Privacy Policy

Who we are

PastFi is an investment simulation tool operated by AYolos LLC ("PastFi," "we," "us"), the data controller responsible for the personal data described in this policy. You can run simulations without creating an account; PastFi does not offer user accounts or logins at this time.

Information we collect

Simulation inputs

When you run a simulation, we process the financial parameters you enter — asset types, stock tickers, region selections, investment amounts, contribution schedules, and time horizons — to compute and display your results. These inputs are not linked to your identity and are not used to identify you.

Usage & analytics data

We collect analytics about how the site is used — pages viewed, features used (for example adding an asset, searching a ticker, running a backtest), approximate value ranges rather than exact amounts, plus your referrer, device/browser type, and a randomly generated anonymous identifier stored in your browser. This is processed through Google Analytics 4 and PostHog (see "Analytics & cookies" below), which may also record session activity to help us diagnose usability issues.

Contact form submissions

If you contact us through the site, we collect your name, email, topic selection, and message content so we can respond. These messages are delivered to us by email through Google (Gmail).

Browser storage

We use your browser's local and session storage, and cookies set by our analytics providers, to keep interface state, generate the anonymous analytics identifier, and measure sessions. You can clear this data at any time through your browser settings, or decline non-essential storage through our cookie banner.

Technical logs

Our servers log request metadata for reliability, debugging, and abuse prevention: request paths, HTTP methods, response status codes, and a generated request identifier. These logs, and our rate-limiting system, may include your IP address. Your IP is also forwarded to our backend to enforce per-client rate limits.

How we use your data

• Run and display your investment simulations
• Understand how the product is used and improve it (analytics)
• Respond to support and contact requests
• Monitor service reliability and fix errors
• Protect the service through rate limiting and abuse prevention

We do not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and have not done so in the preceding 12 months. We do not use your data for third-party or cross-context behavioral advertising.

Analytics & cookies

We use two analytics services to understand product usage. Both may set cookies or use browser storage:

• Google Analytics 4 — measures traffic and feature usage. Google sets first-party cookies (for example _ga, _gid) and processes your data under Google's privacy policy.
• PostHog — product analytics and session recording to diagnose usability issues. PostHog stores an anonymous identifier in your browser's local storage.

Analytics and other non-essential storage load only after you accept them through our cookie banner, and you can change your choice at any time. Storage that is strictly necessary to operate the site is always active. We do not run advertising networks, pixel trackers, or device-fingerprinting services.

Third-party services

• Google Analytics & PostHog — usage analytics, as described above.
• Sentry — server-side error monitoring. When an error occurs, Sentry receives error details and request context. We disable personally identifying data by default and scrub sensitive fields (authorization tokens, passwords, API keys, cookies) before transmission, so Sentry does not receive your IP address or email by default.
• Google (Gmail) — delivers contact-form messages to us by email.
• Hosting & infrastructure providers — serve the application and may process technical data such as IP addresses to deliver and secure the service.
• We self-host our web fonts, so loading the site does not send your data to a font provider.

Legal bases for processing (EEA/UK)

• Contract / legitimate interest — running simulations and delivering the service you request.
• Legitimate interest — securing the service, preventing abuse (rate limiting, logs), and error monitoring.
• Consent — analytics and non-essential cookies/storage, which you may grant or withdraw via the cookie banner.
• Legitimate interest — responding to messages you send us through the contact form.

International data transfers

We and our providers (including Google, PostHog, and Sentry) may process your data in the United States and other countries. Where personal data of individuals in the EEA or UK is transferred, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or a provider's Data Privacy Framework certification.

Data security

• HTTPS encryption for all connections
• Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• Rate limiting on sensitive endpoints
• PII scrubbing on error reports before third-party transmission

Data retention

Simulation inputs are processed to generate your results and are not stored against your identity. Server logs are retained according to our infrastructure provider's policy (typically around 30 days). Analytics data is retained according to the retention settings of Google Analytics and PostHog. Contact-form emails are kept for as long as needed to handle your request.

Your rights

Depending on where you live, you may have the right to access, correct, or delete personal data we hold about you, to opt out of analytics, and to withdraw consent. California residents have the right to know the categories of personal information collected, to request deletion, to opt out of sale/sharing (we do neither), and not to be discriminated against for exercising these rights.

To exercise any of these rights, visit our contact page or email yolojaem@gmail.com.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

Children's privacy

PastFi is not directed at children under 13 years of age (or, in the EEA/UK, under the age of digital consent, which is 16 in many countries). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Reach us at pastfi.com/contact or email yolojaem@gmail.com.