Vedutafree stock forecasts Use in browser Download

Last updated 10 November 2026

Privacy

This page covers the Veduta desktop app (Mac and Windows), the two web apps (Veduta for the web at getveduta.com/web, for computers, and Veduta Lite at getveduta.com/app, for iPad and phones) and this website: what is processed, why, on what legal basis, for how long, and who else receives it.

Who is responsible

Veduta is run by Jaden. Veduta is a free, non-commercial project; nothing is sold and there is no advertising.

For anything on this page, including the requests under your rights: Write to whoisgetlost@gmail.com.

The short version

What is processed, and why

Page visits on this website

What
For each day and page (this site's pages, the opening page of each web app, and the page a phone gets when it asks for the download), a counter: how many times it was opened, the name of the site that linked to it (for example google or reddit), the kind of device (Mac, Windows, phone, Linux, other) and whether the request looked like a person, an automated program or the owner. These are read from what your browser sends with the request, which is then dropped. No IP address, cookie id or fingerprint is stored, and nothing tells one visitor from another.
Why
To know whether the site is used and how people find it.
Legal basis
Legitimate interest (GDPR Art. 6(1)(f)). The counts are not personal data.
Kept
As daily counts, for as long as the site runs.
Who else
Railway, the host.

Downloads

What
Each download from this site is stored as a row: the date and time, the version, the name of the site that linked to it (if any), whether it was a person, an automated program, the owner or the app updating itself, and the kind of computer. No address.
Why
To count how many people download each version, apart from bots and updates.
Legal basis
Legitimate interest. No personal data is stored.
Kept
For as long as the site runs.
Who else
The file itself comes from GitHub Releases, which sees that request under GitHub's own privacy statement.

The app's update check

What
About 12 seconds after the desktop app opens, and then every six hours while it is open, every copy asks this site for the newest version; any announcement comes back with the answer. The request carries the version you run, which build suits the computer (it says Windows, or Intel on an Intel Mac; an Apple silicon Mac says neither) and three yes-or-no marks: whether it is the copy's first check of the day, whether it is its first check ever, and (from version 3.0.6) whether it is the first check since the copy first opened a stock, which is sent once. No id of any kind, and no system version. The site adds these into counts per day and version, and per day and kind of computer (Apple silicon Mac, Intel Mac or Windows): checks, copies open that day, first launches, and copies that opened a stock. When the app then downloads an update, that is counted as a download, as above, and the file comes from the address the check gave (GitHub Releases).
Why
To offer updates, and to know how many copies are in use and how quickly a release reaches them.
Legal basis
Performance of the service you use (offering updates) and legitimate interest (the counts, which are not personal data). Settings can stop the app from downloading updates on its own.
Kept
As daily counts, for as long as the site runs.
Who else
Railway, the host.

Usage statistics (desktop app, off unless you say yes)

What
Sent with the update check, only while the switch is on: a random install number made on your computer, which is not linked to your name, email or address; the app's version; the operating system's name and major version only (for example macOS 15 or Windows 11); and for each time the app was open, when it started (in UTC, to the minute), how long it lasted in seconds and the seconds spent on each kind of page (Summary, Portfolio and so on, never what a page showed). Never symbols, holdings, prices, notes, keys or anything you typed. A session is stored once: if the same report arrives twice, the copy is dropped, so two sessions that started in the same minute and lasted exactly as long would count as one.
Why
To see which parts of the app are used, and for how long, so the right things get improved.
Legal basis
Your consent (GDPR Art. 6(1)(a)), given when the app first asks or by switching it on in Settings. Switching it off withdraws it: sending stops at once and anything counted but not yet sent is thrown away.
Kept
Each session is deleted automatically 13 months after it started, and an install number 13 months after it was last seen. To have it deleted sooner, write with your install number, which Settings shows.
Who else
Railway, the host.

Error reports, setup steps and speed timings (desktop app, each off unless you say yes)

When the desktop app first opens, it asks whether it may send each of these, and usage statistics above. Each has its own switch, all start off, and saying no to all of them takes one click, the same as saying yes. The app asks again only when a new version would send something it did not send before, and then only about what changed. Settings > Privacy shows each switch and can change it at any time, and shows your install number even after you switch everything off, so you can still ask for what was sent to be deleted.

