Privacy
We cannot leak what we never receive
Not a promise about how carefully we handle your data — a statement that it never reaches us. Here is exactly what that does and does not cover.
In short
What is collected, and what is not.
- Not collected: Name, email address, or any account
- Not collected: Trade history, positions, or portfolio value
- Not collected: Analytics, cookies, pixels, or session recording
- Not collected: IP address logs (there is no server to log them)
- Not collected: Third-party embeds, fonts, or scripts at runtime
- Sent: Ticker symbols, sent by your browser to Alpha Vantage with your own key
Where your data lives
On your device, in your browser profile.
Imported trades, fetched price history, and your Alpha Vantage key are written to IndexedDB — the browser’s own database, scoped to this domain and to this browser profile. They are read back by code running on your machine.
Nothing is synced. Opening Veluma on a second device shows an empty ledger, because there is no account tying the two together and no copy of the first device’s data anywhere to fetch.
What leaves your device
One request per ticker, carrying a ticker symbol.
To plot value over time the app needs closing prices, and those have to come from somewhere. Your browser requests them from Alpha Vantage directly, using the key you supplied, and caches the result locally so a repeat visit costs no requests.
That request carries a ticker symbol and your key. It does not carry how many shares you hold, what you paid, when you bought, or the value of anything. Alpha Vantage can see that somebody asked about a symbol. They cannot see a portfolio.
The site itself is static files. There is no application server, no database, and no request log with your address in it.
What we are not claiming
The honest limits of a local-only design.
Browser storage is not encrypted. Anyone who can use your computer profile can read it, exactly as they could read a spreadsheet you left open. A shared or unlocked machine is a real exposure and this design does not fix it.
Alpha Vantage has its own policy. Requests your browser makes to them are governed by their terms, not ours.
Your host may keep access logs. Serving static files still involves a web server somewhere, and whoever operates it can see that a file was requested.
Clearing site data is irreversible. There is no backup on our side to restore from, which is the same property that makes the rest of this page true.
Deleting your data
One button, and it is genuinely gone.
The tool has an export that writes every trade back out as CSV or JSON, and a delete that clears trades, cached prices, and your saved key from this device. Neither involves us, because neither can.
Clearing site data in your browser’s own settings does the same thing.