1. Who we are
Covalt Guard ("Guard") is operated by Covalt. Guard is provided at guard.covaltpay.com. For any privacy question or request, contact us at support@covaltpay.com.
2. Data we process
- Account data. The email address you sign up with, or the basic profile returned by Google when you choose to sign in with Google. Used to create and secure your Guard account.
- Brokerage data from eToro. Only after you explicitly authorise the connection, Guard reads your account identifier, account currency and environment, portfolio value, cash balance, open positions, unrealised profit and loss, and instrument information. Used to produce your portfolio view and risk analysis. Guard uses a read-only authorisation. It never places, changes or closes a trade and never moves funds.
- Connection credentials. The access and refresh tokens eToro issues to Guard. Used solely to read your portfolio on your behalf.
- Risk and analysis data. Portfolio snapshots, risk scores, the limits you set in your Guard Pact, risk events and alerts, and notification preferences. Used to show your history, trends and breach explanations.
- API data. If you create a Guard API key, we store a hashed form of the key, its label, and its last-used timestamp. Used to authenticate machine access to your own data.
- Billing data. If you subscribe, Stripe processes your payment. Guard stores the Stripe customer and subscription identifiers, plan and status. Guard never receives or stores your card details.
- Technical logs. Operational records such as request status codes, timestamps and correlation identifiers.
3. How your data is protected
- Brokerage tokens are encrypted before they are stored, and are never sent to your browser.
- Credentials for eToro, Stripe and email delivery are held server-side only and are never written to logs or returned in responses.
- Database access rules restrict every record to the account that owns it, so one customer cannot read another customer's data.
- Guard API keys are stored only as hashes; the full key is shown once, at creation.
- All traffic to Guard is served over HTTPS.
No service can promise perfect security. We describe the controls Guard actually implements and make no certification or formal compliance claims.
4. Processors and third parties
- eToro — source of your brokerage data, accessed only with your authorisation.
- Stripe — payment and subscription processing.
- Google — optional sign-in provider.
- Lovable Cloud — application hosting, database and authentication.
- Covalt Intelligence — supplementary market intelligence for supported instruments.
- Covalt platform (Pacts) — only when you explicitly choose to create a Covalt Pact.
We do not sell your data and do not use it for advertising.
5. Retention and deletion
We keep your data for as long as your Guard account exists, because your risk history and trends depend on it. When you disconnect eToro, Guard asks eToro to revoke the authorisation and deletes its stored tokens. When you ask us to delete your account, we delete your account data, portfolio snapshots, risk history, API keys and preferences. Records we must keep for accounting purposes, and payment records held by Stripe, remain subject to their own retention rules.
6. Your rights
You can access your data in the Guard dashboard, correct your settings at any time, disconnect your brokerage account at any time, revoke API keys, cancel your subscription, and request export or deletion of your data. To make a request, email support@covaltpay.com from your account address. Depending on where you live you may also have the right to complain to your local data protection authority.
7. Changes to this policy
If this policy changes materially, we will update the version and date shown at the top of this page and, where appropriate, notify you in the application.