What this is, what you may do with it, and what happens to your data.

This is the long version of the notice at the foot of every screen. It is written so that each claim on it can be checked against the product rather than taken on trust — the same standard the rest of this site holds itself to, and the only one worth anything on a page like this.

Last updated 10 September 2026

1. What this is

Risk Co-Pilot performs descriptive analysis of price history for a portfolio you type in. It measures what a set of holdings has done — volatility, drawdown, concentration, how much each position contributed to the whole — over a window it names every time.

It is not, and does not attempt to be, any of the following:

• Investment advice. It makes no personal recommendation to buy, sell or hold anything.
• A suitability assessment. It knows nothing about your circumstances, your other assets, your obligations or your tolerance for loss, and it never asks.
• A prediction. No figure on this site forecasts a price, a return, or the probability of either.

Because it makes no personal recommendation concerning a financial instrument, it is not an investment service within the meaning of MiFID II or Law 126/2018, and it is not authorised or supervised by ASF. It does not need to be — but that boundary is the reason, so the boundary is kept deliberately.

That is a claim, so here is the evidence rather than the assurance: /method prints how every figure on the site is computed, generated from the engine itself rather than from prose kept beside it, and /kills lists twenty-seven hypotheses this project pre-registered, tested and abandoned — most of them attempts to predict something. The descriptive stance is what was left after losing, not a disclaimer bolted onto a product that quietly does more.

What you do with the numbers is your decision, and yours alone.

2. Who runs it

Risk Co-Pilot is built and run by one person, in Romania, as a non-commercial research and education project. There is no company behind it, no team, and no investor.

Contact: [email protected] — an address on this domain, forwarded to a mailbox kept only for this. Mail is read by the person who wrote the product. It is also the address for anything in the privacy section below.

If this ever stops being free — which it cannot do before the licence question in section 3 is settled — a registered entity will have to exist, and this section will then name it, its registration number and its registered address.

3. It is free, and that is load-bearing

Nothing is charged. There is no plan, no checkout, no paywall, no subscription, no advertising and nothing sold — not as a launch offer, but as a condition the rest of the product depends on.

The price data comes from sources whose free terms cover research and education and not commercial use or redistribution. Free, non-commercial, and redistributing nothing is precisely what keeps this deployment inside those terms. It follows that on the day money is taken for access, a commercial display licence has to already be in place — not be arranged afterwards. That order is written into the project's own repository as a gate, so taking the money first would mean breaking something recorded rather than overlooking something.

What being free does not create

No entitlement to availability, to any particular feature, or to notice before either changes. This may be modified or shut down at any time. It runs on a free hosting tier that sleeps when idle, so the first load after a quiet period can take around half a minute; that is the tier, not a fault.

4. Where the numbers come from

End-of-day closing prices from public sources, together with dividends, fund metadata and academic factor data. The detail, figure by figure, is on /method.

• Prices can be wrong, late, or missing. Corporate actions are handled by the source; this project does not audit them.
• What leaves the server is derived — volatilities, drawdowns, contributions, scores. Raw quotes appear in two places only, and only for a ticker you asked about.
• There is no bulk export and no download of price series. That is a deliberate limit, not a missing feature.

5. What you may do with what you read here

This project publishes measurements in order for them to be used and argued with. So the permission is stated plainly and broadly, rather than reserved by default and negotiated on request.

The pages, text, design and code of this site belong to its author. Open-source components keep their own licences, and their notices ship inside the application bundle.

6. No warranty

Figures may be wrong. Sources may be wrong. The code may have bugs — this project's own audits have found and published a number of them, and there is no reason to believe that has stopped. The site is provided as is, with no warranty of accuracy, completeness, availability or fitness for any purpose.

Every figure is shown with the method that produced it, the window it covers and the limit of what it supports. That is the honest maximum a tool like this can offer: it can tell you what was measured. It cannot tell you what will happen.

7. Liability

To the fullest extent Romanian law permits, the author is not liable for any loss arising from use of this site or from reliance on anything shown on it, including investment losses.

Romanian law does not permit excluding liability for harm caused intentionally or through gross negligence (Civil Code, art. 1355), and nothing here attempts to. If you are a consumer, the mandatory protections of your country of residence apply whatever this page says.

