You are being asked for your CAS, a statement that lists every mutual fund you own. This is what is kept about you, who else sees any of it, what the person who runs the site can and cannot read, and how to make it all go away — including the parts that are not reassuring.
Portfolio Lens is run by Nikhil, for friends and family. Questions, and deletion requests: nikhiltx31@gmail.com. Last changed 18 October 2026.
Your browser turns it into a key and sends only the key, so the keyword itself is never in a request, a log or a backup. That is also why nobody can reset it for you.
Your holdings and transactions are kept only inside your vault, encrypted under a key that only your keyword or your recovery code opens. A vault moved to another account will not open. The one exception is a profile you have shared: while it has a guest, a copy of it is kept without a key. That copy holds fund names and their ISINs, weights, returns, the look-through, the funds' public prices, how many folios and tax lots you hold in each fund, the dates behind the split of your value (which show the month you first invested and each financial year you have held), the date your statement runs to, and the name the portfolio goes by (the name on the statement, else your account's name, else your email address). It holds none of your amounts: no value, cost, gain or unit count. Removing your last guest deletes it, though the database's restore history keeps it for up to 30 days after.
The server decrypts your portfolio while it handles your request — an upload, opening your dashboard, building a guest's copy. During that request, whoever runs the server could in principle read it. Nobody here will tell you “even we cannot read it”, because it would not be true. What can and cannot be read is set out below.
The name is sealed in the vault with the holdings. The PAN, address and mobile number on the statement are never stored. The PDF and its password are used during the upload and never stored.
Every rupee figure and unit count is taken out before the copy is made, so it is not in the page, its tooltips or anything a guest's browser receives.
The shared fund data (the scheme list, prices and the fund houses' monthly filings) records that a fund is held by somebody, never by whom, and nothing records which fund you looked up to compare. The gap: which shared rows exist, and when they were written, shows when a fund first matters to somebody. A row appears or changes when you are the first person here to hold a fund, or to look up one nobody has looked up. An upload can also add a fund's price history even though somebody here already holds it, when that history was never fully fetched, and the fund's first filing when it has no filing of its own yet. Somebody comparing the database at two moments could match those rows to the uploads and sign-ins in between, and on a quiet day that could point to you. Two records tie them to you more closely: your upload record names your account and when it ran, and while it fetches it says it is fetching prices or what new funds hold, and an upload cut off mid-fetch keeps that text; and the one-a-minute limit keeps your account and the time of your last request to fetch a fund to compare, until a request by anyone a minute or more later, or the nightly run. Neither names a fund. A fund somebody here already holds, with its price history fetched and a filing of its own, leaves no new row. This gap is known and accepted: closing it would mean tracking every fund in India.
Screenshots and examples never come from a real portfolio.
No mail is sent today — not invitations, not notices, not a confirmation when you delete your account. When mail is added, it will carry no amount, not even a rounded one.
The rules about the keyword, the PAN and what a guest receives are checked by automated tests that may not be loosened. Where a test checks less than the rule says, the product's own requirements say so.
Everything listed under “What an account holds” except the inside of the vault: your email address and name, your profile names, your guests' email addresses and visits, the activity log and how each upload ended. Any guest's copy, which carries no amounts. And, in principle, your portfolio during a request that decrypts it (P-3).
Your keyword, which never arrives. Your vault as it is stored — holdings, transactions and the investor's name — without your keyword or recovery code. Your PAN, address, mobile number, the PDF and its password, none of which is kept. Who holds which fund, from the shared data, beyond the gap in P-6.
Each of these is kept until you delete the account.
Not kept: the PDF and its password, your keyword, and the PAN, address and mobile number on the statement. A failure on our side is recorded with the page or API path it happened on, the type of error and where in the code; error rows name no account and are kept. Price and filing refreshes are logged too, and name no account.
Signing in to read it gives you an account of your own, holding the rows above. The owner sees your email address and when you last looked, and their activity log records each visit. If you were invited and never signed in, your email address is still stored with the invitation: the owner can revoke it, or you can write to nikhiltx31@gmail.com to have it removed. If you erase your account, their invitation to your email address and their record of your visits stay with them, with your account's name removed. Whether you can still see their portfolio is their decision, not part of your account.
None of them receives your keyword.
sessionStorage, until the page locks after 15 minutes idle
or the tab closes. A note that it locked is kept there too, so the page
can say why it is asking again.localStorage: the last
profile chosen, the last tab open and the width of the detail panel.
None of them holds a figure.No tracking, no analytics, no advertising.
Tax figures are a model, not advice, and none are shown in the hosted product today. The look-through comes from each fund's latest monthly disclosure, which lags by up to about 40 days; that is expected, and the page shows the month it reflects. The terms of use say more.
You can delete a profile at any time, which removes its vault, its guests and its guest copy. Deleting the account — from the last profile, by typing “delete” — removes every profile and vault, your key, your guests and their copies, your upload records, the activity log about your account, and the account itself. A single row records that an account was deleted, naming nobody.
Deleting is final, and nobody can recover the account for you, Nikhil included. The database's point-in-time restore history still holds the erased rows, vault included, for at most 30 days, and then they are gone. No mail is sent to confirm it.
Deleting your account here does not delete your sign-in identity at Clerk; signing in again starts a new, empty account. To have it removed as well, or for anything this page does not answer, write to Nikhil at nikhiltx31@gmail.com.