Privacy policy

Data controller

The controller of the personal data of broksy.eu users is the owner of the Site. Contact for personal data matters: hello@broksy.eu.

The Site is designed to process as little data as possible. Browsing it requires no account and no data of any kind. An account is needed only to keep your own portfolio.

What data we process

Data you provide yourself:

• newsletter: e-mail address, chosen language, chosen topics and brokers, subscription date, confirmation date and unsubscription date;
• error report: the report text, the page address, the value or the selected part of the page it points at and, optionally, a link to evidence; we do not collect an e-mail address in a report;
• e-mail correspondence: the address and the message;
• account: e-mail address and Site language, as well as the date the account was created and of the last login; the account has no password, you log in with a link sent to that address;
• portfolios: name, goal, the brokers you keep the portfolio at, the setting for showing amounts, and the trades you enter yourself (buy or sell: instrument, number of units, date and, optionally, price and fee; cash deposit or withdrawal: amount, currency and date; currency exchange: amounts, currencies, date and, optionally, fee), together with the moment of recording set by the server; we do not connect to your broker account;
• profile: handle and photo, if you set them; of the photo we store only our own square thumbnail, without metadata such as where and when the photo was taken;
• public portfolio, only if you publish it: others see the handle, photo, the portfolio's name, goal and brokers, its composition in per cent, its result and its trade history; amounts in złoty are shown only once you turn them on yourself. We show your e-mail address and your other portfolios to no one.
• monthly portfolio summary, only if you turn it on in your profile: that setting; we send the message once a month to the account's e-mail address, about your public portfolios' results and places;

Data collected automatically:

• consent log of the newsletter and of the monthly portfolio summary: the kind of event, its date, the version of the consent text, the language and the page where consent was given;
• abuse protection: a hash (HMAC) of the IP address, without the address itself, kept at most one day for request limits; when you ask for a login link or subscribe to the newsletter, also a hash of the e-mail address, and when you use your account, its random identifier;
• login: for as long as a login link is valid (15 minutes), a hash of the link, a hash of the code and the number of attempts to type it, the e-mail address we sent them to and a hash of the cookie of the browser that asked for them; for each logged-in browser, a hash of the session identifier with the dates it was created, last used and expires, without the IP address or browser data. A session expires 30 days after it was last used;
• server logs at the hosting provider: IP address, page address, time and browser data, kept for a short period for security;
• technical error reports: the kind of error, the page address and browser data, without form contents;
• cookieless visit statistics: aggregate page view counts, with no user identifier;
• Google Analytics after your consent: a random identifier from a cookie, the pages you visit and events on the Site (for example using a calculator), where you came from, your device and browser type, and an approximate location that Google derives from your IP address without storing the address itself. Details are in the Cookie policy.

We process data about investments only if you enter it yourself into a portfolio on your account. The parameters you enter into calculators stay in your browser and in the page address, which you may share yourself. No analytics runs on account pages; only technical error reports work there.

Purposes and legal bases

• sending the newsletter: your consent (Art. 6(1)(a) RODO) given by subscribing and confirming; you can withdraw it at any time through the link in every message;
• account, login, profile and portfolios: performance of the contract for the electronic service you request by creating an account (Art. 6(1)(b) RODO);
• publishing a portfolio, handle and photo: performance of the same contract on your explicit instruction (Art. 6(1)(b) RODO); you can withdraw the publication at any time, and the portfolio, your handle and your photo then disappear from public pages; the ranking of the month already under way keeps only the result itself, without your handle or the portfolio's name;
• sending the monthly portfolio summary: your consent (Art. 6(1)(a) RODO) given in your profile; you can withdraw it in your profile or with one click on the link in every message;
• handling error reports, corrections and correspondence: the controller's legitimate interest (Art. 6(1)(f) RODO) in keeping the data correct and answering messages;
• the consent log: the legal obligation to demonstrate consent (Art. 6(1)(c) RODO in connection with Art. 7 RODO);
• security, request limits, server logs and error reports: the legitimate interest (Art. 6(1)(f) RODO) in keeping the Site working and secure;
• reserving a released handle: the legitimate interest (Art. 6(1)(f) RODO) in protecting users from impersonation;
• analytics with cookies: your consent (Art. 6(1)(a) RODO and the rules on electronic communications), which you can withdraw in the cookie settings on the Site.

We make no decisions based solely on automated processing, do not profile users and do not sell data.

Recipients of data

We entrust data to technical service providers that process it only on our instructions and under data processing agreements:

• hosting and server logs: Vercel Inc. (USA);
• newsletter, report, account and portfolio database: Supabase Inc., servers in the European Union (Frankfurt);
• sending e-mail: Resend Inc. (USA), servers in the European Union;
• technical error reports: Sentry (Functional Software Inc., USA);
• analytics after consent: Google Ireland Limited (Ireland), with possible transfer of data to Google LLC (USA);
• request limits: Upstash Inc., servers in the European Union (Frankfurt).

We pass no data to brokers or other advertisers. A broker only sees that a visit to its website came through a partner link, on the terms described in its own privacy policy.

Transfers outside the European Economic Area

Some providers are established in the USA. Data is transferred to them on the basis of a European Commission adequacy decision (including under the EU-US Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards by writing to hello@broksy.eu.

How long we keep data

• newsletter e-mail address: until you unsubscribe; after that we keep the address and the consent log for 3 years as proof that consent was given and withdrawn;
• error report: the report text stays in the history of corrections; it holds no contact details unless you type them in yourself;
• IP address hash for request limits: at most one day; e-mail address hash and account identifier for request limits: at most 2 days;
• account, profile (handle and photo) and portfolios, archived ones included: until the account is deleted; deleting the account erases them at once, and they disappear from database backups within 7 days;
• a released handle (after a change of handle or deletion of the account): the handle alone and the date its reservation ends, with no link to you, for 90 days, so that no one can pose as you;
• consent to the monthly summary and the log of its changes: until you withdraw it or delete the account, which erases them at once;
• a portfolio's row in a closed monthly ranking: its result and place stay in the ranking archive; the handle, photo, name, goal and brokers are shown beside it only while the portfolio is public; once its publication is withdrawn the row stays without them, and deleting the account erases them from the archive for good, so that others' places don't shift;
• login link: at most one day after it expires; session: at once when you log out, or at most one day after it expires;
• server logs and error reports: for a short period set by the provider;
• analytics data linked to the cookie identifier: up to 2 months; after that only aggregate statistics without identifiers remain.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

To exercise these rights, write to hello@broksy.eu. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

You can delete your account and all its data yourself in the account profile. There you can also download, as a file, everything we store about your account, profile and portfolios. Deleting the account does not unsubscribe you from the newsletter: you unsubscribe through the link in every message. You turn the monthly portfolio summary off in your profile or with the link in every message.

Providing data is voluntary. Without an e-mail address we cannot send the newsletter or keep an account.

Cookies and similar technologies

How cookies and browser storage are used, including the record of your analytics choice, is described in a separate document, the Cookie policy.

Changes to this policy

Changes to this policy are published on the Site with a new version number and date. The history of changes is at the bottom of this page. This version (1.0.0) applies from 30 September 2026. The binding version is the Polish one.