Effective 30 September 2026

Privacy Policy

This policy explains what personal information ETFtracker collects, why, who it is shared with and how you can control it. Questions or requests: mark@foundrylabs.com.au.

About this policy

ETFtracker is an Australian ETF research and analytics service operated by Foundry Labs (ABN 50 659 216 903) (“we”, “us”). This policy covers our website (etftracker.com.au), the ETFtracker app, the emails we send and the tools we provide for use inside ChatGPT.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), to the extent they apply to us. You can use the public parts of the site without an account. Some features (saved portfolios, watchlists, screens, full research) need one.

Information we collect

We collect only what we need to run the service. The table shows each type, what it includes and when we collect it.

Type	What it includes	When we collect it
Account details	Your email address, how you sign in (email and password, or Google), and when you signed up and last signed in. Your password is held only as a secure hash by our authentication provider; we cannot read it. If you sign in with Google, Google gives us your email address and basic profile details, which can include your name and picture.	When you create an account or sign in.
Profile (optional)	A display name, short bio, avatar, investor type and experience level.	Only if you choose to add them.
Your saved work	Portfolios and the ETFs and allocation percentages you enter, watchlists, saved screens, display and table preferences, and your email preferences.	When you use those features.
Email updates and consent	Whether you have chosen to receive our monthly market update, when and how you agreed (for example by ticking the box at sign-up), and when you last unsubscribed.	When you sign up, switch updates on in your profile, or unsubscribe.
Support messages	Your email address and name as they appear in your message, what you write, and any attachments you send.	When you contact us.
Usage analytics	Pages and features you use, when and for how long, the page that referred you, your browser and device type, which videos you watch, and a random session identifier kept in your browser. When you are signed in this is linked to your account; visitors who are not signed in are identified only by the session identifier.	Automatically as you use the website and app.
Sign-up security records	Your email address, IP address, browser details and the result of each sign-up attempt (for example accepted, blocked or rate limited). Used to detect spam and abuse. At this step your browser asks a third-party service (ipify) for its public IP address.	When you attempt to create an account.
Technical logs	IP address, requests made and error information, kept by our hosting and database providers.	Automatically.
Email delivery data	Whether an email was delivered, bounced or marked as spam and, where our email provider has it switched on, whether it was opened or a link was clicked.	When we email you.
ChatGPT tool requests	The inputs sent to our tools (for example a fund ticker or a search phrase) and the data we return. See the ChatGPT section.	When ChatGPT calls our tools.

We do not currently take payments, so we do not collect card or bank details. We do not ask for government identifiers. We do not use advertising trackers.

ETFtracker in ChatGPT

You can use ETFtracker from ChatGPT through tools we provide. When ChatGPT calls one of them, ETFtrackerreceives the tool inputs (for example a ticker or search phrase) and returns the requested data to ChatGPT.

No account is needed for the public tools. We do not link these requests to an ETFtracker account. Requests can still appear in our and our providers’ server logs (for example the time, the address of the requesting service and the input).
Portfolio access in ChatGPT is not yet enabled. ChatGPT cannot currently read or change your saved portfolios. If we add it, it will only work after you sign in and approve it, and we will update this policy first.
How the tools run. They run as a separate service hosted on Vercel that looks up our public fund data in Supabase. The service does not call any OpenAI model, and it does not itself save the inputs it receives.
OpenAI runs ChatGPT, not us. How your conversations are handled is governed by OpenAI’s own terms and privacy policy. We only see what ChatGPT sends to our tools.

How we use information

To provide the features you use: dashboards, saved portfolios, watchlists, screens, research and the ChatGPT tools.
To create and secure your account and to sign you in.
To send service emails (such as account confirmation and password reset) and, if you have chosen to receive them, our monthly market update and research notes. A new account is not subscribed unless you tick the box when you sign up or switch updates on in your profile. You can unsubscribe at any time from any email or from your profile.
To respond to support requests and to investigate and correct data errors you report.
To keep the service secure and to prevent spam, fraud and abuse.
To understand how the service is used and to improve it.
To meet legal obligations.

We do not sell personal information, and we do not use it for advertising.

Who we share it with

We use the providers below to run the service. They receive only what they need for their role. Some are overseas (see the next section).

