Trust

Paper, not a broker

AetherForge is a paper book: you record what you hold or would trade (cash, buys, sells, corrections, dividends) in NZ$. Real trades happen at your broker. We never move money. Recording a buy does not send money to a broker, an exchange, or a bank. A sell does not pay you.

Where prices come from

Prices for NZX- and ASX-listed shares, and for US shares, come from public market data (Yahoo Finance). They are not a direct NZX or ASX feed. When a newer print is not in the response, the page shows the last saved print and its time. Crypto prices come from CoinGecko, CoinCap, Binance, Kraken, Coinbase, and Yahoo Finance. DEX token prices come from GeckoTerminal and DexPaprika. Gold and silver spot prices come from gold-api.com. Foreign-exchange rates are a daily rate from ExchangeRate-API. Past trade-date rates use Frankfurter. Prices may be delayed and are for information only. Calculations by AetherForge; plain-English notes written by AI.

How fresh the figures are

NZX and ASX figures are delayed during the regular session, or the last close after that session ends. US share figures are the last close in New York once that session has ended. Crypto quotes are delayed or indicative. The page shows the as-of time when it has one. Foreign-exchange rates are a daily rate. Profit and loss uses the latest available price.

• NZX shares — Yahoo Finance, about 20 minutes while the market is open; last close otherwise.
• ASX shares — Yahoo Finance, about 20 minutes while the market is open; last close otherwise.
• US shares — Yahoo Finance, delayed while the market is open (the vendor does not state a fixed figure); last close otherwise.
• Crypto — CoinGecko, a few minutes; a quote older than 5 minutes is labelled with its age.

Who else handles data

Your data is never sold. It's shared only with the processors listed in our Privacy Policy.

• Cloudflare — public site and network.
• Stripe — subscription payments. We never see your card number.
• xAI (Grok) — plain-English notes and assistant replies.
• Google Analytics — which pages are used, only after you accept analytics cookies.
• Totalum on Google Cloud — account storage.
• CoinGecko — crypto prices.
• CoinCap — crypto prices.
• Binance — public crypto price tickers.
• Kraken — crypto prices.
• Coinbase — crypto prices.
• Yahoo Finance — prices for NZX-listed, ASX-listed and US shares, and mapped crypto quotes.
• GeckoTerminal — DEX token prices.
• DexPaprika — DEX token prices.
• gold-api.com — gold and silver spot prices.
• ExchangeRate-API — daily foreign-exchange rates.
• Frankfurter — foreign-exchange rates on past trade dates.

Security

Encrypted in transit (HTTPS). Payments handled by Stripe. We never see your card number. The book is tied to your signed-in account. Another member cannot read it. We do not ask for a broker login, and we do not store a password for a bank or an exchange.

The site response sets Strict-Transport-Security to max-age=31536000; includeSubDomains.

Where the book is stored

Totalum on Google Cloud handles account storage.

Pages and APIs run on Cloudflare's global network. The paper book and account data are stored by Totalum on Google Cloud. Traffic is encrypted in transit (HTTPS with HSTS).

Retention, deletion and export

Personal information is kept only for as long as it is required for the purposes set out in the privacy policy or as required by law. When information is no longer needed, it is securely deleted or de-identified.

You may delete your holdings at any time, and you may request deletion of your account. Access and correction requests are answered within the timeframes in the Privacy Act 2020, generally 20 working days.

A CSV export of your transactions is included on Starter and above. Yearly billing also includes a downloadable Excel investor toolkit template. That file is a blank template. It is not filled with your holdings, and it is not a copy of the figures in the ledger.

The full wording is in the privacy policy.

The fee rule

The fee is whatever you enter. It defaults to NZ$0.00 on every transaction type and every asset — shares, crypto, DEX tokens, gold and silver — the same way a portfolio tracker leaves brokerage at zero until you type the fee your broker charged. The fee is always shown, including at zero. That amount is what the review screen, the cash change, cash after, and the ledger use.

What the AI does

Scores and projected ranges are calculated by a rules-based engine. A third-party AI service writes the plain-English note on a ticker and the replies in the assistant, the Portfolio Notes Assistant, and the Headmaster chat. Those notes are labelled “AI-written note”. A stored member report for Stox, Koins or Headmaster marks its summary as not AI-enhanced, because that summary is built from the calculated figures.

The assistant can send the question you typed, and recent messages in that chat. When the paper book has holdings, it can also send the holding count, the total market value, the total cost, the total unrealised profit or loss, the best and worst performer, the sector weights, and for each holding the ticker, the name, the sector, the share count, the average price, the current price, the value, the profit or loss, and the weight.

The Portfolio Notes Assistant can send your question, and recent messages in that chat. When a Headmaster book is available it can also send the cash balance, the total value, the profit or loss, the diversification score and its label, and the allocation weights and values in NZ$, including cash. It can send the top eight positions with name, asset class, weight and value, the latest Stox and Koins findings, and the Headmaster ideas for names in the book. It can send a plan you typed and report text you attached.

The Headmaster chat can send your question, and recent messages in that chat. It can send the total value, the total cost, the profit or loss, the cash balance, the cash weight, the retained-cash target, the illustrated cash reallocation, and the working that produces that reallocation. It can send each asset class with its weight, its value in NZ$ and its position count, the top eight positions with name, asset class, weight, value and profit or loss, concentration-risk notes, stress-test impacts in NZ$ and percent, and the bull, base and bear scenario pathways. When the book is invested it can send the diversification score and HHI. It can send a calculated yearly return and volatility for the mix. It can send the latest Stox and Koins findings, and the Headmaster ideas block. Names outside the book are included only when you ask for a watchlist.

A ticker note can send the ticker, the question you typed, and the quote used for that note. If you leave the question blank, the request still includes a short default question.

A weekly projections email, when that email is enabled, can send the market-wide indicative 7-day projections already on the projections page: the ticker, the name, the market, the indicative percent, and the as-of label. It does not send a person's holdings, values, cash, profit or loss, or allocation. It does not send the email address. It does not use a report allowance. One note is written for the week and reused for each recipient.

The request does not include a card number. Our code does not write the text of these requests to its logs. Messages in the assistant chat are saved to your account so the conversation can continue, and they stay until you clear the chat. The Portfolio Notes Assistant, the Headmaster chat, the ticker note and the site guide do not save your messages. Stored Stox and Koins reports stay in your account. To have reports or your account deleted, email us and we delete them. The AI provider keeps a request under its own API terms.

Plain-English notes are written by a third-party AI service, xAI (Grok), through its API. xAI's API terms state that API requests and responses are kept for up to 30 days for abuse monitoring, then deleted, and are not used to train its models.

Report a vulnerability

security.txt lists Contact mailto:admin@aetherforgeai.co.nz and Expires 2027-10-08. A notifiable privacy breach is reported to affected people and the Office of the Privacy Commissioner, as the privacy policy states.

The contact file is security.txt.

If you find a security weakness, email admin@aetherforgeai.co.nz or lukas@aetherforgeai.co.nz or use the contact form and put "Security report" in the message.

Changes on this page

• 10 Oct 2026: Transport header, storage name, AI retention, deletion, export and breach contact, each matching the privacy policy.
• 11 Oct 2026: The AI provider is named on this page.
• 13 Oct 2026: The provider row uses the 30-day API wording. Google Analytics is described as running only after analytics cookies are accepted.
• 16 Oct 2026: Added the data sources and delay table, where the site runs, and a retention statement for AI requests.

Not financial advice