1. What is collected
- Account: your e-mail address and a salted, hashed password. The password itself is never stored and cannot be recovered — only reset. If an admin account sets up an authenticator app, the key it shares with that app is stored encrypted, and its one-time recovery codes are stored hashed.
- Investor profile: what you choose to enter — name, date of birth, contact details, province, employment, income band, net worth, dependants, risk tolerance, objectives and preferences. Every field is optional and each exists to personalise the reports. It is suitability information, not identity verification.
- Portfolio: accounts, holdings, transactions, cash balances, goals, and anything you import.
- Broker connections (optional): if you link Questrade or SnapTrade, the access tokens are stored encrypted (Fernet) and used only to sync your holdings.
- Operational: a security log of sign-ins, sign-outs, account deletion and similar events, and a record of AI usage and its cost.
- Your IP address, which is recorded in these places:
- in the security log, with sign-ins, failed sign-ins, sign-outs, password resets, e-mail verification and account deletion. A failed sign-in where you typed your e-mail address is logged under that address;
- with each acceptance of the Terms, this policy and the "research, not advice" acknowledgement, together with the version and the date;
- next to your e-mail address, if you join the waitlist;
- for up to an hour, in the counters that limit repeated attempts (sign-in, sign-up, password reset, e-mail verification, changing your e-mail address, account deletion, the waitlist, and page-view counting);
- in the security alerts Vishal receives. A password-reset request, or a run of failed sign-ins, sends him an alert naming the IP address it came from, and for a reset the account too. A record of each blocked-sign-in alert, with the IP address, is kept so the same alert is not sent twice;
- in the server's error logs, when a request of yours fails with a server error.
No SIN, no government ID, and no payment details are collected. CompoundWise is not a registered dealer and holds no assets, so it has no reason to ask for them — and asking would create risk with no purpose.
Support messages. If you open PulseDesk — the help button in the corner of the app — what you type there is stored with your account, together with the page you were on, your browser and window size, and any file you attach. The page and browser are captured automatically so a bug report does not begin with "which screen were you on?". Your holdings are never attached to a support message; but anything you type into one is stored as you typed it, so do not paste passwords, account numbers or verification codes.
Questions the help desk could not place. When PulseDesk cannot work out what a message is asking, the message is also recorded on a short list that only Vishal reads, so the help can be taught the words people actually use. It holds what you typed and your username, nothing else, it is deleted with your account like the rest of your support history, and a question the desk answers outright is never added to it.
2. Where it lives
In a SQLite database on a virtual machine hosted by Google Cloud in the United States
(us-east1), reached over HTTPS. A staging copy runs on Fly.io.
Backups. Google Cloud keeps daily snapshots of that machine for 7 days. Every
night a backup copy of the database and of any files you uploaded is also encrypted on that machine, to
a key only Vishal holds, and stored with Amazon Web Services in Canada (ca-central-1). AWS holds only the encrypted
file and cannot read it. Each copy is locked so that nobody, including Vishal, can delete it early, and
is removed automatically after about 40 days.
3. Who else sees it
| Service | What it receives | Why |
|---|---|---|
| Anthropic | Portfolio holdings and profile context, when you generate an AI report | Writes the Strategy, Intelligence and Sector reports |
| Anthropic | Your support message, the manual sections that matched it, and a fixed list of non-financial account details: your plan, its status and expiry, whether you are in a household, which features and AI modules you hold, whether your e-mail is verified, when you joined, whether a broker is linked and its status, when it last synced and with what result, how many accounts you have linked, your display currency and your theme. No holdings, no balances, no dollar figures, and never a broker credential. That list is enforced in code as a closed allow-list rather than as an instruction to the model, and a test fails the build if anything money-shaped is added to it. | Answers support questions in PulseDesk before they reach a person |
| Google Cloud | Everything, as the host | Runs the service |
| Amazon Web Services (Canada) | An encrypted backup of the database and your uploaded files; AWS holds no key to read it | Keeps a backup outside Google Cloud, so the service can be restored if Google Cloud is lost |
| Resend | Your e-mail address | Sends confirmation and password-reset mail |
| Questrade / SnapTrade | Only what you authorise when linking | Syncs your holdings |
| Apple / Google (APNs, FCM) | A device token. Separately, the security alerts sent to Vishal's own devices, which name an IP address (and, for a password reset, the account) | Push notifications, if enabled |
| Telegram | Alert text you opted into. Separately, the security alerts sent to Vishal, which name an IP address (and, for a password reset, the account) | Alerts, if you connect it |
| Cloudflare | Your IP address and a browser challenge, on the sign-up page and on the home page (which carries the waitlist form), and only while the sign-up captcha is switched on. It is off today | Turnstile, which keeps automated sign-ups out |
Market and fundamentals data is fetched from Yahoo Finance, Finnhub, Alpaca, the Bank of Canada and SEC EDGAR. Those requests ask about tickers; they carry nothing about you.
