand usage patterns and prioritize features.

We do not sell your personal information or financial data to any third party, ever.

4. Third-Party Services

Plaid

FrostDeck uses Plaid to connect to financial institutions. When you click "Connect Account," you interact with Plaid's interface and agree to Plaid's terms. Plaid may store certain financial account data as described in their privacy policy. You may disconnect your accounts at any time from the Settings page, which revokes FrostDeck's access token.

Plaid's End User Privacy Policy: https://plaid.com/legal/#consumers

Amazon Web Services (AWS)

FrostDeck is hosted on AWS infrastructure (EC2, RDS) located in the United States. AWS processes data on our behalf and is contractually bound to protect it. Your database is hosted in a private subnet with no public internet access.

5. Data Security

• Passwords are hashed with bcrypt (cost factor 12) - we cannot recover them.
• Plaid access tokens are encrypted at rest with AES-256-GCM.
• All data in transit is encrypted with TLS 1.2+.
• The database is in a private VPC subnet - not reachable from the public internet.
• RDS storage is encrypted at rest.

While we take security seriously, no system is 100% secure. We encourage you to use a strong, unique password and to enable two-factor authentication in your account settings.

6. Data Retention

FrostDeck retains account data (holdings, transactions, dividends) for as long as your account is active. Plaid access tokens are retained only while the linked brokerage connection is active; revoking a connection immediately deletes the associated access token. Application and security logs are retained for 90 days. If you delete your account, all personal data is permanently removed within 30 days, with the exception of records we are legally required to retain (e.g., for tax or anti-fraud purposes).

Deletion Requests

You may request deletion of your account and all associated data at any time by emailing privacy@frostdeck.com. We will confirm deletion within 30 days.

Policy Review

This policy is reviewed at least annually, and updated when material changes to data practices occur.

7. Your Rights and Choices

• Access & Correction - view and update your profile information from the Settings page.
• Disconnect Plaid - revoke brokerage access at any time from the Connect page. This stops future data syncs and removes the access token.
• Delete your account - contact us at the address below to request full account deletion.
• Data portability - your holdings, transactions, and dividends can be exported via CSV. (Coming soon.)

If you are a resident of California or the EEA, you may have additional rights under CCPA or GDPR. Please contact us to exercise those rights.

8. Children's Privacy

FrostDeck is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. Your continued use of FrostDeck after changes are posted constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, please contact us at:

FrostDeck
privacy@frostdeck.com