Privacy
Your Alpaca key
Your Key ID and Secret stay in your browser. By default they are kept in this tab's session storage and forgotten when you close the tab. If you tick "Remember" (offered for paper-trading keys only), they are kept in this browser's local storage until you press "Disconnect" (in Settings). Your browser sends the key only to Alpaca (data.alpaca.markets and stream.data.alpaca.markets), never to our server, and the page's security policy lets it contact no other site except vibistic.com's visitor counter, below, this site's own cloud backup (if you turn it on), and the five AI providers Ask AI can use (Anthropic, Google, xAI, OpenRouter and Zhipu; the page calls only the one you pick, and only when you ask), none of which ever receives the Alpaca key.
Please use a paper-trading key. Vibistic Stocks only reads prices, but anyone who obtained a live-trading key could place trades with it.
Your watchlist and settings
Your watchlist, your settings and your own anchored VWAPs are kept in this browser's local storage. They are not sent anywhere except as the symbols your browser asks Alpaca about, and, only if you turn on cloud backup, encrypted (below).
Your alerts
Your alert rules, when each last fired and whether you turned on notifications and sound are kept in this browser's local storage. Alerts are checked and shown by this page in your browser; Vibistic Stocks sends no email and no push message. Only the rules themselves go into your cloud backup, if you turn it on; when they fired and your notification choices stay on this device.
Cloud backup (optional, off unless you turn it on)
Cloud backup keeps your watchlist, settings, alert rules and anchored VWAPs in step across your devices. Turning it on gives you a recovery code; your browser derives three values from it: one to find your backup on our server, one to prove you may change it, and one to lock and unlock it. Everything is encrypted in your browser (AES-256-GCM) before it is sent, so our server (a Cloudflare D1 database) stores only scrambled data it cannot read. It never receives your Alpaca key, prices or the recovery code. To keep your devices in step, each one fetches the encrypted backup when the page opens, when you come back to it and every few minutes, and uploads it a few seconds after you change something.
The QR code and the restore link shown with your code contain the code itself (after a #, which browsers never send to any server; the page removes it from the address as soon as it opens). Anyone with the code, the link or the QR code can open your backup, so keep them like a password. This browser keeps the backup's lookup value and change token, and its key in a form that cannot be copied out, so it can sync without asking for the code. If you lose the code, nobody can recover the backup. Turning backup off (Manage) deletes it from our server; your other devices then stop syncing and keep their data.
Ask AI (optional)
Ask AI answers questions about the chart and about Vibistic Stocks with your own AI key (Anthropic, Google Gemini, xAI Grok, OpenRouter or Zhipu GLM). When you ask, your browser sends your question, the last few messages of that conversation and which chart you are on (the stock's symbol, the time range, daily or weekly candles, which lines are shown, your near-band and big-dip settings and the dates of your own anchored VWAPs) straight to that provider, never through Vibistic. It never sends prices, levels or any other market data, and never your Alpaca key. The provider's own terms and privacy policy apply to what you send it, and it charges your account for what you use.
Your AI key is kept in this tab only and forgotten when you close it, unless you tick "Remember on this device", which keeps it in this browser's local storage until you press "Forget key". It is never part of a backup or an export. Conversations are kept only while the page is open.
The microphone button next to the question box uses your browser's own speech recognition. In Chrome and Edge that sends the recorded audio to the browser maker (Google or Microsoft) to turn it into text; the button says so before you first use it. Vibistic never receives the audio. It stops when you press it again, press Escape, or close the panel.
What our server sees
Our server sends you the page and, if you turn on cloud backup, stores your encrypted backup. It never receives your key or any prices. Like every website it sees the address your request comes from, which Cloudflare (our host) uses to deliver and protect the site.
Counting visitors
The footer shows how many people have visited and how many are here now. Your browser reports a visit to vibistic.com, which counts it from a one-way scrambled form of your address and browser name; it receives nothing about your key or watchlist. Unlike Vibistic's other sites, this page runs no analytics script: no script from anywhere but this site runs on a page that holds your key.
Cookies
One cookie, vibistic-theme, remembers whether you chose the light or dark theme, shared across Vibistic's sites. Nothing else.