Privacy Notice

Updated 14 October 2026. Data controller: Roman Hauk / Haukro. Contact: Haukro on eToro.

eToro sign-in and session

eToro sign-in is required to use the application and its data APIs. The app requests openid/profile for identity verification only. It does not request permission to read your trading account, execute trades or move money. Your eToro password and two-factor codes are entered only on eToro's website.

The server verifies eToro's identity token. It stores only the verified pseudonymous subject identifier and session creation/expiry timestamps, encrypted in a separate private Vercel Blob store. OAuth access and refresh tokens are not retained; the server attempts to revoke them after verification. The browser receives a random signed session reference in a Secure, HttpOnly, SameSite=Lax cookie, not an eToro token. A separate encrypted login-transaction cookie expires after ten minutes.

A session expires after twelve hours. Signing out deletes the server session and clears its cookies; this does not sign you out of eToro or other Haukro apps. Expired records are removed by the twice-daily cleanup job while scheduled processing is operational. Signing out with JavaScript enabled also removes locally stored Thesis Watch portfolio data, keeping only your language preference.

Portfolio processing

When you paste or import a broker portfolio, the file is parsed in the browser. The app stores the analysed position list, including instruments, quantities, values, weights and cost data where supplied, in browser localStorage until you sign out or clear site data. Its symbol-resolution API receives instrument identifiers including raw symbols, ISINs and instrument names to match securities. Quantity, value, weight and cost are not part of that resolution request. For matched symbols, additional news and financial requests send those symbols and relevant search keywords to server endpoints. Where available, the optional public eToro username lookup sends the entered name to a server endpoint; it is separate from authentication and does not read your private trading account.

Service providers and retention

Vercel hosts the site, functions and private session storage, and may process technical access logs for security and delivery. Financial and news information is retrieved from third-party providers through service APIs. Google Fonts and spreadsheet support libraries may be requested from third-party CDNs, which can receive technical request metadata. Provider logs are retained under their own policies. No new advertising or user-tracking analytics is added by this sign-in integration.

Your choices

Local processing and authenticated API access provide the service you request. Essential login cookies protect access and prevent login forgery. You can clear this website's stored data in your browser and contact the operator to request information, correction or erasure of server-held personal data. Do not import portfolios you are not authorized to analyse.

Slovensky: Appka vyžaduje prihlásenie cez eToro iba na overenie identity. Heslo ani oprávnenie obchodovať nezískava. Na serveri uchováva šifrovaný identifikátor používateľa a čas platnosti relácie, nie importované portfólio. Portfólio sa spracúva v prehliadači; symboly a vyhľadávacie údaje sa odosielajú na získanie správ a finančných údajov. Odhlásenie zruší reláciu na serveri. Pri zapnutom JavaScripte odstráni aj lokálne údaje portfólia. Kontakt: Haukro na eToro.