Privacy

Last updated: 24 September 2026

In short

• Your Trade Republic export is read and analysed in your browser: it is never sent, neither to this site nor to anyone else.
• No cookies, no trackers, no analytics, no user account.
• Only security identifiers (ISIN, ticker) are sent to this site’s server, to fetch market prices.
• Nothing is kept on your device unless you tick Remember on this device.
• If you use the support form, your message is emailed to the publisher.

Your exports never leave your browser

The CSV export contains personal information: your trades, your card payments and the merchants involved, your transfers, sometimes IBANs and names. The file you drop is read by the page’s JavaScript, on your device, and all the calculations (returns, spending categories, income) happen there. No request contains your amounts, quantities, dates, payments, name or IBANs.

What is sent to this site’s server

To value your securities, market prices are needed. Two kinds of requests go to this site, and only if your export contains securities:

The history requested is always complete, since 2019 (when Trade Republic opened): the server does not learn when you bought. Like any website, however, it sees the IP address the requests come from and the list of securities requested. The IP address is only used, in memory and for a few minutes, to limit the number of requests per visitor (protection against abuse); it is not written to any log. Requests to Yahoo Finance are made by the server: your IP address is never passed on to Yahoo.

Prices are cached per security, for all visitors, and are not linked to anyone.

To monitor the server’s load, each request adds a line to a counter: the site requested, the method, the status code, and the size and duration of the response. No IP address, no page address (so no ISIN or ticker), no browser, no referrer: these lines relate to no one. They are deleted after 14 days.

The server also measures its own speed: for each request, the type of request (for example /api/prices/{ticker}, without the ticker), the method, the status code and the duration; for the machine, processor, memory and disk usage; and, taken from the counter above, the number of requests and their duration per site. The server sends these measurements to Grafana Cloud (Grafana Labs), on servers located in Germany (European Union), which deletes them after 14 days. They contain no IP address, no page address, no ISIN, no ticker and no information about your browser, and your browser never contacts Grafana.

When you arrive on the site’s main address, your browser’s language (the Accept-Language header, sent by every browser) is only used to open the version in your language. It is neither stored nor used for anything else.

What is stored on your device

Nothing, by default: closing the tab erases everything. If you tick Remember on this device, your exports, the tickers you corrected, the transfers marked “my accounts”, your display preferences and a cache of prices are saved in your browser’s storage (IndexedDB, plus three flags in localStorage: remembering switched on, automatic opening, amounts hidden), for this site only. This storage is never read by the server. Clear everything deletes it at any time, as does unticking the box.

One exception: if you switch theme with the button at the top of the page (light or dark), that choice is kept in localStorage (a single value, light or dark) so that the other pages look the same. Without that click, the site follows your device’s setting and stores nothing. Clear everything deletes this choice too.

On your next visit, the home page only shows the remembered export (name and date range): it is only opened if you click Open, or automatically if you ticked Open automatically on every visit (unticked by default).

This storage is triggered by your own action and is strictly necessary for the service you ask for: it does not require a consent banner. On a shared computer, do not tick the box.

Support form

The support form is the only place on the site where you send content yourself. The type of request, your message and the language of the page are emailed to the publisher; the server neither stores nor logs them. Your IP address is only used, in memory and for one hour, to limit the number of messages; it is not included in the email.

The message is then kept in the publisher’s mailbox (Gmail, provided by Google, which may process this data outside the European Union under the EU–US Data Privacy Framework) for as long as it takes to handle your request, and at most 12 months. Any contact details you leave in the message are only used to reply to you. Do not include your export, an IBAN or login details.

Hosting

The site is hosted by OVH SAS (OVHcloud, Roubaix, France), on a server located in the European Union. OVHcloud provides the infrastructure (server, network) and acts as a technical processor: it has no access to your exports, which never leave your browser. The host’s full details are in the legal notice.

Controller and your rights

Controller

Yann Avondo, publisher of the site

Data processed

IP address and identifiers of the securities requested, temporarily, to serve prices and limit abuse; if you write to support, your message and any contact details you include

Legal basis

Legitimate interest: running and securing the service, and answering the messages you send (Article 6(1)(f) GDPR)

Retention period

No personal data is stored on the server (the anonymous request counter is deleted after 14 days, as are the performance measurements sent to Grafana Cloud); the in-memory anti-abuse counter expires within a few minutes (one hour for the support form). Support messages: at most 12 months in the publisher’s mailbox

Recipients

None, apart from the host for the technical routing of requests and Google (Gmail) for support messages

You have the rights of access, rectification, erasure, objection and restriction provided by the GDPR. No data about you is kept on the server; a message sent to support can be shown to you or deleted on request; your local data is erased with Clear everything. For any question, contact the publisher via the support form or LinkedIn. You can also lodge a complaint with the French data protection authority, the CNIL, or with the supervisory authority of the country where you live (Article 77 GDPR; see the list of European authorities).

How to check it

• Open the developer tools (F12), Network tab, then import your export: only /api/resolve/… and /api/prices/… requests to this same site appear.
• The page is served with a security policy (Content-Security-Policy: connect-src 'self') that forbids the browser from contacting any other domain, even if the code tried to.
• No third-party scripts: the fonts and the charting library (Chart.js) are hosted here.
• The site’s code is neither compiled nor minified (only the Chart.js charting library is served in its official minified build), so you can read it exactly as it runs: import.js (reading the export), engine.js (investment calculations), budget.js (spending and income), prices.js (the only network requests), store.js (local storage), theme.js (light or dark theme), app.js, budget-view.js (display), rewards.js (Saveback), support.js (support form) and i18n.js (interface text, in the page’s language).