I built a Chrome extension that grades stocks with deterministic rules; here's the privacy architecture

Most stock tools ask for your broker login or portfolio data, providing opaque AI suggestions that cannot be verified. I created StockAgent, a Chrome extension that grades stocks using transparent, deterministic rules and would like to share my privacy layer design. StockAgent grades each stock on a 0-5 scale based on five financial metrics: Debt-to-Equity below sector threshold, PEG ratio below threshold (varying by sector), ROE above 15% (or 8-12% for banks/utilities), 200-day SMA price above moving average, and RSI below 35 (indicating oversold conditions).

Additionally, news headlines from Yahoo Finance RSS are scanned for risk keywords and scored accordingly: Severe penalty of -2 (with a cap of -3), Moderate penalty of -1 (with a cap of -2), and Mild penalty of 0 (informational only). The final grade ranges from 4-5 (STRONG BUY), 3 (HOLD), or 0-2 (AVOID). The extension sends scheduled email digests and optionally uses a BYOK Gemini key to explain grades in plain English, but this never influences the score.

The privacy challenge was to build a cloud feature (email reports) without seeing the user's actual portfolio. StockAgent implemented a three-layer privacy enforcement: 1) Two-tier storage, treating everything as either private (never transmitted) or cloud-eligible (sent only if user opts into email); 2) Allowlist payload construction, which reconstructs the outbound object from scratch using only allowed fields, ensuring holdings and API keys can't leak; and 3) Runtime blocklist assertion, which checks every payload for private fields before sending them over the network.