Keys stay on your PC
In the Windows app, broker credentials and data or AI keys are stored in the Windows Credential Manager and sent only to the provider they belong to. The web app does not accept broker keys.
Security & privacy
Designed to hold as little as possible.
BYP keeps your keys and your portfolio on your device wherever it can, encrypts what it syncs, and never acts on your accounts by itself.
How BYP protects you
Encrypted before upload
Optional sync in the Windows app encrypts your preferences, watchlists, saved views, notes and workspace state on your device with AES-256-GCM, using a key derived from a passphrase only you know (PBKDF2-SHA256, 600,000 iterations). The server stores ciphertext it cannot read.
A strict allow-list
The desktop app’s content-security policy lists every host it may contact. Anything else — including an injected script trying to send data elsewhere — is blocked.
Diagnostics without secrets
Diagnostic reports you choose to send exclude keys, account numbers and holdings.
You control your account
See your signed-in devices, sign out of every device at once, or delete your account and its cloud data from Settings.
Nothing trades on its own
Orders can be sent only through Alpaca, only from the Windows app, and only after you review and confirm. Captain Umro and alerts cannot place orders.
Encrypted sync
What sync does today — and what it doesn’t.
Sync is optional and available in the Windows app. It covers preferences, watchlists, saved views, notes and workspace state — never broker keys, API secrets, orders or payment data. Your data is encrypted on your device before it is uploaded, and only someone with your passphrase can decrypt it. If you lose the passphrase, BYP cannot recover the synced data.
- The Android app does not sync your workspace today; treat your phone and your PC as separate.
- If two devices change the same data, the most recent change wins. Sync is designed for one primary computer.
- Deleting your account deletes its synced ciphertext from BYP’s servers. Data kept only on a device stays there until you remove it.
Order safety
Who can place orders.
| Order placement | Alpaca only — US stocks and ETFs, in the Windows app, through your own Alpaca account. You review and confirm every order; nothing is sent automatically. |
|---|---|
| Interactive Brokers | Read-only. Live trading through BYP is on hold. |
| Tradier, OANDA | Read-only: data and portfolio sync. |
| Android and web | No order placement. Android paper trading is simulated on the phone. |
| Captain Umro and alerts | Never place an order. They inform; you decide. |
This website
No trackers here.
This site uses no analytics, advertising or tracking scripts and sets no cookies. It loads its fonts and images from its own server. A theme preference you choose is kept in your browser’s local storage and never sent to us.
Found a vulnerability? Email security@buildyourpocket.com with steps to reproduce, and give us reasonable time to fix it before disclosing it publicly.
Read the Privacy Policy for what BYP collects and why.
Start with the workspace, not a sales pitch.
Free to download. Purchasing isn't open yet, so there is nothing to buy and nothing to cancel.