Privacy
What happens to your statement
The short version: your statement is read on your device and never uploaded. What Miw makes of it is saved to your account, so it is there on every device you sign in on. This page says exactly what that file holds, where it sits, who could read it, and how to delete it.
Your file is read on your device
The statement is parsed by JavaScript running in your browser; the CSV or workbook you drop in is never transmitted. What comes out — your transactions — is kept in this browser and copied to your account, which is the next section.
What does leave your browser, and it is not nothing
To show what your holdings are worth today, the app asks a price service for quotes. That request carries the identifier of a security — an ISIN or a ticker — and nothing else. It does not carry your name, your account number, how many shares you hold, what you paid, or anything that identifies you. It travels through a small proxy that adds no identity of its own and whose cache is keyed on market symbols only. As with any web request, your IP address is visible to the servers that answer it.
Two consequences, stated plainly. The set of securities you look up is visible to the price service. And if that matters to you, the app still works with the network switched off — you will see cost basis instead of live market value, and nothing else changes.
No analytics, and two cookies to keep you signed in
There is no analytics, no tracking pixel and no third-party script — nothing on the page is counting you. Signing in sets two cookies: a signed token that says which account you are, and a plain flag that only tells the page you are signed in, so it can show the right screen before anything has loaded. Neither carries anything else, and signing out deletes both. The demo sets none.
What your account stores
Using Miw means signing in with Google. Your account then holds one file: the same one the Export button produces — your transactions, your ticker corrections and your targets. It is stored on Cloudflare D1, encrypted at rest, and it is the only thing stored besides the email address and first name Google gives for the account (the name is only there to greet you), which is kept so a deletion or export request can be matched to it.
Said plainly: this is not end-to-end encrypted, so I hold the key and could technically read your file. I do not, and there is no analytics or profiling built on it — but "could not" would be a stronger promise than the one I am making, so I am not making it. Deleting is one button, it removes the account and the file together, and it is a real delete rather than a flag.
If you connect Trading 212 by API, the account also holds that key, encrypted, to fetch statements by itself. Create it with read permissions only: then even at worst it reaches the data, not the money. It is never shown again, and disconnecting deletes it.
Do not take my word for it
Most of this you can check in about a minute, and you should:
- Open your browser’s developer tools, go to Network, and import a statement. No request carries the file you dropped in.
- Then switch the network off. The app keeps working on what is already there.
- A few seconds later you will see one request to /api/sync. It carries the backup file — the same one Export downloads — and nothing else.
Who is behind it
Miw is built and maintained by one person, working alone. There is no company, no legal entity and no organisation behind it. That is worth knowing in both directions: nobody’s business model depends on your data, and equally there is no corporate support desk standing behind this.
Questions, or something that looks wrong: info@miwgold.com
Questions
- Is my statement stored on a server?
- No. The statement is read in your browser and never sent. What is stored is the file Miw builds from it — your transactions, corrections and targets — one per account, so your other devices can open it.
- What happens if I clear my browser data?
- Nothing is lost. Sign in again and your portfolio comes back from your account. A backup file of your own is still worth keeping, because broker exports only reach back so far.
- What about GDPR?
- I am the controller of what your account stores. You can export it (the same backup file) and delete it outright from settings, which erases the account and the file together. Questions about either go to the address above.
This describes how the app works, checked against its source. It is not a legal document, and it is not legal advice.