How Parallax handles your data.

Authentication and authorization

Signing in with email and password, and confirming your email, are handled by Supabase. Every request to the server is tied to your signed-in session, and you can only read your own portfolio. New beta accounts also need approval from an administrator.

Production transport

The site is served over HTTPS, with headers that stop it being framed by other sites, stop browsers guessing file types, and limit what is sent to other sites as the referring page. Encryption in transit does not protect a compromised device or account.

Broker credential handling

Every stored broker credential is encrypted before it is saved: the Interactive Brokers Flex token, the eToro key pair and the Trading 212 key pair. Each broker has its own server encryption key, so changing one cannot affect another. If that key is missing, saving fails rather than storing the credential unencrypted. No credential is shown back in the browser after it is saved; you see a masked hint.

What each credential allows differs, and that is for you to weigh. Interactive Brokers Flex tokens and eToro keys can only read, by the broker’s own rules. A Trading 212 key has the permissions you choose when you generate it. Parallax asks only for the read permissions, which are account data, portfolio and history, but it cannot see which permissions a key holds, and a key generated with order permissions could place orders. Parallax never calls the order endpoints: its Trading 212 client only sends read requests, and an automated test fails if that changes. A read-only key makes the broker enforce the same limit. Trading 212 lets you restrict a key to specific IP addresses, or revoke it, at any time.

Read-only by design

Parallax imports or fetches statements and analyzes them. It has no way to place an order or move money, even where a broker’s credential would allow it. That lowers the risk, but your financial history is still sensitive data.

Data the product uses

• Account identity and profile information required for authentication and approval.
• Brokerage transactions, holdings, cash events, instrument identifiers, account labels, notes, and reasoning you import.
• Calculated portfolio values, returns, move edges and trade labels, analytics, stored calculations, and assistant conversation history.
• Server logs and error reports needed to run the beta and fix problems.

Why it is used

Parallax uses this data to sign you in, rebuild and analyze your portfolio, provide the features you use, fix failures, keep the service secure, and run the private beta. It cannot place orders.

Usage analytics

The public pages, meaning this one, the home page, methodology, coverage and status, count visits with Umami Cloud. It sets no cookies and stores no identifier in the browser. For each page view, and for a click on a sign-in or request-access link, it sends the page address and title, the referring page, the screen size, and the browser language. It is not counted when the browser sends Do Not Track, and the script is a copy Parallax reviewed and serves itself, not one loaded from Umami. It is not loaded inside the signed-in application.

Inside the application, Parallax records which features an approved user opens and uses, for example that an import was started or a tab was viewed. These events are stored in its own database, against that user’s account, to understand how the beta is used. Portfolio values and holdings are not part of them. Neither the public pages nor the app use advertising or cross-site tracking.

The numbers do not come from the AI

Portfolio values, return calculations, move edges, trade labels, and analytics are calculated by Parallax’s own code. The assistant only reads and explains them.

Third-party model processing

When you use the assistant, your question, the recent conversation, the assistant’s instructions and the portfolio data needed to answer can be sent to Anthropic’s API. Conversations are also stored by Parallax so you can pick them up later.

What a connection is

You can connect your own Claude, ChatGPT or other MCP client to Parallax. Claude and ChatGPT connect when you sign in to Parallax and approve read access on a page that names the assistant. Other clients use a personal access token, shown once and stored only as a one-way hash. You can revoke either from Settings → Agent access, and a token also stops working when it expires.

What it can do

A connected assistant calls the same calculations the dashboard shows, for the whole portfolio or one account, limited to 30 calls a minute. It cannot trade, move money, or change portfolio data. The one thing it can write is a file in your import inbox, and nothing in that file reaches the portfolio until you review and confirm it in the import wizard. Its access is limited to the part of Parallax built for assistants, never the app itself.

Where the data goes

The results of each call go to the assistant you connected, and its provider processes them under your own agreement with it, not Parallax’s. Disconnecting stops further access; it does not delete what the provider already received.

Who takes the payment

Paid plans are announced and not yet on sale; during the beta nothing is charged. When they open, they are sold through Link, Stripe's checkout, which is the merchant of record: Link takes the payment, charges the VAT that applies where the buyer lives, sends the receipt and invoice, and handles payment disputes. A card statement shows LINK.COM* PARALLAX.

What Parallax stores

Parallax stores the Stripe customer ID, the plan, its status and its renewal or end date, so the app knows what an account has paid for. Card numbers and other payment details are entered on Stripe's page and never reach Parallax. Stripe and Link process them under their own privacy policies.

Cancelling and downgrading

Cancelling ends a plan at the end of the paid period, and a downgrade deletes nothing. An account left with no plan is locked until one is chosen; its data is kept, and the backup export stays available. The termsterms, published when paid plans open, set out renewal, the EU right of withdrawal, refunds, and what a smaller plan keeps.

Export

You can export a portfolio backup as a JSON file from Settings. It is meant for moving and restoring your data, and may not include everything that every connected service stores.

Deletion

There is no complete self-service account deletion yet. During the private beta, ask for deletion by writing to support or replying to your invitation. A documented and tested deletion and retention process will be in place before public signup or paid plans open.

User responsibility

Do not upload brokerage data you are not authorized to use. Protect account credentials and exported backup files. Broker statements can contain account numbers and other financial identifiers.

• Parallax is analytical software for education and retrospective review. It is not investment, tax, legal, accounting, or financial-planning advice.
• Parallax does not know your complete financial position, objectives, risk tolerance, liquidity needs, or tax circumstances.
• Past performance, move edges, trade labels, benchmark comparisons, and counterfactual outcomes do not predict future results.
• Market and FX data can be delayed, missing, stale, adjusted, or matched to the wrong instrument. Review coverage warnings and source records.
• A ghost rests on assumptions. It may not reflect everything that would have happened on the path you did not take, such as dividends, taxes, fees, liquidity or slippage.
• No score proves skill, luck, causality, or that repeating a historical action will improve returns.

The decisions are yours, and so is checking important numbers against your broker’s records and, where it makes sense, with a qualified adviser.

Write to support@parallaxinvesting.com for support, billing, privacy and security questions. Include the approximate time, affected account, and action that failed, but never send a password, session token, IBKR Flex token, raw brokerage statement, or complete account number.

There is no promised response time yet. You can request beta access below; the seller's identity is on the terms pageis published when paid plans open.

Request beta access

Current trust disclosure revision: 7 October 2026.