Privacy Policy

MarketMitra runs two different ways — hosted (our deployment) and self-hosted (your own deployment, on your own infrastructure) — and what happens to your data is genuinely different between them. This policy describes both separately rather than blurring them into one generic statement.

1. If you use the hosted version (marketmitra-v2.vercel.app)

This section applies only when you use MarketMitra's own hosted deployment. It does not apply to anyone running their own self-hosted instance — see §2.

Account and authentication. Sign-in is handled by Clerk, a third-party identity provider. Clerk processes your email address and authentication credentials under its own privacy policy; we never see or store your password. Clerk sets a session cookie required for you to stay signed in — this is strictly necessary for the service to function and isn't an optional/marketing cookie.

Portfolio and app data. Holdings, alerts, notes, saved chat history, and your AI provider settings are stored in our MongoDB Atlas database, associated with your account. Your AI provider API key is encrypted at rest (AES-256-GCM) before storage and decrypted only server-side, only to make the request you asked for.

AI features (bring-your-own-key). When you use an AI insight, the Mitra chat, research briefs, or multi-agent analysis, the relevant prompt — which may include your portfolio holdings, a stock symbol, or your chat message — is sent to the AI provider you configured (Google Gemini, Anthropic, or OpenRouter) using your own API key. That provider processes the request under its own privacy policy; MarketMitra does not operate or see traffic through any AI model itself. If you don't add a key, these features simply aren't available to you — nothing is sent anywhere.

Market data. Public market data (quotes, fundamentals, news, IPOs) is served by our fundamentals-api service and free upstream data sources — this is public financial information, not personal data about you.

Email and webhooks. If you set up alert notifications, the alert content may be sent via Resend (email) or to a webhook URL you provide (e.g. a Telegram/Discord/Slack incoming webhook) — only to destinations you configure.

Analytics. The hosted deployment uses Vercel Web Analytics, which is cookieless — it does not use tracking cookies or any identifier that can single you out across sites, and only aggregated, anonymised page-view data is collected. See Vercel's Web Analytics privacy documentation for detail.

Performance monitoring. The hosted deployment also uses Vercel Speed Insights to measure page load performance (Core Web Vitals). Like the analytics above, it cannot reconstruct your browsing session or identify you — it records route, approximate device/network type, country, and page-speed metrics, with no cookie and no cross-site identifier. See Vercel's Speed Insights privacy documentation for detail.

Rate limiting. Requests are keyed transiently (by account or IP) against an Upstash Redis store purely to enforce fair-use limits; this isn't used for tracking and expires on its own short window.

Data retention and deletion. Your data is retained while your account exists. To request deletion of your account and associated data, contact us via the channel in §5.

2. If you self-host MarketMitra

MarketMitra is open-source (MIT licensed) specifically so you can run your own instance. In self-hosted mode:

• There is no sign-in and no MarketMitra account — the app runs as a single local user.
• Your portfolio, holdings, alerts, and notes are stored in a MongoDB database youprovide and control — not one operated by us. We have no access to it.
• If you configure an AI provider key, prompts go directly from your own deployment to the AI provider you chose, using your own key — never through MarketMitra's infrastructure.
• Market data is fetched from the fundamentals-api service you point your deployment at — by default this may be our hosted instance of that service (which serves only public market data, not your personal data) unless you also self-host that service yourself.
• No analytics or tracking is included in self-hosted mode by default, and none should be added without your own explicit configuration — this is a deliberate design choice, not an oversight.

In short: for a self-hosted instance, MarketMitra (the project maintainers) receive no data about you or your usage at all, beyond the public GitHub repository traffic anyone running any open-source project can see.

3. What we never do

• We never sell personal data.
• We never use your portfolio data, notes, or chat history to train any model.
• We never invent or infer investment advice from your data — see our guardrail on every AI-generated response.

4. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. For the hosted version, contact us (§5) to exercise these. For self-hosted instances, you already have direct control over your own database.

5. Contact

For privacy questions or data-deletion requests regarding the hosted deployment, open an issue on our GitHub repository marked confidential, or use GitHub's private security advisory form linked from our security policy.

6. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected here with an updated date at the top of this page.