Privacy Policy
Options Portfolio Tracker. Effective November 10, 2026.
This is an independent browser extension, not affiliated with, endorsed by, or produced by Fidelity Investments or Google.
Information Handled
Only when you click Scan Portfolio, the extension reads the rendered Options sections on the active Fidelity Positions page. It handles account labels and identifiers, underlying tickers, option expiration dates, strikes, types, quantities, cost basis, current values, and gain/loss. It also handles the options cash budget you enter and your display and account-selection settings. There is no setup or agreement screen; local storage initializes automatically without starting a scan or requesting quotes.
The extension does not request your Fidelity password, read authentication cookies, access Fidelity account APIs, place trades, or monitor your browsing history. It does not collect analytics or use advertising, tracking pixels, or a developer-operated backend.
Local Storage and Encryption
Your budget, portfolio snapshots, account settings, preferences, saved quotes and any historical consent record are stored locally in this Chrome profile, together in an AES-256-GCM encrypted vault. Each save uses a fresh random IV. The short disclosure next to Scan Portfolio explains this use before you click it; there is no setup screen. No consent record is fabricated by opening the app. Data is not synced by the extension.
PIN Protection is optional and off for new portfolios. Without a PIN, a random 256-bit non-exportable CryptoKey is kept in the extension's local IndexedDB key store and the popup opens directly, including after browser restart. The key is separate from the ciphertext in extension storage, but remains in the same Chrome profile. Non-exportable means the Web Crypto API does not allow exporting the key; it does not mean the key is hardware-backed or that the browser profile is safe from compromise. Anyone using or controlling this profile or device can access the app and its data.
With PIN Protection on, the vault key is derived from your four-digit numeric PIN using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a random salt. The PIN is not saved or sent to external services. The derived unlock key is held in extension memory and Chrome's restricted session storage, not persisted beside the vault. Each newly opened PIN-protected popup requires the PIN. A cached internal key lets already-requested background quotes finish after the popup closes; it does not bypass this PIN prompt. The automatic key is removed after PIN protection is successfully enabled, when possible.
Existing PIN-protected data remains protected unless you explicitly disable PIN Protection and confirm with your current PIN; disabling it switches to automatic-key encryption, not plaintext. Enabling or disabling the PIN preserves saved records. A four-digit PIN provides limited protection against offline guessing and is weaker than six digits or a long passphrase. Encryption does not protect a compromised computer, an authenticated popup, screenshots, malware, or copies in device backups. Existing plaintext records in the current app namespace are automatically encrypted before their redundant copies are removed. Existing passphrase or six-digit PIN vaults require that previous credential once to re-encrypt with a four-digit PIN. Deleting records or changing protection cannot guarantee forensic erasure of older copies from backups or storage media.
Saved records use the Options Portfolio Tracker storage namespace. Already-migrated financial values and protection settings are preserved when upgrading.
Optional Stock Prices and Google
Stock prices are off by default. Enabling them requests optional access to https://www.google.com. Chrome host permissions apply to the whole origin, even though this extension only fetches Google Finance quote pages. When enabled, a Scan Portfolio click sends underlying ticker symbols and candidate exchange codes to Google Finance over HTTPS to obtain stock-price snapshots. The requests omit Google cookies and referrers and do not include your option details, quantities, account identifiers, Fidelity page URL or budget. Opening the popup does not start these requests.
Google receives the requested symbols, your IP address and normal HTTP/browser metadata. These requests are not anonymous. Google's handling of requests is governed by the Google Privacy Policy. Public pages may be delayed, blocked, unsupported or changed; there is no guaranteed live quote service.
Clicking a company ticker opens a normal Google search tab for that ticker plus "stock". Normal browser and Google cookie/settings behavior applies to that user-opened tab, unlike the cookie-free background quote requests.
Use, Sharing and Retention
Information is used only to display your options, calculate estimates, retrieve optional quotes, and preserve your chosen local settings. The developer does not receive your portfolio or budget, and does not sell or transfer them to advertisers, data brokers or other parties. The only external data requests made by the extension are the optional Google quote requests described above and links you explicitly open.
Saved data remains until replaced by a later scan, deleted with Clear Saved Data, or removed when you uninstall the extension. Quote snapshots may remain older than your latest scan when a lookup fails. Disabling Stock Prices stops quote refreshes and removes optional Google access; existing saved quotes remain visible until deleted.
Your Controls
You may enable or disable PIN Protection, disable Stock Prices, lock a PIN-protected vault, edit your budget, choose which accounts affect calculations, or use Clear Saved Data to delete saved records, settings, historical consent records, popup authorizations, session key and automatic encryption key. Deletion does not change your Fidelity account or erase Google's records. A forgotten PIN or lost automatic key cannot be recovered; resetting a vault permanently deletes saved extension data.
Limited Use and Changes
The extension's use of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only for the disclosed user-facing purpose. Material changes to these practices will be described in the extension before any new use requiring consent.
Contact
Contact the publisher through the Support contact shown on this extension's Chrome Web Store listing. Do not send passwords, account numbers, or unredacted portfolio screenshots.