Privacy Policy & GDPR Compliance

Last updated: 28 October 2026

Minimal Data Collection

When you sign in, we store your email address for authentication and your saved portfolio records. In Guest Mode, your portfolio data stays locally in your browser. If you sign in with Google, Google sends your email address and basic profile information to Supabase Auth to complete sign-in and identify your account; the app displays the account email.

Portfolio and Asset Data

When you save a portfolio or sync trades and assets—including stocks, ETFs, options, and cash balances—this financial data is stored in Supabase, our database and authentication provider, to save and display your personal portfolio analytics and dashboards. Access is protected by database access controls and encryption at rest. We do not access your portfolio data except when needed for user support, security or legal obligations.

Broker credentials saved to the cloud are encrypted at rest with a server-held key. Some IBKR credentials may also be saved locally as a browser fallback; browser storage is not encrypted by FolioTracking. Avoid saving credentials on a shared device and clear saved browser data when appropriate.

Security

Cloud connections use HTTPS and account-based access controls. Cloud broker API credentials are encrypted at rest with a server-held key.

FolioTracking does not place trades or request withdrawals. Use read-only permissions for broker and exchange API keys wherever the provider offers them.

Contact attachments are stored in a private bucket. Email download links require a private token; admin download links are signed and time-limited. Admin support data is restricted to the FolioTracking administrator.

Analytics and Cookies

PostHog Cloud EU is our analytics processor. By default, including after Decline, we count visits and a few product actions without analytics cookies or browser-stored analytics identifiers. PostHog uses a server-generated, privacy-preserving hash for this counting; we do not create person profiles. Accept enables optional cookie-based analytics, coordinate-only heatmaps and session insights. Session recording is disabled. We do not send portfolio values, symbols, file names, form contents, emails or account identifiers. Page addresses exclude query strings and fragments. Change your choice in Settings > Privacy at any time; withdrawing consent clears analytics storage. Essential consent storage remembers your choice. Questions: support@foliotracking.com.

Browser Storage

Guest portfolios and their local backups are stored in your browser, not in an account database. Clearing browser data removes these local copies; deleting an account removes cloud records separately. The table summarises what is stored and why.

Purpose	Where stored	How long	Consent
Sign-in session	Browser storage	Until sign-out, session expiry, or browser data is cleared. Valid sessions may be renewed.	Strictly necessary when you sign in.
Preferences: theme, currency and sidebar	Browser storage and a sidebar cookie	Until changed, reset, cookie expiry, or browser data is cleared.	Necessary to remember your chosen settings; not used for analytics.
Guest and local portfolio data, including any locally saved broker settings	Browser storage	No automatic expiry; until removed in the app or browser data is cleared.	Necessary to provide local saving and Guest Mode.
Support-message retry queue	Browser storage	No automatic expiry; browser data can be cleared to remove queued copies.	Necessary when you submit a support message that needs a local fallback.
Visit statistics, optional analytics and your choice	Default visit statistics use no analytics cookies or browser-stored analytics identifiers. The essential consent cookie `ft_analytics_consent_v2` and browser choice `foliotracking-analytics-consent-v2` remember your decision. After Accept, PostHog cookies/browser storage (`ph_*`) and random browser/session identifiers support optional analytics.	Consent cookie: 1 year. Browser choices remain until changed or cleared. Optional analytics storage is cleared on withdrawal; session-only storage ends with the session.	Cookie-based analytics, heatmaps and session insights require opt-in. Cookieless counting is the default.

Service Providers

When enabled, Cloudflare Turnstile processes browser and network signals to prevent automated abuse of authentication and contact forms; it is a security check, not analytics.

FolioTracking runs on Replit hosting. Supabase provides account authentication and the database. PostHog Cloud EU processes default cookieless visit statistics and optional analytics after consent. The contact form sends support reports and attachments to the FolioTracking API for storage, and Resend is our email delivery provider. Support emails are sent through Resend's EU (Ireland) region. Resend states that account data, email metadata, logs and API records are stored in the United States; the recipient's email provider may also process email under its own terms. Google is an identity provider when you choose Google sign-in. These providers process information only to provide their respective service to FolioTracking.

No Third-Party Selling

TradingView charts load only after you click “Show live chart”, sharing the selected symbol and browser connection information with TradingView, but not portfolio quantities, transactions or values.

We never sell, rent, or trade your personal or financial data to third parties or advertisers.

Full Data Control and Right to Erasure

You can permanently delete your account at any time by clicking Delete Account in the page footer and confirming. This permanently deletes your account, cloud portfolios, holdings, trades, cash balances, and encrypted broker credentials. Deletion is irreversible. Guest data stored in your browser is separate and must be cleared from that browser.

Contact

For privacy inquiries, data requests, or general support, contact us at support@foliotracking.com.