This Privacy Policy explains how FolioX Tracker (operated by FolioX Tracker, "we", "us") collects, uses, and protects your personal information. We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where applicable, the GDPR.
1. What we collect
When you create an account and use the service, we collect:
- Account info: name, email address, password (hashed; we never store plaintext), and — if you sign in with Google — your Google account ID, profile name, email, and profile picture URL.
- Portfolio data you provide: profiles, asset tickers, transactions (date, action, quantity, price), allocation targets, broker/exchange labels, and any optional notes you enter.
- Imported data: contents of broker statements (CMC Markets, Stake, Swyftx, Independent Reserve) you upload.
- Usage info: IP address, browser/user-agent, and session timestamps stored in our session store for security and abuse prevention.
We do not collect bank account numbers, brokerage credentials, or government identifiers.
2. How we use it
- To provide the core service (display your holdings, calculate drift, send alerts).
- To send transactional emails — verification, password resets, and rebalance notifications you have enabled.
- To detect and prevent fraud, abuse, or security incidents.
- To understand which features are used so we can improve the product, via a small set of first-party, anonymised usage events (for example, that a transaction was logged or a file imported). These events never include dollar amounts, holdings, or free text, and you can opt out under Settings → Privacy & Analytics.
- To comply with legal obligations.
We do not sell your personal information, and we do not use your data to train machine-learning models.
3. Third parties we share with
We share the minimum necessary information with:
- Turso (libSQL) — hosts our database. Your portfolio data and account record are stored there.
- Vercel — hosts the application. Server logs may temporarily contain IP addresses and request metadata.
- Vercel Web Analytics — privacy-friendly usage analytics. It counts page views and referrers using anonymised, aggregated data (page path, referrer, approximate country, device type) and does not use cookies, persistent identifiers, or cross-site tracking. It does not receive your portfolio data, holdings, or transactions.
- Resend — sends transactional email (verification, password reset, alerts). Resend processes your email address and the email content.
- Sentry — error monitoring. When the app encounters a technical error, Sentry receives a diagnostic report (error type, stack trace, page URL, browser). We configure it to exclude your portfolio data and personal information — it does not receive your holdings, transactions, or email content.
- Google— authenticates you when you choose "Continue with Google." Subject to Google's privacy policy.
- Yahoo Finance — provides market prices. Yahoo does not receive any of your personal data; we query public symbols only.
We do not use third-party advertising, ad networks, or cross-site tracking, and we set no marketing cookies. For usage measurement we rely on our own first-party analytics (anonymised events stored in our own database, Turso above) together with Vercel Web Analytics(described above), which is cookieless and does not identify you. You can opt out of our first-party analytics at any time under Settings → Privacy & Analytics; Vercel Web Analytics collects no personal identifiers, so there is nothing user-specific to opt out of.
4. Cookies
We use a single essential cookie to keep you signed in (Better Auth session cookie). It is HTTP-only, Secure in production, and SameSite=Lax. We do not use marketing or cross-site tracking cookies.
5. Where your data lives
Our database is hosted by Turso on AWS (primary region: ap-northeast-1, Tokyo). Our application is hosted by Vercel (edge and serverless functions run in the region closest to the request). Data may be processed in countries other than your own (including Japan and the United States). By using the service you consent to the transfer of your information to those locations.
6. How long we keep it
We retain your account and portfolio data for as long as your account is active. When you delete your account from Settings, your profiles, assets, transactions, prices, allocation targets, and account record are erased from our database immediately.
Server logs (request metadata, IP addresses) are retained for up to 30 days for security and debugging, then automatically purged. Backups may persist for up to 30 days before being overwritten.
7. Your rights
You can, at any time:
- Access and export your data — Settings → Danger Zone → Export downloads a JSON copy of everything we hold about you.
- Correct inaccurate information — edit your profiles, transactions, and account email directly in the app.
- Delete your account and all associated data — Settings → Danger Zone → Delete account.
- Withdraw consent for marketing emails — disable notifications in Settings (transactional emails like password resets cannot be disabled while your account is active).
- Complain to a privacy regulator. In Australia that is the Office of the Australian Information Commissioner (oaic.gov.au).
8. Security
Passwords are hashed with scrypt (legacy accounts may still use bcrypt; both are one-way). Sessions are signed and stored server-side. Connections to the application are encrypted with HTTPS. No system is perfectly secure — please choose a strong, unique password and notify us at hello@folioxtracker.com if you suspect unauthorised access.
9. Children
The service is not intended for children under 18, and we do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it.
10. Changes
We may update this policy from time to time. Material changes will be notified via email or an in-app notice at least 7 days before they take effect.
11. Contact
For privacy questions or to exercise the rights above, email hello@folioxtracker.com.