Privacy policy

The short version

Without an account, this site stores nothing about you beyond the standard web-server log described below. There is no analytics tool, no advertising network, no tracking pixel and no third-party script of any kind — every font, icon and stylesheet is served from this domain.

With an account, it stores what you type in: your sign-in identity and the crypto positions you choose to declare. Those positions are declarative figures in a database. This site never connects to an exchange, a wallet or a bank, holds no funds, and cannot place an order.

What is stored

If you never sign in

• Server log. Like every web server, this one records each request: IP address, date, the page requested, the referring page and your browser's user-agent string. It is written by the hosting platform and used for security and diagnosis only.

If you have an account

• Identity — a username, a display name, and an email address. If you signed in with Google, we receive and store your email address, your display name and Google's stable account identifier. We never receive your Google password, and we ask Google for nothing beyond those three items.
• A password hash, only if you set a password. It is hashed, never stored or storable in readable form. Accounts created through Google have no password at all.
• The date of your last sign-in, and the date the account was created.
• Your declared positions — the assets and quantities you enter yourself, and the value history computed from them.
• The proposals generated for you, if you use the strategy feature, along with the portfolio snapshot each one answered.

That is the whole list. There is no profiling, no behavioural scoring, and no attempt to identify you across other sites.

Why, and on what basis

• Identity and password hash — to let you sign in and to keep your data separate from anyone else's. Necessary to provide the service you asked for (contract).
• Declared positions and generated proposals — they are the service. Without them there is nothing to analyse.
• Email address — to identify your account and to send a password-reset link if you ask for one. It is not used for marketing; this site sends no newsletter and no promotional message.
• Server log — security and troubleshooting (legitimate interest).

Who else sees it

Nothing is sold, rented or shared for advertising. Three third parties are involved, each for one purpose:

• Google — only if you choose « Continue with Google ». Google tells us your email address, display name and account identifier; Google learns that you signed in to this site. Google privacy policy.
• Anthropic — when you generate a strategy proposal, the composition of the selected lines (asset names, quantities, values and computed indicators) is sent to Anthropic's API so a model can propose a reallocation. Your name, email address and account identifier are never included; the request carries figures, not an identity. Anthropic privacy policy.
• The hosting provider — which necessarily processes the server log and the database on our behalf.

Market data (prices, candles, derivatives) is fetched by scheduled server-side jobs. Those requests carry no information about you, and your browser never contacts an exchange.

The site operator

The person who runs this site can read your account in the database, and can open your pages as you see them, for support and administration. Two limits apply to that, and they are enforced in code rather than promised here: the session is read-only — nothing about your account can be changed, and no billable action can be triggered, while it is being viewed — and every such view is written to a server-side log with the date, the administrator and the account concerned.

Cookies and tracking

This site sets one cookie, and only once you sign in: GLOPPRSESS, which holds your session. It is HttpOnly, Secure and SameSite=Lax, it expires when you close your browser, and it contains no personal data — only a random session identifier. It is strictly necessary for the site to work, which is why no consent banner is shown.

Your light/dark theme choice is kept in your browser's local storage. It never leaves your device and is never sent to the server.

There are no analytics, advertising or social cookies, because there are no third-party scripts at all.

How long

• Account data and positions — until you ask for the account to be deleted.
• Server log — rotated by the hosting platform; kept for a matter of weeks, for security purposes only.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the right to access your data, correct it, have it deleted, obtain a portable copy, and object to processing. Similar rights exist in several other jurisdictions.

Write to the address below and it will be handled. Deleting the account removes the identity, the declared positions and the generated proposals. You may also lodge a complaint with your national supervisory authority — in France, the CNIL.

Contact

For anything on this page — access, deletion, a question, a mistake you have spotted — write to david.marchioni@gmail.com.

See also the terms of use, which set out what this site does and — importantly — what it is not.