Security & Trust

This page summarizes how Stocklore stores and protects your data, and how you can manage your account and data. You can also delete your account further down this page.

This English text is a reference translation provided for your convenience. The Korean version is the official text.

1. Data Storage and Transmission

Passwords are never stored in plain text. The authentication processor (Supabase) handles them as a one-way hash (it cannot be reversed to the original value); Stocklore does not keep plain-text passwords, and not even the operator can see yours.
Encryption in transit (HTTPS): all connections are encrypted over HTTPS.
Database: your account, watchlists, portfolios, and similar data are stored on Supabase (USA). See the Privacy Policy for details on cross-border transfer and processing.

2. Your Data Is Yours by Default

Data you save — watchlists, filter presets, tags, portfolio holdings, and stock notes — is designed to be viewable and editable only from your own account. Access is restricted per account through Row Level Security (RLS) at the database level together with server-side authorization checks, and portfolios and watchlists are private by default (we do not offer sharing or public-profile features).

3. Account and Infrastructure Security

Automated sign-up protection: Sign-up and sign-in requests are handled through our server, with rate limiting and Cloudflare security rules applied.
API key isolation: API keys for external data providers are used only on the server and are never exposed to the browser.
Server-side authorization: admin and paid privileges are verified on the server, not merely by what the UI shows.
Access control (Cloudflare): abnormal bulk requests and known scanners are blocked. Routing through Cloudflare also keeps the origin server address out of view.
Alert email safety: alert and digest emails are sent only from [email protected] and never ask for your password or payment details. If an email does, it is not from us — please report it to [email protected].

4. Reporting a Vulnerability

If you find a security vulnerability, please report it to [email protected]. The standard disclosure policy is available at /.well-known/security.txt. We will review what you send and get back to you, and we will not hold a good-faith report against you.

5. Controlling Your Data and Account

Edit or delete directly: watchlists, tags, filters, portfolios, and notes can be edited or deleted at any time within the Service.
Access and correction: for how to exercise rights such as access, correction, and suspension of processing, see the Privacy Policy.

6. Change Log

You can review improvements and changes to the Service on the Changelog page.

This page summarizes the security measures the Service actually applies; no system can guarantee 100% safety. If you used a shared device, the sign-out item in the account menu on the left ends the session.