Privacy
PortfolioInvestiQ is in build. Nobody can create an account yet, so there are no portfolios, no transactions and no payment details to write about. This is the short version of what the site does with the little it does collect.
The waiting list
If you leave an address on the waiting list, it is sent to us by email and it is not written to a database. There is no list to export and no list to leak; there is an inbox. It is used once, to tell you the product is open, and it is not sent to anyone else, sold, or added to any other mailing.
The contact form
The contact form sends us the name, address and message you type into it, so that somebody can reply. Same inbox, same treatment.
What the servers record
Serving a page writes an ordinary request log — the address the request came from, the page asked for, the time, and what the browser said it was. That is how the hosting works rather than something switched on, and it is what tells us whether anybody visited at all. If a page fails in your browser, the error and where it happened are reported so it can be fixed; those reports are configured to carry no form contents, no request bodies and no cookies.
Cookies, and the choice you get
There are two kinds of storage here and only one of them is your decision. Signing in and remembering whether you picked the light or dark theme need storage on your device, and those are always on — without them the site cannot do the thing you asked it to. Analytics is the optional kind: it is off until you say yes, the banner is where you say it, and the Cookie settings control at the bottom of any page is where you change your mind later. Saying no leaves the site working exactly as it does now.
No advertising, and nothing that follows you to another site. This is everything that can be stored, generated from the same list the banner itself reads:
Always on, because the site cannot work without them:
| Name | Type | Set by | Purpose | Kept for |
|---|---|---|---|---|
| sb-<project>-auth-token | Cookie | PortfolioInvestiQ | Keeps you signed in. Without it every page load would ask you to log in again. | Until you sign out, or the session expires. |
| sb-<project>-auth-token-code-verifier | Cookie | PortfolioInvestiQ | Holds one half of the sign-up and password-reset link check, so a link only completes in the browser that started the request. | Deleted as soon as the link is used. |
| theme | Local storage | PortfolioInvestiQ | Remembers whether you chose the dark or light theme. Set only when you use the theme control. | Until you clear your browser storage. |
| piq-consent | Local storage | PortfolioInvestiQ | Records your answer to the cookie banner, so you are not asked again. Not set until there is something to ask about. | 12 months from the date you answered. |
Stored only if you agree, and deleted from your browser if you withdraw. Nothing below is set until you say yes:
Analytics
Counts page views, so we can see how many people find the site and which pages they read.
| Name | Type | Set by | Purpose | Kept for |
|---|---|---|---|---|
| _ga | Cookie | Google (Google Analytics) | Tells one browser apart from another, so two visits from you are not counted as two different people. | Two years from your most recent visit. |
| _ga_DHFNL17T9S | Cookie | Google (Google Analytics) | Holds one visit together, so several pages read one after another count as a single session rather than several. | Two years from your most recent visit. |
Counting visits
Two separate things count visits on this site, and they behave differently enough to be worth separating.
The first arrives with the hosting and is deliberately the cookieless kind: no cookie is set, nothing is written to your browser, and no identifier is kept that would let anyone recognise you on a second visit or follow you anywhere else. What it produces is totals — how many people came and which pages they read — not a profile of you. Because it stores nothing on your device, it asks for nothing.
The second is Google Analytics, and it behaves differently before and after you answer the banner. Until you agree, it counts the visit without storing anything: no cookie is set, no identifier is kept, and it cannot tell that you have been here before. Your browser does tell Google which page was read, along with the usual things every web request carries such as an IP address, and we rely on our own interest in knowing whether the site reaches anyone to do that much.
If you do agree, it starts setting the two cookies in the table above, which is what lets separate pages be recognised as one visit. Either way it counts page views and nothing else — the additional measurement Google offers, which watches scrolling, downloads, form interactions and site searches, is switched off here. If you change your mind, those cookies are deleted from your browser and it goes back to storing nothing. The site is new, and this is how we find out whether anybody arrives.
Who else handles it
The site is hosted, the mail is delivered, the error reports are collected and — if you agree to it — the visits are counted by third parties acting for us, under contracts that stop them using any of it for their own purposes. Most of them are the same companies whether or not you are on the waiting list: hosting sees every request, and only the mail provider sees an address. The analytics provider is the exception, because it is the only one you can switch off, and the only one that is not used at all until you do agree.
How long, and how to be removed
Waiting-list addresses are kept until the product opens and are deleted once everyone has been told. Request logs turn over on the hosting provider’s own schedule, in weeks rather than years. Ask through the contact form to be taken off the list, to have a message deleted, or to be told what is held about you, and it will be done.
Changes
This page changes when what the site does changes — which it will, because accounts, imports and payments all collect things this version has no reason to mention. A fuller notice arrives with them.
Last updated 24 August 2026.