Trader is a teaching demonstration: a simulated trading workstation built for a course on agentic AI coding. The money is imaginary, the portfolio is imaginary, and nothing here is financial advice. This page describes what the app stores anyway, because it does store something, and you should be able to find out what.
What is stored if you never sign in
Visiting the app creates an anonymous guest account. It is identified by a random id held in a single signed cookie named trader_session. That id is not derived from anything about you — it is not an advertising identifier, and it is not shared with anyone.
Attached to that id, the app stores the work you do in it:
- your watchlist
- your positions, your cash balance, and the log of simulated trades behind them
- periodic snapshots of your portfolio’s total value, which draw the P&L chart
- the messages you exchange with the AI assistant
- when the account was created and when it was last used
What signing in adds
Signing in with Google or GitHub is optional, and exists for one reason: it attaches the guest portfolio you already have to an account, so it survives a change of browser. It grants no extra access to anything and unlocks no extra features.
When you sign in, the app stores what the provider returns about you:
- your account id at that provider, and which provider it was
- your email address
- your display name and the URL of your avatar image
No password ever reaches this app, and neither does anything else in your Google or GitHub account. Trader asks each provider only for your basic profile and email.
Cookies
One cookie, trader_session, which holds the signed id described above. It is what makes your portfolio still be yours on your next visit. There are no analytics cookies, no advertising cookies, and no third-party trackers on any page of this app.
One further cookie, trader_oauth, is written only while a sign-in is in progress. It carries the OAuth state and the verifier that together prove the round trip came back to the same browser that started it. It is cleared when the sign-in finishes, and expires by itself within ten minutes either way.
How long it is kept
A guest account that goes unused for seven days is deleted outright, along with its watchlist, positions, trades, snapshots, and chat history. A signed-in account is kept until you ask for it to be deleted.
Who else sees it
The app runs on infrastructure operated by other companies, and they process data on its behalf:
- Vercel hosts the deployment and routes requests to it.
- Neon hosts the Postgres database everything above is stored in.
- Google and GitHub see a sign-in request only if you choose to sign in with them.
- OpenRouter would receive your chat messages if the live AI assistant were enabled. On this deployment it is not: the assistant runs in a deterministic mock mode, so chat messages are answered on the server and are never sent to any model provider.
Nothing is sold, rented, or handed to advertisers. There is no profiling and no behavioural tracking.
Deleting your data
Signing out drops the session cookie; the next visit starts a fresh guest. To have an account and everything attached to it deleted, or to ask what is held about you, write to busek.vit@gmail.com.
Security, honestly stated
This is a course project, not a commercial service. Anyone who has the URL can use it and be given their own guest portfolio; accounts are isolated from one another, but the app itself is open to the public and carries no access control. Please do not put anything sensitive into the chat panel — it is a demonstration, and it should be treated as one.
Changes
If this policy changes, the date at the top changes with it. The whole history of this page is public in the project’s Git repository.