Provider	What it does for us	What it receives
Supabase	Database, sign-in (authentication) and the backend functions that power the app.	Account, profile, saved-work, usage and sign-up security records, and support-related records we store.
Vercel	Hosts and delivers the website.	Request data such as your IP address, browser and the pages you request, which it keeps in server logs.
OpenAI	Writes the plain-English chart explanations inside the app, and operates ChatGPT if you use our ChatGPT tools.	For chart explanations: the chart type, its data points and filters, generated from our backend. Not your name, email or portfolios. For ChatGPT: see the ChatGPT section.
Perplexity	A search service we use to compile our weekly ETF news digest.	A general query about ETF news for a date range. No personal information.
Resend	Sends our emails.	Your email address, the message content and delivery events.
Google	Sign in with Google, if you choose it. Also delivers the fonts used on our pages.	For sign-in: the details needed to sign you in. For fonts: your browser contacts Google when a page loads, which shares your IP address with Google.
ipify	Tells your browser its public IP address at sign-up.	Your browser contacts ipify directly, so ipify sees your IP address.

Our people. Authorised administrators can view account and usage information (such as sign-up details, saved portfolios and activity) to give support, keep the service secure and improve it.

Legal and safety. We may disclose information where the law requires it or to protect people or our rights. If the business is ever sold or restructured, personal information may be transferred to the new owner, who must handle it under terms no less protective than this policy.

Overseas processing

Most of the providers above are based in, or process data in, the United States and other countries outside Australia. We cannot promise where your information is stored or processed at any moment, and we do not claim it stays in Australia. We take reasonable steps to make sure providers handle personal information in a way that is consistent with the Australian Privacy Principles.

Cookies and browser storage

We do not use advertising or cross-site tracking cookies. We use your browser’s local storage to keep you signed in, remember your theme, layout, watchlist and saved screens, remember whether you have seen the product tour, and hold the random session identifier used for analytics. Clearing your browser storage removes these; you will be signed out and your local preferences will reset.

How long we keep it

We keep personal information only while we need it for the purposes above. When we no longer need it, we delete it or remove the details that identify you.

Information	How long
Account and profile	While your account is open. If you ask us to delete it, we will respond within 30 days, tell you what will be deleted and anything we must keep, and aim to complete the deletion within 30 days of confirming it is you.
Portfolios, watchlists, saved screens and preferences	While your account is open, and removed when your account is deleted.
Email updates (your subscription, preferences and consent record)	While your account is open. We keep your preference, including if you unsubscribe, so we do not email you again by mistake, along with a record of when and how you subscribed.
Usage analytics (page views, feature events, report and video views)	Linked to your account or browser for up to 24 months. After that we remove the identifiers (your account, browser session and browser details) and keep the rest, such as which page was viewed and when, as anonymous statistics. If you delete your account, we also remove the analytics records linked to it.
Sign-up security records (email and IP address)	Kept for 90 days, or longer if needed for an active investigation. After that we remove the email and IP address and keep only whether the attempt succeeded and when, as anonymous statistics.
Rate-limit records (IP address)	About 7 days after your last attempt, then deleted.
Email delivery records	The recipient address is kept for up to 24 months, then removed. We keep the delivery counts.
Support messages	12 months after we resolve your request, then deleted.
Accounts that never confirm their email address	We do not delete these automatically yet. We delete them if you ask.
Server logs	Kept by our hosting and database providers for the periods set on our plans with them.
Backups	Information you ask us to delete can remain in our providers’ backups until those backups expire under the retention set on our plans.
ChatGPT tool requests	We do not store them. They can appear in the server logs described above.

Where we say we remove identifiers, a scheduled job does it every day. Anonymous statistics are kept longer because they no longer identify anyone. If you would like to know more about how long we hold specific information about you, ask us at mark@foundrylabs.com.au.

Your choices and rights

Access and correction. Ask for a copy of the personal information we hold about you, or for it to be corrected. We will respond within 30 days.
Deletion. Ask us to delete your account and the information linked to it. To protect you, we may ask you to write from the email address on the account. We will respond within 30 days and explain what will be deleted, anything we must keep and the expected timeframe.
Emails. Every digest and research email has an unsubscribe link, and you can change your email preferences in your profile.
Analytics and storage. You can clear your browser storage at any time. To remove analytics records linked to you, contact us.

Make requests by emailing mark@foundrylabs.com.au. There is more on the Support page.

Security

We use encrypted connections (HTTPS), database access rules that limit each person’s saved data to their own account, and limited administrator access. No online service is perfectly secure. If a data breach is likely to cause serious harm, we will notify the people affected and the OAIC as the law requires.

Children

ETFtracker is for adults. It is not directed at anyone under 18, and we do not knowingly collect their personal information. If you think a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy. The effective date at the top shows when it last changed. For material changes we will tell you by email or with a notice in the app.

Contact and complaints

Email mark@foundrylabs.com.au with any privacy question, request or complaint. For a complaint, please describe what happened; we will investigate and reply within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).