Privacy Policy for SGX Tracker

Last Updated: April 2026

Google API Limited Use Disclosure:
SGX Tracker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1. Where Your Portfolio Data Lives

SGX Tracker is designed so your portfolio data lives in your own cloud storage account, not on a server we control. Specifically:

Google Drive: We use the appDataFolder scope to store your portfolio files in a hidden folder that only this app can access.
OneDrive: Files are stored at /Apps/SGXTracker/.
Local-only mode: Files are stored in your browser's localStorage and never leave your device.

The transactions, dividends, and settings files themselves are never sent to or stored on a server we operate. You can delete them at any time by removing the files from your cloud account.

2. What We Do Send to Our Server (Analytics)

We operate a Cloudflare Worker (sgx-tracker-proxy) that does two things: (a) proxy live SGX prices from Yahoo Finance, and (b) record anonymous usage analytics so we can understand how the app is used and detect outages.

2.1 Price queries

When the app shows you live prices, it sends the list of stock symbols you hold to the Worker. The Worker does not see how many shares you own, your purchase prices, or any totals.

2.2 Usage analytics events

The app sends event-level analytics to our Worker. These events are recorded in Cloudflare Analytics Engine and used in aggregate to monitor app health. Event types include:

App lifecycle: app_open, page_view, page_dwell, theme_change
Auth: login_success, login_failed (with provider only — no email or token)
Portfolio events (this is the part you should know about):
- session_start — sends total cost basis bucketed to the nearest S$1,000 and total transaction count
- transaction_add — sends ticker symbol, sector, share count, and trade value bucketed to S$1,000
- transaction_edit, transaction_delete — sends ticker symbol
- portfolio_snapshot, achievement_level — sends derived portfolio metrics
- dividend_sync, twr_result — sends derived metrics
Errors: error events with the type of error

We send these to detect issues and understand usage, not to identify you. If you want to use the app without sending these events, use a network blocker that drops requests to sgx-tracker-proxy.ladiida.workers.dev/event; this will not affect any other functionality.

2.3 Visitor identification

Each event is tagged with a daily-rotating identifier derived from the SHA-256 hash of your IP address combined with a date-based salt. The same IP produces a stable identifier within a single calendar day (so we can count unique visitors that day) but a different identifier the next day. We do not store raw IP addresses in Analytics Engine.

2.4 Cloudflare Web Analytics

Our pages also include the Cloudflare Web Analytics beacon, which records page-level traffic without cookies. See Cloudflare's documentation for details.

3. Use of Google User Data

We request access to your Google account for the following purposes:

View and manage its own configuration data (Drive): To save and load your stock transactions in a hidden app-data folder. We cannot see any other files in your Drive.
View your email address: To display your identity within the app interface.

We do not transfer Google user data to any third party. We do not use it for advertising or for any purpose other than what is described above.

4. Data Deletion and Security

You can delete your portfolio data at any time by deleting the files from your Google Drive or OneDrive account, or by clearing browser storage in local-only mode. Authentication is handled via official OAuth 2.0 flows, meaning we never see or store your password.

Analytics events are retained according to Cloudflare Analytics Engine's default retention. Because the visitor identifier rotates daily, individual users cannot be tracked across days in the analytics data.

5. Third-Party Sharing

We do not share data with third parties beyond the infrastructure providers we use to run the app:

Cloudflare — hosting, Workers, KV, Analytics Engine, Web Analytics
Yahoo Finance — receives stock symbols only (no identifying data)
Google / Microsoft — only when you sign in with their identity providers, and only for the data you explicitly grant access to via OAuth consent

6. Changes

If we materially change what data is sent to our Worker, we will update this page and the "Last Updated" date above.