Privacy Policy
Your portfolio CSV is processed entirely inside your own browser. It is never uploaded to any server, never transmitted to us, and never stored anywhere — not by XRay My Portfolio, not by any third party. We do not have your data. We cannot see it. There is nothing for us to lose, sell, or be breached. Some features require a free account, which collects only an email address for access — see Sections 2–3 for exactly what that does, and does not, include.
1. What this tool does with your data
XRay My Portfolio is a static, client-side web application. When you upload a Fidelity or Schwab portfolio CSV export, the file is read and parsed using JavaScript running locally in your web browser. All calculations — exposure analysis, sector breakdowns, stress testing, correlation matrices, and every other feature — happen on your own device.
At no point does your portfolio data leave your browser. There is no backend server receiving your file. We have built this deliberately: the application would function identically if you disconnected your device from the internet immediately after the page finished loading (with the exception of the optional live data features described in Section 4).
2. Information we do not collect
We do not collect, store, transmit, or have access to:
- Your portfolio holdings, balances, or any data contained in your uploaded CSV file
- Your name, account numbers, Social Security number, or any personally identifiable financial information
- Your brokerage login credentials (we never ask for these, and you should never enter them anywhere other than your brokerage's own website)
- Any record of which files you've uploaded or what the contents were
This is true whether or not you have an account with us — see Section 3. There is no database of portfolio data, and we have nothing to hand over even if compelled to, because your holdings are never sent to us in the first place.
3. Account sign-up
Some features require a free account. We use this only to manage access to the tool — not to store or analyze your financial information.
When you sign up, the only thing we collect is your email address, used to send you a sign-in link and, occasionally, product updates you can unsubscribe from at any time. We don't use passwords, and we never ask for or store any brokerage, account, or portfolio information as part of sign-up.
Your account and your portfolio data are, and will remain, two separate things. Your email identifies you to us for access purposes only. Your CSV — your quantities, dollar values, cost basis, everything in it — is parsed locally, never uploaded, and never associated with your account, stored, or reviewed by us — see Sections 1 and 2. (The one exception: if you use the optional Live Data or Ratings features, ticker symbols — not portfolio numbers — are sent to fetch pricing data; see Section 4.)
You can ask us to delete your email from our records at any time — see Section 9.
4. Optional third-party data — Finnhub
The "Live Data" and "Ratings" features are optional and require being signed in (see Section 3). When you use them, your browser sends a request to our own server (a Cloudflare Worker), which forwards it to Finnhub.io, a third-party financial data provider, using our own API key — you never need to obtain or enter one yourself. Finnhub returns public market data (stock prices, dividend yields, fundamental metrics) for the ticker symbols involved, which we relay back to your browser.
| What is sent to our server | Ticker symbols only (e.g. "AAPL", "VOO"), plus your session cookie to confirm you're signed in — never your share counts, dollar values, cost basis, or any other portfolio detail |
|---|---|
| What we forward to Finnhub | The same ticker symbols, and nothing else — no share counts, dollar values, or account information ever reach Finnhub either |
| What we store from this | Nothing about the request or response is retained beyond what's needed to serve it and enforce a shared rate limit for a few seconds |
Finnhub's use of any data sent to them is governed by their own terms of service and privacy practices, which we do not control. If you prefer not to share even ticker symbols with a third party, simply don't use the Live Data or Ratings features — every other feature of the tool works fully offline.
5. Usage analytics
We use anonymous, aggregate analytics to understand how visitors move through the site and which features get used — for example, how many people view a page, or how many reach a given screen — so we can improve the tool. This is entirely separate from, and never linked to, the contents of your portfolio.
As of this policy's last update, we use Cloudflare Web Analytics, a cookie-less analytics service that does not use tracking cookies or device fingerprinting and does not track you across other websites. It reports aggregate metrics like page views and visit counts — it does not tell us who you are.
We may add or change analytics tools over time — for example, to better understand which specific buttons or screens people use, or how visitors move from browsing for free to signing up — as the product grows. Regardless of which specific tool is in use at any given time, we commit to the following, and we will not change these commitments without updating this page and, for account holders, notifying you directly by email (Section 8):
- Analytics activity is never linked to your name or the contents of your portfolio. What you upload and what our analytics tools see are, and will remain, entirely separate systems.
- We do not sell or share analytics data with advertisers, and we do not use it to build cross-site advertising profiles.
- If usage data is ever associated with your account (for example, to distinguish signed-up from anonymous usage), that association stays internal to us, is never sold or shared externally, and is never combined with anything from your uploaded CSV.
Your browser's local storage may also be used to remember display preferences, purely for convenience between visits. This data stays on your device and is never transmitted to us.
6. Hosting infrastructure
This website is hosted on Cloudflare Pages, a static-site hosting service. Cloudflare may log standard, anonymized web server metadata (such as IP address, browser type, and timestamp) for security and performance purposes, consistent with their role as our hosting provider. We do not have access to your uploaded portfolio data through this infrastructure, because that data is never part of any network request — it stays in your browser's memory. See Cloudflare's privacy policy for details on their hosting-level practices.
7. Children's privacy
This tool is intended for use by adults managing their own investment portfolios. It is not directed at children under 13, and we do not knowingly collect information from children. If we learn an account was created by a child under 13, we will delete the associated email address.
8. Changes to this policy
If this policy changes, we will update the "Last updated" date at the top of this page. If you have an account with us, we will also notify you by email of any material change — in particular, any change to the analytics commitments in Section 5. If you don't have an account, we encourage checking this page periodically if you have concerns.
9. Contact
This is an independent project. For privacy questions, or to request deletion of your email address, you can reach out through the contact information listed on the About page.
This privacy policy describes the practices of the XRay My Portfolio website and tool only. It does not apply to Fidelity Investments, Charles Schwab, Finnhub, Cloudflare, or any other third-party service you may interact with separately. We are not affiliated with Fidelity Investments or Charles Schwab.