The one to weigh: generating an AI report sends your holdings and profile context to Anthropic. That is true of every AI feature that reads your portfolio: the Strategy report, Intelligence chat, Sector Lab, the Tax & Structure Audit, Earnings Recaps, Winner theses and Discovery. If you would rather that never happen, do not use them — the tracking, scoring and tax tools work without any of them.
PulseDesk is narrower, and worth stating separately. The support assistant is sent your message, the manual sections that matched it, and a fixed list of non-financial account details — never a holding, a balance or a dollar figure. That list is enforced in code as a closed allow-list rather than an instruction, and a test fails the build if anything money-shaped is added to it. You can skip the assistant entirely: ask for a person and the conversation goes straight to Vishal without reaching Anthropic at all.
4. How long it is kept
Support conversations and their attachments are kept until you delete your account, and are deleted with it — they are not one of the exceptions below. If you want a copy first, export the conversation before deleting.
For as long as your account exists. Delete the account and it goes, with two deliberate exceptions, which are kept with your username replaced by a placeholder:
- the security log, because letting a deletion erase the evidence of a break-in would be a hole in the deletion feature itself;
- the AI cost record, which is a financial record of money already spent.
Neither contains portfolio data. Deleting the account also removes your e-mail address from any failed sign-in logged under it. The security log does keep the IP address each event came from, with no fixed time limit, so it is not anonymous: an IP address can sometimes be traced back to a person. How long each IP record lasts:
- Consent records: deleted with your account.
- Rate-limit counters: up to an hour.
- Security alerts to Vishal: his alert history keeps the latest 200, and the copies in his Telegram chat and on his phone stay until he deletes them. Alerts already sent are not removed when you delete your account.
- The record that stops a blocked-sign-in alert repeating: it expires after 15 minutes but is only cleared when the next such alert is checked, so it can last longer.
- Server error logs: overwritten as newer logs fill them, which is usually within days.
- The app's own logs (Google Cloud Logging), which can name your account in a line such as a broker sync: 30 days.
- A waitlist entry (your e-mail and IP address): kept until you ask for it to be removed.
Backups outlive a deletion. Deleting your account removes you from the live database at once. Copies made before the deletion still contain your data until they are removed:
- the daily snapshots, after 7 days;
- the encrypted nightly backup in Canada, after about 40 days. It is locked, so it cannot be deleted sooner;
- the copies the server takes before each software update, which are kept for the last 7 updates rather than for a fixed time, so they can last longer when updates are rare;
- a copy occasionally taken by hand before risky maintenance. Vishal is alerted every day once one is more than 7 days old, until it is deleted;
- the app's logs, which can name your account, after 30 days.
All of them stay on Google Cloud or, encrypted, with AWS. They are used only to repair or restore the service.
5. Your choices
- See it, and take it with you: everything held about you is visible in the app. Your full ledger — every transaction, your holdings with their cost base, realized gains by year, and the history of every edit and deletion — downloads as a CSV from Settings → Accounts & data → Download my ledger on the web, or Settings → Download my ledger on Android, where it is also the first step of Delete Account. Reports save as PDF. Download before deleting your account — deletion cannot be undone.
- Correct it: every profile field is editable in Settings.
- Delete it: in the iPhone or Android app, Settings → Delete Account, re-entering your password. Immediate, and it cannot be undone. There is no self-serve delete on the web yet — ask in the app's help chat and it will be done for you.
- Disconnect: unlink a broker, turn off alerts, or stop using AI reports at any time.
6. Security
Passwords are PBKDF2-hashed. Admin accounts can add an authenticator app, and admin pages then need its code. Broker tokens are encrypted at rest. Sessions are short-lived and refresh tokens are single-use with reuse detection. Traffic is HTTPS only. None of this makes a breach impossible, and if one occurs that affects you, you will be told.
7. Children
CompoundWise is not intended for anyone under 18 and accounts are not knowingly created for them.
8. Changes
Material changes will be shown in the app and re-accepted, with the version, the date and the IP address the acceptance came from recorded.