This Privacy Policy explains how FolioX Tracker (operated by FolioX Tracker, "we", "us") collects, uses, and protects your personal information. We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where applicable, the GDPR.
1. What we collect
When you create an account and use the service, we collect:
- Account info: name, email address, password (hashed; we never store plaintext), and — if you sign in with Google — your Google account ID, profile name, email, and profile picture URL.
- Portfolio data you provide: profiles, asset tickers, transactions (date, action, quantity, price), allocation targets, broker/exchange labels, and any optional notes you enter.
- Imported data: contents of broker statements (CMC Markets, Stake, Swyftx, Independent Reserve) you upload.
- Usage info: IP address, browser/user-agent, and session timestamps stored in our session store for security and abuse prevention.
We do not collect bank account numbers, brokerage credentials, or government identifiers.
2. How we use it
- To provide the core service (display your holdings, calculate drift, send alerts).
- To send transactional emails — verification, password resets, and rebalance notifications you have enabled.
- To detect and prevent fraud, abuse, or security incidents.
- To understand which features are used so we can improve the product, via a small set of first-party, anonymised usage events (for example, that a transaction was logged or a file imported). These events never include dollar amounts, holdings, or free text, and you can opt out under Settings → Privacy & Analytics.
- To comply with legal obligations.
We do not sell your personal information, and we do not use your data to train machine-learning models.
3. Third parties we share with
We share the minimum necessary information with:
- Turso (libSQL) — hosts our database. Your portfolio data and account record are stored there.
- Vercel — hosts the application. Server logs may temporarily contain IP addresses and request metadata.
- Resend — sends transactional email (verification, password reset, alerts). Resend processes your email address and the email content.
- Google— authenticates you when you choose "Continue with Google." Subject to Google's privacy policy.
- Yahoo Finance — provides market prices. Yahoo does not receive any of your personal data; we query public symbols only.
We do not use third-party advertising, tracking pixels, or third-party analytics SDKs. Product-usage analytics are first-party only— anonymised events are stored in our own database (Turso, above) and never shared with an analytics vendor. You can opt out at any time under Settings → Privacy & Analytics.
4. Cookies
We use a single essential cookie to keep you signed in (Better Auth session cookie). It is HTTP-only, Secure in production, and SameSite=Lax. We do not use marketing or cross-site tracking cookies.
5. Where your data lives
Our database is hosted by Turso on AWS (primary region: ap-northeast-1, Tokyo). Our application is hosted by Vercel (edge and serverless functions run in the region closest to the request). Data may be processed in countries other than your own (including Japan and the United States). By using the service you consent to the transfer of your information to those locations.
6. How long we keep it
We retain your account and portfolio data for as long as your account is active. When you delete your account from Settings, your profiles, assets, transactions, prices, allocation targets, and account record are erased from our database immediately.
Server logs (request metadata, IP addresses) are retained for up to 30 days for security and debugging, then automatically purged. Backups may persist for up to 30 days before being overwritten.
7. Your rights
You can, at any time:
- Access and export your data — Settings → Danger Zone → Export downloads a JSON copy of everything we hold about you.
- Correct inaccurate information — edit your profiles, transactions, and account email directly in the app.
- Delete your account and all associated data — Settings → Danger Zone → Delete account.
- Withdraw consent for marketing emails — disable notifications in Settings (transactional emails like password resets cannot be disabled while your account is active).
- Complain to a privacy regulator. In Australia that is the Office of the Australian Information Commissioner (oaic.gov.au).
8. Security
Passwords are hashed with scrypt (legacy accounts may still use bcrypt; both are one-way). Sessions are signed and stored server-side. Connections to the application are encrypted with HTTPS. No system is perfectly secure — please choose a strong, unique password and notify us at hello@folioxtracker.com if you suspect unauthorised access.
9. Children
The service is not intended for children under 18, and we do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it.
10. Changes
We may update this policy from time to time. Material changes will be notified via email or an in-app notice at least 7 days before they take effect.
11. Contact
For privacy questions or to exercise the rights above, email hello@folioxtracker.com.