Privacy Policy

Ekpa is a research and education product that shows your investment accounts, positions, news, and analysis in one dashboard. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account details. Your name, email address, birthday, and a password. Passwords are never stored in plain text, only as a salted hash.
• Brokerage data. When you connect a brokerage through SnapTrade, we receive a read-only snapshot of your accounts, balances, and positions. We never receive your brokerage username or password. You sign in on your broker's own page.
• Investor profile answers. The optional questionnaire you fill in so analysis can be tuned to you.
• Usage data. Basic product analytics (pages viewed, features used) collected through PostHog to help us improve Ekpa.
• Payment information. If you subscribe to a paid feature, payment is handled by Stripe. We never see or store your card number.

How we use it

• To display your portfolio and generate research, news, and alerts built from what you actually own.
• To send you the emails you ask for such as verification codes, price alerts, and digests you opt into.
• To operate, secure, and improve the product.

What we never do

• We never sell your personal information.
• We never take custody of funds or securities, and our brokerage connection cannot place trades or move money.
• We never see or store your brokerage login credentials.

Service providers

We rely on a small set of providers to run Ekpa: SnapTrade (brokerage connections), Stripe (payments), Resend (email delivery), PostHog (product analytics), and cloud infrastructure hosting. Each receives only what it needs to do its job.

Data retention and deletion

Disconnecting a brokerage account immediately removes its imported holdings from Ekpa.

Cookies

We use a session cookie to keep you signed in and analytics identifiers to understand product usage. We do not use advertising cookies.

Security

Passwords are stored as salted scrypt hashes, session tokens are hashed at rest, and the app runs with strict browser security policies and rate-limited endpoints.

Changes to this policy

If we make material changes, we will update the date above and, where appropriate, notify you by email or in the product.

Contact

Questions or requests: founders@goekpa.com.