What
With the same random install number as usage statistics, the app's version and the operating system's name and major version: error reports, for something that failed: when (in UTC, to the minute), what kind of thing it was (for example prices, a forecast, the update check, or the app closing without warning, which is reported the next time it opens), which kind of page it happened on, a short code (the name of the error, or a status number such as 429) and the names of the app's own functions involved with their line numbers. Never the error's message text, a file or folder path, a symbol, a price, a key or anything you typed. A copy with error reports on also says once a day that it is sharing them, even with nothing to report, so the share of copies that had a problem can be worked out. Setup steps, only from a copy whose user said yes when it first opened: the first time each step of getting started happens (opening the app, opening a stock, seeing a forecast, adding to the watchlist, adding a holding, tracking a forecast, a paper trade, a deep analysis, an alert, adding a key, coming back another day and another week), with the minute it happened and how long after the first launch. Not which stock, holding or key. Speed timings: for each time the app is open, how long starting up, opening a stock page, working out a forecast, a deep analysis, loading Summary, fetching prices and the update check took (how many times, the typical time, the time 9 in 10 were under, and the slowest), with the kind of processor (Apple silicon or Intel) and the memory rounded to a common size (for example 16 GB).
Why
To find and fix what goes wrong on other people's computers, to see where new users get stuck between downloading the app and using it, and to know when the app is slow and on which kinds of computer.
Legal basis
Your consent (GDPR Art. 6(1)(a)), for each one separately. Switching one off withdraws it: sending stops at once and anything collected but not yet sent is thrown away. What was already sent stays until it is deleted as below.
Kept
Each row is deleted automatically 13 months after its date. The owner's dashboard shows them as counts and lists of kinds of error, never by install number. To have them deleted sooner, write with your install number, which Settings shows.
Who else
Railway, the host.

The shared record (desktop app and web app, on unless you switch it off)

What
After each update check, and when forecasts are scored, for each scored forecast: its horizon (for example 1 month), whether it was a tracked checkpoint or a band on a chart, whether a deep analysis drew it, and whether the price ended inside the middle half of the band and (for a tracked checkpoint) inside the 9 in 10 band. The web app sends only the horizon and the two yes-or-no answers. No symbol, price, date, holding, install number or version. The site adds them into one count per day, horizon and kind; every copy reads the totals back to correct its bands, and the site shows them as the track record.
Why
So the bands can be checked and widened when they miss more often than they claim.
Legal basis
Legitimate interest. The counts are not personal data. To stop: Settings > Engine in the desktop app, or Share my scored forecasts in the web app's Settings; off stops both the sending and the reading. The owner can also pause it for everyone.
Kept
As daily counts, for as long as the site runs.
Who else
Railway, the host.

Feedback

What
The feedback page sends your message to this site's own inbox: the message, the kind you picked, the date and, when it comes from the app, the app's version. An email address is stored only if you give one, and is used only to reply.
Why
To fix what is wrong and to answer you.
Legal basis
Legitimate interest in reading and answering a message you chose to send; for the optional email address, your consent, given by typing it in to get a reply.
Kept
Deleted automatically 24 months after it arrived, unless a conversation with you is still going, which the owner marks so it is kept until it ends. You can ask for a message to be deleted at any time.
Who else
Railway, the host; Google only if the Google Form is used and you load it.

The feedback survey

What
The multiple-choice questions on the feedback page. Only what you send: the choices you picked, your comment if you wrote one, the date and, when the page was opened from the app, the app's version. No name, email address, IP address or install number is stored with the answers. They go to this site only, never to Google or anyone else, and nothing is sent before you press "Send my answers".
Why
To see, across everyone who answers, what is hard to install, what is unclear and what to improve first.
Legal basis
Legitimate interest in improving the app from answers you chose to give. Do not put anything personal in the comment; if you do, you can ask for that answer to be deleted.
Kept
Deleted automatically 24 months after it was sent. The owner sees the answers added up, and the comments.
Who else
Railway, the host.

Limits on how often an address can ask

What
To stop one address from flooding the site or inflating the counts, the server keeps the address with a short counter, in memory only. Most limits forget an address within about two minutes; the ones on counting visits, update checks, feedback and the survey within about eleven minutes of its last request; the shared record's daily allowance about ten minutes after that day ends (UTC). Addresses are never written to the database or to the site's own log, and all of this is lost whenever the server restarts.
Why
Security, and keeping the counts accurate.
Legal basis
Legitimate interest.
Kept
As above, minutes, or until the end of the day.
Who else
No one.

The host's records

What
Railway, which runs the site, receives every request (including your IP address and what your browser sends) to deliver it, and keeps technical logs of its own. The site's own log records errors and start-up messages, not requests or addresses.
Why
To run the site and find faults.
Legal basis
Legitimate interest.
Kept
Railway's own logs for the time Railway's service keeps them.
Who else
Railway.

The owner's dashboard

What
The owner signs in to a private dashboard at /hub with a password. It sets two cookies in the owner's browser only, described on the cookies page. Visitors never see or receive them.
Why
To keep the owner signed in, and the owner's own visits out of the counts.
Legal basis
Legitimate interest.
Kept
14 days for the sign-in, 2 years for the other.
Who else
No one.

