How we protect your information
- No broker passwords. You log in on your broker's or SnapTrade's own screen. We receive only a connection that lets us read your account.
- Read-only. PinkGuava cannot place trades, move money or change your broker account.
- Separation between users. The database enforces row-level rules, so one account's data cannot be read through another account's session.
- Encryption in transit. The website, the app and our server all use HTTPS. Our database provider also encrypts stored data.
- Secrets stay on the server. Service keys and API keys are kept in server settings, never in the web app.
- Hashed access tokens. The tokens used for scheduled tasks are stored as one-way hashes, not in plain text.
- Admin access is limited. Admin pages and system jobs need a signed-in admin or a secret header.
- Abuse limits. Access requests, support reports and Guava AI questions are rate-limited.
- Review before saving. Imports from screenshots and statements are shown to you to check before they are saved.
What you can do
- Use a strong, unique password for PinkGuava.
- Keep your email account secure, because password reset links go there.
- Disconnect brokers you no longer use from Connected accounts.
- Do not share screenshots of your account with people you do not trust.
Reporting a security problem
If you believe you have found a vulnerability, email hello@pinkguava.co with the subject "Security". Please tell us what you found, how to reproduce it, and how to reach you. We will reply as soon as we can.
We ask that you give us reasonable time to fix the issue before sharing it, avoid accessing other people's data, and avoid disrupting the service. If you act in good faith within these limits, we will not take legal action against you.
If something goes wrong
If a breach of our systems affects your information in a way that could cause you real harm, we will tell you and report it to the regulator where the law requires. We keep a record of security incidents.
Limits
No system is perfectly secure. We work to keep PinkGuava safe, but we cannot promise that nothing will ever go wrong. See our Privacy Policy and Terms.