Privacy and security

Your data is encrypted in your browser

Everything SmartStrikes stores in your browser, including your imports, cached analysis, settings and saved API keys, is encrypted and kept separately for each user. After you sign in with Google, your PIN unlocks it. Another person who signs in on the same browser, or anyone with a copy of the browser's files, can't read your data.

Your imported CSV files are read in your browser and stay there. They are never uploaded or synced.

Your PIN

Your PIN is 6 digits, not all the same. A few things make it stronger than it sounds:

• Guesses are checked by the server. Your browser holds no copy of the PIN, so it can't be guessed offline. After 5 wrong PINs you're locked out for 15 minutes, then longer after repeated lockouts (an hour, then a day). Wrong guesses never erase anything; you just wait and try again.
• Your Tastytrade connection needs it too. SmartStrikes won't use the connection until you've unlocked, so someone who has only your Google sign-in reaches nothing.
• Changing it in Settings → Security & account takes effect everywhere at once. Other open browsers ask for the new PIN within a few minutes, so a browser unlocked with the old one doesn't stay open.

Locking and signing out

Locking after an hour

After an hour without any mouse or keyboard input, the PIN screen covers the app, whether or not the tab is in view. It's a cover, not a sign-out: live data keeps streaming behind it, and entering your PIN puts you back where you were. You can turn it off in Settings → Security & account → Lock after an hour of inactivity, but only do that on a computer nobody else uses.

Signing out

Sign out is at the bottom of every Settings page. It asks what to do with your data in this browser; neither answer is preselected:

• Keep my data on this device: your imports, cached analysis and settings stay, encrypted, and nobody can open them without your PIN. Best for your own computer.
• Remove my data from this device: deletes them from this browser only. Your PIN and your data in other browsers are unaffected. Best for a shared or public computer.

Either way, your Tastytrade connection and subscription stay as they are, and you sign in again with Google and your PIN.

Privacy mode for screen sharing

Settings → General → Privacy → Privacy mode hides account numbers on screen, showing only the last 3 digits, like ••••345. Use it for screen shares, recordings and screenshots. It covers the account picker, the Account tab, imported account and file names, and account labels in tooltips. It only changes what's shown: exports keep the full numbers. It's a per-browser choice and doesn't sync.

Your Tastytrade connection

SmartStrikes connects to Tastytrade (on Pro) through a personal OAuth application that you create in your own Tastytrade account. You give SmartStrikes its Client Secret and a Refresh Token, never your Tastytrade password.

• Read only. When you create the grant, select the read scope only. SmartStrikes never places orders, so it refuses a grant that also has the trade scope and asks you for a read-only one.
• Stored on the server, encrypted. The two values are kept encrypted on the SmartStrikes server, never in your browser. Signing out doesn't affect them.
• You can remove it any time. In Settings → Security & account → Tastytrade connection, Disconnect Tastytrade makes SmartStrikes forget it. Because the grant belongs to your Tastytrade account, you can also remove it there.

What SmartStrikes sees and stores

• Google only confirms who you are. SmartStrikes never sees your Google password.
• Payments are made on Stripe's checkout page. Your card details are entered there, not in SmartStrikes.
• Synced settings (optional) are encrypted in your browser before they're sent, with a key released only after you sign in and enter your PIN. The server stores them without the key and doesn't decrypt them. It isn't end-to-end encryption, though: the key comes from a secret the server holds. Turning sync off deletes the server's copy.
• AI endpoints and their keys stay in your browser unless you also turn on Sync AI endpoints, which stores them encrypted on SmartStrikes servers. Turning it off removes them.
• Your Alpaca key is used straight from your browser to request market data from Alpaca. With sync on, it travels inside the encrypted settings copy.
• AI Analysis sends your analysis to the AI provider you set up, under that provider's terms.
• SmartAssist receives your question, the conversation so far, and which screen you're on with a few facts about what it's showing. It doesn't receive your account data, positions or imports.
• Your agreement to the Terms is recorded with your account and the date, so you aren't asked again in each browser.

The browser can clear site data

Browsers treat site storage as removable, and Chrome may clear it when the disk is nearly full. SmartStrikes asks the browser to keep its storage each time you unlock, but the browser decides. If it's cleared, you sign in again with Google and your PIN. Your Tastytrade connection is kept on the server and synced settings come back, but imports, which are never synced, are lost.