Privacy Policy

Last updated: 13 June 2026

Who we are

Tsang Portal (tsang.org.uk) is a private household wealth dashboard operated as an independent project in the United Kingdom. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the operator of Tsang Portal is the data controller for the personal data described in this policy. You can reach us at hello@tsang.org.uk for any privacy question or request.

The short version

• We never connect to your bank. There is no open-banking link, and we never ask for, see, or store banking credentials.
• You choose what the portal knows. Every financial figure in your account was entered or imported by you.
• We don't sell data, run advertising, or profile you. Your data is used to show you your own dashboard — nothing else.
• You can leave cleanly. Export your data to CSV at any time, and ask us to delete your account whenever you want.

What we collect

We collect only what the service needs to work:

• Account data: your email address and a password (stored as a secure hash by our authentication provider — we never see your password).
• Financial data you enter: balances, transactions, investments, liabilities, goals and related notes that you type in or import. We never gather this from third parties.
• Settings: preferences such as your base currency and sharing choices.
• Basic technical data: standard server logs (such as IP address and browser type) kept by our hosting providers for security and reliability.

We do not use third-party advertising or analytics trackers on the portal.

Why we process it (lawful basis)

• Contract: we process your account and financial data to provide the service you signed up for — your dashboard.
• Legitimate interests: we process technical logs to keep the service secure and reliable.
• Consent: sharing with family members happens only when you explicitly opt in, and you can withdraw that sharing at any time.

Where your data lives

Your data is stored in a managed PostgreSQL database provided by Supabase, and the website is served by Vercel. Both act as our data processors. Data is encrypted in transit (HTTPS/TLS) and at rest, and every user table is protected by row-level security so your records are isolated to your account. See the security overview for the full picture.

Who can see your data

Only you, unless you explicitly share specific items with members of a Family Space you join. Sharing is opt-in, granular and revocable. We do not sell or share your data with advertisers or data brokers. Operational access to production systems is limited to the operator and used only to run and support the service.

How long we keep it

Your data is kept while your account is active so your history and charts keep working. If you ask us to delete your account, we remove your personal and financial data from the production database, after which it leaves provider backups as those rotate.

Your rights

Under UK GDPR you have the right to access, correct, export (data portability), restrict and delete your personal data, and the right to object to processing. In practice:

• Export: you can download your transactions and investments as CSV from inside the app at any time.
• Correction: you can edit or remove any figure you've entered, at any time.
• Deletion: email hello@tsang.org.uk and we will delete your account and data.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Cookies and local storage

We don't use advertising or tracking cookies. The portal uses your browser's local storage to keep you signed in between visits and to remember preferences. Signing out clears your session.

Changes to this policy

If we change this policy, we'll update this page and the date at the top. Material changes will be highlighted on the site or by email.

Contact

Questions, requests or concerns: hello@tsang.org.uk.