Veduta's posts on Bluesky, Threads and Instagram

What
The site posts to Veduta's own accounts: a short note after each market day built from the basket's closing prices, and news about new versions. It keeps the posts, their pictures and the keys for Veduta's own accounts. It does not read replies, likes or followers, and keeps nothing about people who see or answer the posts.
Why
To tell people about Veduta and how its ranges held.
Legal basis
Legitimate interest.
Kept
The posts for as long as the site runs; their pictures for 60 days. If Veduta's account removes the app at Meta, or asks Meta to delete its data, the saved key is deleted at once.
Who else
Bluesky, Meta (Threads and Instagram) and Finnhub, for a market headline. Each platform's own privacy policy covers what happens on it.

The desktop app, on your computer

Your portfolio, watchlist, notes, alerts, tracked stocks and forecasts are kept in files on your computer: on a Mac in ~/Library/Application Support/com.stockpred.pro, on Windows in your user folder under AppData\Roaming\Veduta. On a Mac your keys are kept in the Keychain, or, if the Keychain refuses one, in a file in that folder that only your account can read; on Windows in that folder. None of it is sent to Veduta.

The app also keeps a list of the notifications it posted, held back or could not post: when, which kind (a price alert, a paper fill, a tracked forecast, an earnings date, an update or a test), what it said and whether it was shown. The list keeps the newest 200, drops any older than 30 days, and stays on your computer. Settings > Notifications shows the latest 30 and can clear the list. A banner that was shown also stays in your computer's own notification list until you clear it there.

For “Since you were last here” it keeps the stocks you opened in the last two weeks (at most 30) and the headlines it fetched (at most 60 a stock, none first seen more than 30 days ago); for the deep analysis, what each of its parts said about a forecast, so it can be scored when the forecast comes due (kept 400 days). All of it stays on your computer.

Settings > Privacy in the app lists every request it makes, in full, with each one's switch. Besides the update check, the shared record, usage statistics, error reports, setup steps and speed timings described above, the app talks to other services directly from your computer, not through Veduta, and Veduta does not see these requests:

Those services have their own terms and privacy policies, and what they do with a request is up to them.

The web apps, in your browser

Veduta for the web (/web) and Veduta Lite (/app) are the same app in two layouts, and share what they keep in a browser. They keep your settings (including your price keys), watchlist, portfolio (each holding's symbol, number of shares and, if you give it, average cost), paper account (made-up cash, positions and orders), tracked stocks, the deep analyses you run, a copy of recent prices, earnings dates for the stocks you look at (for up to two days), today's Discover list, the latest shared record and today's count of Twelve Data requests (so it stays within that service's free limit) in your browser's storage on that device, and a copy of their own files so they open without a connection. For a stock you open they also keep the week's headlines from Finnhub for an hour. None of it is sent to Veduta. Saved prices, headlines, earnings dates and deep analyses for symbols that are no longer on a list, in the portfolio or the paper account, or tracked are deleted when the app starts, and so are saved quotes and headlines more than a day old.

They ask Twelve Data, and Finnhub if you add a key for it, for prices and headlines directly from your browser, with your own key, and what you type in Find a stock goes to Twelve Data as a symbol search (well-known companies are matched in the browser, without a request). With a Finnhub key, a stock's earnings dates and the day's market headlines (for Discover) come from Finnhub too. Discover asks Twelve Data for the prices of the stocks it looks at; those services see the request, your IP address and the key, under their own policies. A headline opens the publisher's own site in a new tab. "Save a backup file" in Settings writes a file to your own computer, with your watchlist, portfolio, tracked stocks, theme and sharing choice and never your keys; nothing about it is sent anywhere. Settings > Clear data removes everything they keep, for both, the offline copies included; so does clearing this site's data in your browser. What they send to the shared record is described above.

Who else receives data

Railway, Cloudflare, GitHub, Google, Anthropic and Alpaca are companies based in the United States. Where your data reaches them, it may be processed outside the European Union, under the safeguards set out in their own terms and privacy policies. Nothing is sold, and no data is used for advertising, profiling or automated decisions about anyone.

Your rights

Under the GDPR you can ask to see what is held about you, to have it corrected or deleted, to restrict or object to its use (for what relies on legitimate interest), and to receive it in a portable form (for the usage statistics, error reports, setup steps and speed timings you consented to). Where something relies on your consent, you can withdraw it at any time; that does not affect what was done before. Write to the address under who is responsible. Most of what the site keeps does not identify anyone, so there may be nothing to find: for usage statistics, error reports, setup steps and speed timings, give the install number that Settings shows; for a message, say roughly when you sent it and from which address. You get an answer within one month.

You can also complain to a data protection authority. In Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it); elsewhere in the EU, the authority where you live or work.

Changes

This page changes when what Veduta does changes. The date at the top says when it last did.