1. What is collected
- Account: your e-mail address and a salted, hashed password. The password itself is never stored and cannot be recovered — only reset.
- Investor profile: what you choose to enter — name, date of birth, contact details, province, employment, income band, net worth, dependants, risk tolerance, objectives and preferences. Every field is optional and each exists to personalise the reports. It is suitability information, not identity verification.
- Portfolio: accounts, holdings, transactions, cash balances, goals, and anything you import.
- Broker connections (optional): if you link Questrade or SnapTrade, the access tokens are stored encrypted (Fernet) and used only to sync your holdings.
- Operational: a security log of sign-ins, password changes and similar events with the originating IP; and a record of AI usage and its cost.
No SIN, no government ID, and no payment details are collected. CompoundWise is not a registered dealer and holds no assets, so it has no reason to ask for them — and asking would create risk with no purpose.
Support messages. If you open PulseDesk — the help button in the corner of the app — what you type there is stored with your account, together with the page you were on, your browser and window size, and any file you attach. The page and browser are captured automatically so a bug report does not begin with "which screen were you on?". Your holdings are never attached to a support message; but anything you type into one is stored as you typed it, so do not paste passwords, account numbers or verification codes.
Questions the help desk could not place. When PulseDesk cannot work out what a message is asking, the message is also recorded on a short list that only Vishal reads, so the help can be taught the words people actually use. It holds what you typed and your username, nothing else, it is deleted with your account like the rest of your support history, and a question the desk answers outright is never added to it.
2. Where it lives
In a SQLite database on a virtual machine hosted by Google Cloud in the United States
(us-east1), reached over HTTPS. A staging copy runs on Fly.io.
Backups. Google Cloud keeps daily snapshots of that machine for 7 days. Every
night a backup copy of the database and of any files you uploaded is also encrypted on that machine, to
a key only Vishal holds, and stored with Amazon Web Services in Canada (ca-central-1). AWS holds only the encrypted
file and cannot read it. Each copy is locked so that nobody, including Vishal, can delete it early, and
is removed automatically after about 40 days.
3. Who else sees it
| Service | What it receives | Why |
|---|---|---|
| Anthropic | Portfolio holdings and profile context, when you generate an AI report | Writes the Strategy, Intelligence and Sector reports |
| Anthropic | Your support message, the manual sections that matched it, and a fixed list of non-financial account details: your plan, its status and expiry, whether you are in a household, which features and AI modules you hold, whether your e-mail is verified, when you joined, whether a broker is linked and its status, when it last synced and with what result, how many accounts you have linked, your display currency and your theme. No holdings, no balances, no dollar figures, and never a broker credential. That list is enforced in code as a closed allow-list rather than as an instruction to the model, and a test fails the build if anything money-shaped is added to it. | Answers support questions in PulseDesk before they reach a person |
| Google Cloud | Everything, as the host | Runs the service |
| Amazon Web Services (Canada) | An encrypted backup of the database and your uploaded files; AWS holds no key to read it | Keeps a backup outside Google Cloud, so the service can be restored if Google Cloud is lost |
| Resend | Your e-mail address | Sends confirmation and password-reset mail |
| Questrade / SnapTrade | Only what you authorise when linking | Syncs your holdings |
| Apple / Google (APNs, FCM) | A device token | Push notifications, if enabled |
| Telegram | Alert text you opted into | Alerts, if you connect it |
| Cloudflare | Your IP address and a browser challenge, on the sign-up page only | Turnstile, which keeps automated sign-ups out |
Market and fundamentals data is fetched from Yahoo Finance, Finnhub, Alpaca, the Bank of Canada and SEC EDGAR. Those requests ask about tickers; they carry nothing about you.
The one to weigh: generating an AI report sends your holdings and profile context to Anthropic. That is true of every AI feature that reads your portfolio: the Strategy report, Intelligence chat, Sector Lab, the Tax & Structure Audit, Earnings Recaps, Winner theses and Discovery. If you would rather that never happen, do not use them — the tracking, scoring and tax tools work without any of them.
PulseDesk is narrower, and worth stating separately. The support assistant is sent your message, the manual sections that matched it, and a fixed list of non-financial account details — never a holding, a balance or a dollar figure. That list is enforced in code as a closed allow-list rather than an instruction, and a test fails the build if anything money-shaped is added to it. You can skip the assistant entirely: ask for a person and the conversation goes straight to Vishal without reaching Anthropic at all.
4. How long it is kept
Support conversations and their attachments are kept until you delete your account, and are deleted with it — they are not one of the exceptions below. If you want a copy first, export the conversation before deleting.
For as long as your account exists. Delete the account and it goes, with two deliberate exceptions kept in de-identified form — your username is replaced with a placeholder and cannot be re-derived:
- the security log, because letting a deletion erase the evidence of a break-in would be a hole in the deletion feature itself;
- the AI cost record, which is a financial record of money already spent.
Neither contains portfolio data.
Backups outlive a deletion. Deleting your account removes you from the live database at once. Copies made before the deletion still contain your data until they are removed:
- the daily snapshots, after 7 days;
- the encrypted nightly backup in Canada, after about 40 days. It is locked, so it cannot be deleted sooner;
- the copies the server takes before each software update, which are kept for the last 7 updates rather than for a fixed time, so they can last longer when updates are rare;
- a copy occasionally taken by hand before risky maintenance. Vishal is alerted every day once one is more than 7 days old, until it is deleted.
All of them stay on Google Cloud or, encrypted, with AWS. They are used only to repair or restore the service.
5. Your choices
- See it, and take it with you: everything held about you is visible in the app. Your full ledger — every transaction, your holdings with their cost base, realized gains by year, and the history of every edit and deletion — downloads as a CSV from Settings → Accounts & data → Download my ledger on the web, or Settings → Download my ledger on Android, where it is also the first step of Delete Account. Reports save as PDF. Download before deleting your account — deletion cannot be undone.
- Correct it: every profile field is editable in Settings.
- Delete it: in the iPhone or Android app, Settings → Delete Account, re-entering your password. Immediate, and it cannot be undone. There is no self-serve delete on the web yet — ask in the app's help chat and it will be done for you.
- Disconnect: unlink a broker, turn off alerts, or stop using AI reports at any time.
6. Security
Passwords are PBKDF2-hashed. Broker tokens are encrypted at rest. Sessions are short-lived and refresh tokens are single-use with reuse detection. Traffic is HTTPS only. None of this makes a breach impossible, and if one occurs that affects you, you will be told.
7. Children
CompoundWise is not intended for anyone under 18 and accounts are not knowingly created for them.
8. Changes
Material changes will be shown in the app and re-accepted, with the version and date recorded.