8. Privacy

The controller is the person described in section 2, reachable at [email protected].

What is not done here

No accounts. No cookies. No third-party analytics, no advertising network, no tracking pixel, no fingerprinting, and no profile of you held anywhere.

No third party is contacted at all. Every file these pages load comes from this domain, including the typeface — it used to be fetched from Google Fonts, which meant your browser asked Google for it and Google saw your address in the request. That was disclosed here while it was true; the files now sit on this server, so there is nothing left to disclose. The site's security policy no longer permits any outside host either, so this cannot quietly come back.

There is no consent banner because nothing is placed on your device for our benefit — only the three items listed below, each strictly necessary for the thing you asked for.

Counting visitors

A few numbers a day are kept: pages served, app opens, analyses run, and distinct daily readers — plus the host that linked here (reddit.com, say), never the thread, the query string or the search term.

How a reader is counted once

Your IP address is combined with a random salt that changes every day and is never written down anywhere, hashed, and part of that hash used as a one-day identifier — so ten page views by one person are not ten people. The identifiers exist in memory only and are discarded when the day rolls over. Only the resulting counts are saved.

Legal basis

Legitimate interest, GDPR art. 6(1)(f): knowing whether anyone uses this at all.

Retention

What is stored is an aggregate with no personal data in it, so there is nothing about you to retain. The daily identifiers last at most a day and never leave memory.

Never recorded

Tickers, weights, amounts, portfolio names, and any free text. These stay in the request and are not written down.

Your portfolio, and what is on your device

Your portfolio is stored in your browser and nowhere else — three entries in this site's local storage, and nothing besides: rcp-workspace-v1 (the portfolio), rcp-history-v1 (a few past readings, so a page can say what changed since last time) and rcp-theme (light or dark). The app also caches its own files so it keeps working offline; there is no personal data in that cache.

Storing anything on your device normally requires consent under art. 5(3) of the ePrivacy Directive and Law 506/2004. These are exempt because they are strictly necessary to provide the thing you asked for — an app that remembers the portfolio you typed into it. Nothing is stored for any other purpose, and none of it is an identifier.

Holdings are sent to the server to be measured, and are never stored there. You can erase everything from the foot of any screen in the app, or by clearing this site's data in your browser. Nobody has to be asked, because there is no copy anywhere else to delete.

If you write to us

Mail sent to [email protected] is kept so that it can be answered — your address, and whatever you put in it. It is forwarded by Cloudflare Email Routing into a Google mailbox. A plain address is offered rather than a contact form, deliberately: a form means storing what strangers write, and that should not be the first thing this product keeps about anybody. Do not send anything you would not want held in an ordinary mailbox.

Where it runs, and what crosses a border

Hosting

Render, on servers in the United States (Oregon). Your IP address reaches that server as part of any ordinary web request, which is where the counting above happens.

Edge, DNS, and storage of the counts

Cloudflare. What is stored there is the aggregate counts, which contain nothing about a person.

Mailbox

Google, for the address above.

Transfer outside the EU

Because the server is in the United States, this is a transfer under Chapter V GDPR, relying on the standard contractual clauses in those providers' data-processing terms. What actually crosses is an IP address, in transit, immediately turned into a one-day pseudonym — no account, no name, no holdings.

Your rights

Access, rectification, erasure, restriction, objection and portability. In practice there is very little to exercise them against, because nothing identifying you is kept — but write to the address above and you will get a straight answer rather than a form. You may also complain to ANSPDCP, the Romanian supervisory authority (dataprotection.ro), or to the authority in the country where you live.

9. Age

This site is not directed at anyone under 18, and no service is knowingly offered to them.

10. Governing law, and changes

Romanian law governs these terms. If you are a consumer resident elsewhere in the European Union, that does not deprive you of the mandatory protections of your own country's law, and you may bring proceedings there. No arbitration clause and no exclusive jurisdiction clause is imposed here, because against an EU consumer such clauses would not hold — and a clause that would not hold has no business on a page whose whole point is that it says only what is true.

This page carries the date it last changed, at the top. There are no accounts, so there is nobody to notify; changes are made by editing this page, and earlier versions are kept in the project's repository.