RaelInfoStarter notice · Review and complete before public launch
Privacy Notice
This page describes the data behavior of the RaelInfo Node/Express website included in this package. The site operator must review it against the actual hosting configuration, legal entity, third-party services and applicable law. This template is not legal advice.
1. Calculator inputs
Calculations run in the visitor's browser. Calculator balances, income, debt amounts and other calculator inputs are not intentionally sent to RaelInfo API endpoints. When a visitor looks up a stock symbol, news topic, or SEC CIK, that query is sent to the RaelInfo server and then to the relevant public or configured data provider. Do not enter sensitive information on a shared or public device.
2. Local browser storage
RaelInfo can store calculator values and display preferences in the browser's local storage so a visitor can return to a scenario. This data is not encrypted by the application, is not synced between devices and may be accessible to anyone with access to the browser profile. The JSON export feature creates a file on the visitor's device. Visitors should protect exported files as they would other personal financial records. A clear-data control is provided in the application.
3. Public data services
The website requests indicative crypto-market data from CoinLore, daily currency reference-rate data from Frankfurter, article metadata from GDELT, and (when configured) stock data from Alpha Vantage, Financial Modeling Prep or EOD Historical Data. SEC filing metadata is requested from data.sec.gov when the operator has configured the required identifying SEC User-Agent. Those requests do not include the amounts entered in calculators. The providers and network infrastructure may process technical connection information (such as IP address, request metadata and user-agent data) under their own policies.
4. Cookies, analytics and advertising
The application does not include an analytics provider, advertising pixel, behavioral advertising cookie or marketing email platform by default. Browser local storage is used for preferences and optional calculator scenarios. Optional accounts use a username and a password hash generated with Node.js scrypt; the raw password is not stored. An HttpOnly, SameSite session cookie is used to keep a signed-in session. Session records are held in server memory and expire after the configured session period; restarting the server invalidates active sessions. If the operator later adds analytics, advertising, chat, embedded content, email marketing or other integrations, this notice must be updated and any legally required consent must be obtained.
5. Affiliate links
No affiliate offers are configured by default in this build. If the operator adds affiliate or sponsored links, the relevant placement must disclose the material connection clearly and conspicuously. Third-party destinations may use their own cookies and tracking technologies under their own privacy notices.
6. Hosting and security logs
The Node server receives requests for account authentication, stock lookups, news searches, SEC filing lookups and portfolio actions. It may log application errors and request/security metadata through the hosting provider. Passwords are stored as scrypt hashes; API keys in .env are server-side secrets and are not included in static frontend files. The hosting provider may collect technical server logs, security telemetry, IP addresses and request metadata. The operator must update this section to identify the actual host, retention practices and any additional processors used by the deployed site.
7. Retention and deletion
Calculator scenarios stored in local storage remain on the visitor's device until removed by the visitor or browser. Portfolio positions are stored on the server in data/users.json and associated with the authenticated account. This file-based store is intended for a small single-server installation and must be protected, backed up and hosted on persistent storage. Signed-in users can delete their account and stored portfolio positions from the dashboard after confirming their password. Operator support and a monitored privacy contact should also be provided for privacy requests.
8. Children
The site is intended as a general financial-information resource and is not designed to collect personal information from children. The operator should adapt this section if the intended audience or features change.
9. Operator and contact
Before launch, replace this sentence with the operator's legal name and a monitored privacy contact email/address. Also identify the applicable jurisdiction and any required privacy representative.
10. Changes
This notice should be updated whenever the site's data practices, integrations, hosting, or legal obligations change. Display the actual effective date after review.