Privacy Policy

Last updated 7 October 2026

1. Who we are

Informed Trader is operated by Informed Investing, ABN 86 561 347 081. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Contact: [email protected].

2. What we collect

Account

• Your email address.
• Your password, stored only as a cryptographic hash. We never store and cannot read your password.
• Email-verification tokens, stored only as a hash, so that a copy of our database cannot be used to verify an address.
• Your access tier and account status, and the dates the account was created and verified.

Sign-in and security

• Session tokens, stored as hashes, together with the IP address and browser user-agent of the session.
• Failed sign-in attempts, recording the IP address and the email address tried. This exists to rate-limit password guessing and for no other purpose.
• If you sign in with Google: the account identifier Google gives us and the email address on it. We never receive your Google password.
• If you joined by invitation: which invite code you redeemed.

Using the product

• The tickers on your watchlist and where each came from.
• How many analyses you have run, so shared limits can be applied fairly.
• Which alerts you have acknowledged, and when the acknowledgement expires.
• The date you last opened each ticker on your watchlist (recorded at most once a day), used only to ask now and then whether you still want it there.
• Your answers to that question: which tickers you chose to keep, and how often you want to be asked. None of this is used for anything else, and it is deleted with the ticker or the account.
• Your dashboard layout, if you change it.

Portfolio Advisor

• Your answers to its setup questions: risk tolerance, time horizon, primary goal and, if you give one, the amount you plan to invest.
• Which tickers on your watchlist you mark as owned, and how many shares.
• Dividend figures you enter: the amount per share, how often it is paid and the month of the first payment.

Watched valuations

Valuation assumptions you type in are not stored unless you choose Save and watch for a ticker. For each valuation you watch, we keep:

• The model, every assumption you entered, your margin of safety and how close to the value you asked to be told.
• The value those assumptions produce, and the closing price you saved it at.
• Each level the price has closed at since, and whether a notification was sent.

These are deleted when you stop watching the ticker, unfollow it or close your account. If you ask for an explanation of a valuation, its assumptions are sent to our own language model to write that answer and are used for nothing else.

Tax records

We keep the following information for each trade if you decide to record your trades for tax purposes:

• The market, the company, the date and time, the number of shares, the amount, the fees and GST, and any exchange rate or note you add.
• The parcels that you have chosen for a sale.

We also keep the following information if you decide to record your investment income:

• Each dividend, interest payment, fund distribution or brokerage rebate: the company, the dates, the amount, any tax withheld, franking credits and fees, and any exchange rate or note you add.
• The figures you enter from a fund’s annual tax statement.

We also keep the following information if you import a monthly statement from your broker:

• The month of the statement, the date you imported it, and the number of shares of each company that you held at the end of that month.

The files that you import are not kept. We take the trades, payments and holdings from them, and your name, address and account number are never stored.

These records are kept until you delete them or close your account. They are not deleted when you unfollow a ticker, because a past sale is still part of your tax records. The Reserve Bank exchange rates used to convert them are published figures and contain nothing about you.

Optional connections

• A connected broker. Access and refresh tokens, stored encrypted, and the permissions you granted. The connection is read-only and a grant including a write permission is refused rather than stored. We never receive your broker password.
• Push notifications. If you enable them, your browser's push subscription, plus a record of what was sent so the same alert is not delivered twice. They carry position alerts, if you have connected a broker, and word when a valuation you watch reaches a level you chose.

Operational records

We keep an audit log of administrative actions taken on accounts, so that changes made by an operator can be accounted for.

3. What we do not collect

• No payment details. There is no billing system in the product and we take no card or bank information.
• No advertising trackers, no cross-site tracking, no behavioural profiling, and no third-party ad networks. The only analytics we use are the visit counts described in section 7, which set no cookies and collect no personal information about you.
• No sale of personal information, ever, to anyone.

4. Cookies

We set one cookie, it_session. It holds your session identifier, is marked HttpOnly so page scripts cannot read it, and exists solely to keep you signed in. It is strictly necessary — without it the Service cannot tell one signed-in person from another. There are no advertising or analytics cookies. Signing out clears it.

Cloudflare, our network provider, may also set a cookie named cf_clearance. It records that your browser has passed Cloudflare's check for automated traffic, and it is used only for security, not for analytics or advertising.

5. How we use your information

• To provide the Service, including generating analysis for the tickers you follow.
• To keep your account secure and to detect and prevent abuse.
• To apply the limits that keep a shared market-data budget available to everyone.
• To contact you about the Service — verification, security matters and material changes.

6. AI processing

The language model that writes each analysis runs on infrastructure we operate. Your watchlist and the prompts built from it are not sent to a third-party AI provider, are not used to train anyone else's model, and do not leave our systems as part of generating analysis.

7. Who else receives data

• Our market-data provider receives ticker symbols so it can return prices. It does not receive your identity or your account, and cannot tell which user a symbol was requested for.
• The US Securities and Exchange Commission (SEC). Company figures for valuations come from its public EDGAR filings. It receives the identifier of the company being looked up, and nothing about you or which user asked.
• News sources. We fetch public feeds on a schedule. They receive nothing about you.
• Google, if you sign in using your Google account.
• Your broker, if you link your broker account.
• Our hosting and network providers, including Cloudflare, the content delivery network that every request to our website passes through. Cloudflare necessarily sees the IP address of each request in order to route it.
• Cloudflare Web Analytics. We use Cloudflare's analytics service to count visits to our website. It records the page visited, the website that referred you, your browser, operating system and type of device, your country, and how quickly the page loaded. It sets no cookies, does not collect personal information about you, and is not used for advertising.
• Cloudflare's security checks. Cloudflare adds a small script to our pages that helps it tell people apart from automated traffic, and the sign-up and password reset forms include Cloudflare's Turnstile check for the same purpose. Neither is used for analytics or advertising.
• Law enforcement or regulators, where we are legally required to disclose information.

8. Overseas disclosure

Some of the providers above are located outside Australia, including in the United States. Where we disclose personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

9. Security

Passwords and session tokens are stored as hashes, broker tokens are encrypted at rest, and traffic is encrypted in transit. Access to production systems is limited to those who need it. No system is perfectly secure, and we cannot guarantee absolute security — if we become aware of a data breach likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as required.

10. How long we keep it

Account and watchlist information is kept while your account is open. If you close your account we delete or de-identify your personal information, except where we are required to retain it by law. Security records such as failed sign-in attempts and session metadata are kept only as long as they are useful for that purpose. Aggregate, non-identifying analysis of market data is retained.

11. Your rights

You can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, or to delete your account and the information attached to it. Email [email protected] and we will respond within a reasonable time. We may need to verify your identity first.

12. Complaints

If you think we have mishandled your personal information, contact us first at [email protected] and we will investigate. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Children

The Service is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has created an account, tell us and we will remove it.

14. Changes to this policy

We may update this policy. If a change is material we will give reasonable notice. The "last updated" date above always reflects the current version.