Your journal stays in this browser.

Where your records live

Holdings, balances, checkpoint history, custom categories, and your journal currency are saved in this browser’s local database. Your theme and public currency preference use browser storage too.

For new visitors, a currency is suggested from the region in the browser’s language settings. This does not read your operating system’s currency setting or request your location. A suggestion does not change an existing journal’s currency or convert amounts.

There is no account or automatic cloud backup. Another browser, browser profile, or device has a separate journal. Exitmargin does not upload your financial records or backup files to a server.

Keep a backup you control

Clearing this site’s browser data removes your local journal and preferences. Private-window records can disappear when that session ends. Browser storage can also be removed by the browser, or become unavailable if you lose the device.

Exitmargin cannot recover records that are no longer stored in your browser. Export backups regularly. To move your journal to another browser or device, export a file here and import it there.

Local does not mean encrypted

Exitmargin does not encrypt the journal database or exported backup files. Someone who can use this browser profile may be able to open your journal.

Backups contain readable financial data. Keep them somewhere you trust. Clearing browser data does not delete backup files you have downloaded or shared.

Hosting and anonymous analytics

Cloudflare hosts Exitmargin. When you load the site, Cloudflare receives technical request information, including your IP address, to serve the app.

We use Cloudflare’s server-side traffic reports to understand traffic trends and demand for public pages and downloads. These reports come from hosting requests, without adding a browser tracking script. Cloudflare’s dashboard can include IP addresses and requested URLs. A public-page report filter does not prevent Cloudflare from processing requests to journal pages.

We also use Google Search Console reports about how our public pages appear in Google Search, including search clicks and impressions. This does not add Google Analytics or a Google tracking script to Exitmargin.

When enabled on the production site, PostHog measures anonymous page visits and selected actions, such as opening the journal, calculating a result, saving a checkpoint, adding a holding, or exporting a backup. Public-page events can include a fixed referral-source label, approved campaign labels, and general browser, operating-system, and device categories. Unknown campaign values and full referrer URLs are discarded. This helps us understand usage and improve Exitmargin.

Financial content is excluded from analytics. We do not send holdings or liability names, financial or portfolio values, institution or account names, journal entries, notes, goals, backup contents, imported files, or personal contact details to PostHog. Private page names use fixed route labels. Local record IDs, URL fragments, and private query parameters are removed. We do not capture form contents or page text.

PostHog runs in cookieless mode. It does not retain analytics cookies or entries in localStorage or sessionStorage. Its SDK briefly writes fixed storage-test values and removes them; these do not contain financial content or visitor identifiers. PostHog receives the connection’s IP address and the browser user agent in the request header and event payload. It uses these for a server-side hash with a daily salt, then removes the IP address and raw user agent before storing the event. This can group visits within a day, but does not provide a reliable history of returning people across days or devices. We do not add our own device fingerprint or create personal profiles. Do Not Track and Global Privacy Control signals disable our browser analytics.

Session replay is disabled everywhere, including public pages and the financial application. We use no advertising analytics, Google Analytics, automatic DOM capture, or remote error reporting. Cloudflare Web Analytics is disabled because its browser beacon cannot safely filter private SPA metadata. Cloudflare’s separate request reports provide aggregate traffic and bot visibility.

Our own traffic summaries are kept for up to 12 months. Provider retention is separate; this limit does not set Cloudflare’s, PostHog’s, or Google’s retention periods. Read PostHog’s privacy policy for its processing details. Contact us if you have questions about analytics or your rights.

Cloudflare Network Error Logging (NEL) is disabled for this domain. New responses do not ask browsers to send Cloudflare network-error reports through NEL or Report-To headers. This is a hosting setting, separate from the application’s Content Security Policy. Browsers that cached an earlier reporting policy may retain it until it expires.

A hosting request still includes its path and query. New holding-detail links put the local ID after the # character, in a URL fragment that browsers do not send with the document request. Older links with an ID in the path still work and send that ID to the host when opened or reloaded. Fragments can remain in browser history or copied links; they are not encryption. Do not put financial values, account numbers, or other personal information in URLs. Outgoing links use a no-referrer policy so they do not disclose your journal URL.

Read Cloudflare’s privacy policy for details about its hosting services.

Contact and support

Email support@exitmargin.com for questions about Exitmargin or your data. If you contact support, we receive your email address and any message or attachments you choose to send. We use these to answer your request.

Support messages are processed by the email services used to send and receive them. They are separate from your locally stored journal. Do not send financial backups. Hide financial details in screenshots.