Privacy Policy

Walnut helps you organise your investments around themes you believe in. To do that, we store the baskets you create, the broker connections you authorise, and the holdings your broker reports back to us. We do not see or store your broker credentials, and we never sell your data. This page explains the details.

• Account information. When you sign up we store your email address and a hashed password (the plaintext password never reaches our servers; authentication runs through Supabase).
• Baskets you create. Names, theses, target weights, and notes you write.
• Broker connections and holdings. When you link a brokerage account through SnapTrade, we store the SnapTrade-issued connection identifier and the positions, balances, and order history your broker reports. We do not store your broker username, password, or multi-factor codes, SnapTrade handles authentication on its side and only returns read or trade-permission tokens.
• Orders you place through Walnut. When you confirm an Invest dialog, we record the order request, the response from your broker, and any fills, so the basket can attribute the position correctly.
• API keys for the Walnut MCP connector. When you generate a key, we store a SHA-256 hash of it; the plaintext key is shown to you only once and is never written to our database.
• Usage data. Standard request logs (IP, user agent, route, timestamp) for debugging and abuse prevention, held by our hosting provider for a short retention window.

• Brokerage credentials, account passwords, or two-factor codes.
• Social Security numbers, government IDs, or other tax-related identifiers.
• Payment information (we don't charge for the service today).
• Behavioural advertising profiles, we do not run ad pixels.

We use the information we collect strictly to operate the service:

• Render your baskets, drift, and rebalance views.
• Pull updated holdings and balances from your linked brokerage(s).
• Place the orders you confirm in the Invest dialog at your broker.
• Let Claude Desktop answer questions about your portfolio when you opt in to the MCP connector.
• Send transactional emails related to your account (sign-in, password reset).
• Detect and prevent abuse of the service.

To keep the service simple and operable by a small team, Walnut depends on the following third parties. Each receives only the data needed to do its job.

• Supabase, hosts our Postgres database and authentication service. Stores your account, baskets, positions, and broker-connection metadata.
• SnapTrade, the broker integration layer. Authenticates with your broker on your behalf and exchanges holdings + order requests with us.
• Vercel, hosts the Walnut web application and serves request logs.
• Yahoo Finance, public price data. We send only ticker symbols, not any identifying information about you.
• Anthropic / Claude, only when you choose to connect Claude Desktop to your account via the MCP connector. Tool calls flow through our API; we do not forward your data to Anthropic.

We set a single authentication cookie (issued by Supabase) so you stay signed in across page loads. We do not use analytics or advertising cookies. The cookie is HttpOnly, Secure, and SameSite=Lax.

• Access. You can view everything we store about you inside the Walnut app itself.
• Export. Email us and we will send you a JSON export within 30 days.
• Deletion. Email us to request account deletion. We remove your baskets, positions, connections, API keys, and authentication record. Some logs may persist briefly for fraud-prevention purposes before being purged.
• Correction. Update your profile inside the app or email us.
• EU / UK residents (GDPR) have the additional rights to data portability, restriction of processing, and lodging a complaint with a supervisory authority.
• California residents (CCPA / CPRA) have the right to know what we collect, to delete it, to correct it, and to opt out of any sale of personal information (we don't sell any).

We retain your account data for as long as your account is active. After deletion, we purge your records within 30 days, except where law requires longer retention. Data in transit is encrypted with TLS; data at rest is encrypted by our hosting provider. Service-role credentials are never exposed to the browser; row-level security in Postgres prevents one user from reading another's data even at the database layer.

Walnut is intended for users 18 years or older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

We may revise this policy as the service evolves. The “Last updated” date at the top will reflect the most recent change. Material changes will be announced inside the app before they take effect.

Questions about this policy, or want to exercise a right above? Use the contact form or email hello@walnutinvest.com.