Privacy
What stays with you, what is sent, and how to check it yourself.
Last updated: 23 September 2026
In short
- Your Trade Republic export is read and analysed in your browser: it is never sent, neither to this site nor to anyone else.
- No cookies, no trackers, no analytics, no user account.
- Only security identifiers (ISIN, ticker) are sent to this site’s server, to fetch market prices.
- Nothing is kept on your device unless you tick Remember on this device.
Your exports never leave your browser
The CSV export contains personal information: your trades, your card payments and the merchants involved, your transfers, sometimes IBANs and names. The file you drop is read by the page’s JavaScript, on your device, and all the calculations (returns, spending categories, income) happen there. No request contains your amounts, quantities, dates, payments, name or IBANs.
What is sent to this site’s server
To value your securities, market prices are needed. Two kinds of requests go to this site, and only if your export contains securities:
| Request | Content | Why |
|---|---|---|
/api/resolve/<ISIN> | a security’s ISIN | find its Yahoo Finance ticker |
/api/prices/<ticker> | a security’s ticker | get its history of closing prices in euros |
The history requested is always complete, since 2019 (when Trade Republic opened): the server does not learn when you bought. Like any website, however, it sees the IP address the requests come from and the list of securities requested. The IP address is only used, in memory and for a few minutes, to limit the number of requests per visitor (protection against abuse); it is not written to any log. Requests to Yahoo Finance are made by the server: your IP address is never passed on to Yahoo.
Prices are cached per security, for all visitors, and are not linked to anyone.
When you arrive on the site’s main address, your browser’s language (the Accept-Language header, sent by
every browser) is only used to open the version in your language. It is neither stored nor used for anything else.
What is stored on your device
Nothing, by default: closing the tab erases everything. If you tick Remember on this device, your exports, the tickers you corrected, the transfers marked “my accounts”, your display preferences and a cache of prices are saved in your browser’s storage (IndexedDB, plus two flags in localStorage: remembering switched on, automatic opening), for this site only. This storage is never read by the server. Clear everything deletes it at any time, as does unticking the box.
On your next visit, the home page only shows the remembered export (name and date range): it is only opened if you click Open, or automatically if you ticked Open automatically on every visit (unticked by default).
This storage is triggered by your own action and is strictly necessary for the service you ask for: it does not require a consent banner. On a shared computer, do not tick the box.
Hosting
The site is hosted by OVH SAS (OVHcloud, Roubaix, France), on a server located in the European Union. OVHcloud provides the infrastructure (server, network) and acts as a technical processor: it has no access to your exports, which never leave your browser. The host’s full details are in the legal notice.
Controller and your rights
- Controller
- Yann Avondo, publisher of the site
- Data processed
- IP address and identifiers of the securities requested, temporarily, to serve prices and limit abuse
- Legal basis
- Legitimate interest: running and securing the service (Article 6(1)(f) GDPR)
- Retention period
- None: nothing is stored; the in-memory anti-abuse counter expires within a few minutes
- Recipients
- None, apart from the host for the technical routing of requests
You have the rights of access, rectification, erasure, objection and restriction provided by the GDPR. As no data about you is kept, there is in practice nothing to consult or delete on the server side; your local data is erased with Clear everything. For any question, contact the publisher via LinkedIn. You can also lodge a complaint with the French data protection authority, the CNIL, or with the supervisory authority of the country where you live (Article 77 GDPR; see the list of European authorities).
How to check it
- Open the developer tools (F12), Network tab, then import your export:
only
/api/resolve/…and/api/prices/…requests to this same site appear. - The page is served with a security policy (
Content-Security-Policy: connect-src 'self') that forbids the browser from contacting any other domain, even if the code tried to. - No third-party scripts: the fonts and the charting library (Chart.js) are hosted here.
- The code is neither compiled nor minified, so you can read it exactly as it runs: import.js (reading the export), engine.js (investment calculations), budget.js (spending and income), prices.js (the only network requests), store.js (local storage), app.js, budget-view.js (display) and i18n.js (interface text, in the page’s language).