My DailyEdge shows you your investments and your budget. It was built from the first line so it can't move a cent, has no passwords to steal, and keeps every account's data walled off from everyone else's.
Wallets are read by their public address and everything else is typed in or imported by you. There is no button anywhere that buys, sells or sends. We never ask for a seed phrase, a private key or a brokerage password.
You sign in with Google or with a one-time code sent to your email. My DailyEdge never creates, sees or stores a password, so there is none to leak.
Every row in the database carries its owner, and the database itself checks it on every read and write. Another account can't reach your data, even by asking for it directly.
Every connection uses HTTPS, and browsers are told never to fall back to plain HTTP. The database is encrypted at rest, and the nightly backup is encrypted with AES-256 before it is stored.
CSV, OFX and most PDF statements are read inside your browser. The file is never uploaded; only the transactions you choose to keep are saved.
When Pro payments open, card details go straight to Stripe, a PCI DSS Level 1 payment provider. They never pass through or rest on our servers.
There are no advertising cookies and no third-party analytics. The app counts how often each screen is opened, with nothing that says who opened it. Your data is never sold or shared for marketing.
Profile → Account → Delete account removes your login and every holding, trade, alert, wallet and budget row at once. Encrypted backups age out within 30 days.
For anyone who wants the details.
Your account and everything you enter are stored with Supabase, a managed Postgres database, on Amazon Web Services in the United States (us-east-1). The website and the app's server run on GoDaddy hosting in the United States. Emails go out through Resend.
Access rules live in the database, not just in the app. Each table only returns rows whose owner matches the signed-in account, and things only our server may change, such as your plan, have no write access from the app at all. Limits like the number of alerts on the Free plan are enforced there too.
The keys for market data, email and wallet lookups are kept in a server file the web server refuses to serve, and are never sent to your browser. Your browser holds only a public key that is useless without your own sign-in.
A strict content security policy means the app runs only code from its own address, so injected scripts are blocked. The app can't be framed by other sites, and HTTPS is enforced for a year on every visit (HSTS).
Prices are fetched by our server using only ticker symbols, never your name, email or amounts. Wallet balances are looked up by public address through Zerion. If you ask AI to read a photo or a hard-to-read PDF, only that statement's text or images are sent through our server to Anthropic; nothing is kept, and under Anthropic's commercial terms it isn't used to train AI.
The admin console shows account details (name, email, when you joined) and counts, such as how many holdings or alerts you have, never what you hold, what you spend or what your alerts say. Every admin action is written to an audit log. Like any online service, the database can be reached for maintenance and backups; the tools are built so nobody needs to look at your data.
Your sign-in is kept on your device so the app opens quickly and works briefly offline. Signing out clears that copy on the device, without signing you out anywhere else. Error reports from the app are deleted after 30 days.
A copy of the database is made every night, encrypted with AES-256, checked that it opens, and kept privately for 30 days, so a bad day can be undone.
If you think you've found a security issue, email admin@mydailyedge.io with "Security report" in the subject. Please don't access other people's data or disrupt the service while you look, and give us a reasonable chance to fix it before telling anyone else. We read every report and reply as quickly as we can.
