Privacy Policy

Last updated 2 September 2026

Who this is

The Holding-Period Lot Tracker ("the tool") is operated by BlueZero, SLU, Paseo Central 17, 04740 Roquetas de Mar, Spain. You can reach us at [email protected] for anything in this policy, including exercising the rights described below.

If you don't create an account

This is the default, and most people never need anything else. When you upload a broker export:

• The file is read into memory, matched into tax lots, and the uploaded file itself is deleted from the server immediately afterward — before you even see the results page.
• The computed results (ticker, ISIN, acquisition date, quantity, cost basis, and the exemption date we calculated) are held only in your browser session — server-side session storage tied to the session cookie described below — never written to a database.
• That session data is cleared automatically when your session ends: when you close your browser, or after a period of inactivity.

The only thing this app's database always holds is the tax rules themselves (holding periods, thresholds, source citations for each supported country) — public information about tax law, not about you.

If you create an account

Creating an account is entirely optional, exists only so you can save a portfolio instead of re-uploading it, and requires you to actively opt in. If you do, we store:

• Your email address, used to sign you in, send the two-factor login code, and send a password-reset link if you ask for one.
• A hash of your password — never the password itself. We cannot see or recover it.
• Your selected tax residency (a country code).
• Your saved lots, if you choose to save a portfolio: ticker/ISIN, acquisition date, quantity, cost basis, and the computed exemption date. Saving always replaces whatever you'd saved before — we don't accumulate a history of every version. We do not store your raw, per-trade transaction history.

You can delete your saved portfolio at any time from the "My saved portfolio" page — it's removed from the database immediately, and this doesn't affect your ability to log in again later. You can also change your password at any time from that same page, which also signs out any other device that was "remembered."

You can delete your account — your email address, password, and any saved portfolio — entirely and immediately from the "My saved portfolio" page too, by entering your password to confirm. It's permanent and cannot be undone from within the app. If you'd rather we do it for you, or you no longer have access to your password, contact us at [email protected] instead — we'll act on that request within the time your jurisdiction's data protection law requires.

Cookies

This app sets exactly two cookies, both functional — neither is used for advertising, and neither exists unless account mode is in use:

• A session cookie, so the app can find your session data (your upload results, or your login state) on the next request. It's marked HttpOnly and Secure, and expires when you close your browser.
• A "remember me" cookie, set only if you tick that box when logging in. It holds a randomly generated token — never your password or email in readable form — and keeps you signed in for up to 30 days. It's revoked immediately if you log out, and rotated every time it's used.

Email

If you create an account, we send you transactional email only: a six-digit login code, and a password-reset link if you request one. We do not send marketing email and do not use email open/click tracking. Email is sent via Google Workspace. We keep a log of send attempts (the recipient address, and whether the send succeeded) to diagnose delivery problems — that log never contains the code or link itself, isn't accessible from the web, and we clear it manually from time to time rather than on any fixed schedule.

Where your data goes

We don't sell, rent, or share your data for anyone else's marketing. The parties that do handle it, and only for the purposes above, are:

• Webdock.io, which hosts the database and web server this app runs on.
• Google Workspace, to deliver the login codes and reset links described above. Google is based outside the EU/EEA; under its Cloud Data Processing Addendum, transfers of this kind are covered by Google's Standard Contractual Clauses and, separately, by Google's own self-certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) — both apply as available safeguards, not a choice we make. The current text of that addendum is published at cloud.google.com/terms/data-processing-addendum.
• Google Fonts — this page's typefaces are loaded from Google's servers, which means your browser makes a direct request to Google when you load any page here, exposing your IP address to Google in the way any font or image request would. We don't control what Google does with that request. If this matters to you, self-hosting the fonts instead of loading them from Google removes this entirely — worth doing if you want one less third party in this section.

We do not use analytics, advertising pixels, or any other tracking script.

Legal basis for processing (GDPR)

Where the GDPR applies to you: computing your results from an upload is processing necessary to provide the service you asked for in that moment (Art. 6(1)(b)/(f)). Creating an account, and everything that comes with it, is based on your consent, given by opting in (Art. 6(1)(a)) — you can withdraw it at any time by deleting your account. Security measures like rate-limiting and CSRF protection are based on our legitimate interest in keeping the service working and abuse-free (Art. 6(1)(f)).

How long we keep it

Upload results: gone when your session ends, always. Account data: kept until you delete your saved portfolio or your account yourself (both immediate — see above). Mail send logs (just the recipient address and whether the send succeeded, never the code or link itself) are appended to a server-side file that isn't rotated or trimmed automatically — we clear it manually from time to time rather than on a fixed schedule.

Your rights

If the GDPR or a similar law applies to you, you can ask us — at [email protected] — to access, correct, delete, or export the personal data we hold about you, or to restrict or object to our processing of it. For most of what this app stores, you don't need to ask: the "delete saved portfolio" and "delete my account" buttons on the account page already cover deletion, self-service and immediately. You also have the right to complain to your national data protection authority if you think we've gotten this wrong.

Children

This tool isn't directed at children and isn't designed for anyone below the age at which their country lets them hold a brokerage account in their own name.

Changes to this policy

If this changes, we'll update the date at the top of this page. Material changes — anything that means we start doing something meaningfully different with your data — will be called out, not just quietly dated.

Contact

Questions about this policy, or a request relating to your data: [email protected].