Last updated 22 September 2026

Privacy Policy

This describes what Wheelhouse collects, what it deliberately does not, and how to make it forget you. It is written to be accurate about this specific product rather than to cover every eventuality, so if something here does not match what the software actually does, treat that as a bug and tell us.

What we collect

• Your email address and password. The password is stored only as a hash produced by scrypt with a random per-account salt. We cannot read it, and neither can anyone who obtains a copy of our database.
• Your brokerage data, read through your own broker connection. Positions, cash balances, option contracts, order and assignment history, and market data for the symbols you look at. This is read on demand to answer the page you are on.
• An email address you give the waitlist. Stored with the date you gave it, used only to send you an invitation, and deleted on request.
• Settings you create in the app — your watchlist, screener thresholds and trigger preferences.
• Session records. For each device you sign in on we store the hash of a session token, when the session started, when it was last used, and a coarse device description such as "Safari on macOS", so you can see and revoke your own sign-ins.

What we do not collect

• Your broker password. You sign in on your broker's own site. That exchange never passes through Wheelhouse.
• Permission to trade. Wheelhouse requests read and market data access only. It has no authority to place, modify or cancel an order, and would be refused by your broker if it tried.
• Analytics, advertising and tracking. There are no third-party analytics scripts, no advertising networks, no tracking pixels, and no cookies other than the single one that keeps you signed in.
• Your bank account or payment details. Wheelhouse does not process payments.

Where it lives

Account data, settings and session records are stored in Amazon Web Services in the US East (Northern Virginia) region, encrypted at rest. Your broker connection credential is stored the same way and never leaves our servers — it is not sent to your browser, does not appear in any API response, and is not accepted as input on any request.

Market data and positions are fetched from your broker when a page needs them and are not cached across accounts.

Who else sees it

Wheelhouse uses a small number of services to function, and shares with them only what each one needs:

• Your broker — receives the requests that read your own account.
• Amazon Web Services — hosting and storage.
• Finnhub — asked for a company's logo by ticker symbol. It is told which symbol, never who asked.

We do not sell personal information, and we do not share it for advertising. We would disclose data if compelled by valid legal process, and would tell you unless prohibited from doing so.

How long we keep it

Account data and settings are kept while your account exists. Session records expire automatically — seven days after last use, and in all cases thirty days after sign-in. Deleting your account removes your account record, settings, sessions and broker connection.

What you can do

• See your sign-ins and revoke any of them, or all of them at once, from within the app.
• Disconnect your broker at any time, from Wheelhouse or from your broker's own dashboard. Revoking it there works even if Wheelhouse is unreachable.
• Delete your account, which destroys the data described above.
• Ask for a copy of what we hold about you.

Depending on where you live you may have further rights over your personal data, including correction and portability. Ask and we will honour them.

Children

Wheelhouse is not intended for anyone under 18, and we do not knowingly collect information from them.

Changes

If this policy changes in a way that affects what we collect or who sees it, we will say so by email before the change takes effect rather than quietly updating the date at the top.

Contact

Questions, requests, or a correction to anything above: privacy@wheelhouse.fyi.