Privacy by design
What stays private, what's public only if you opt in, and what you control. Analytics only with your consent, no data sales, no Plaid.
Privacy by design
The product is built so that your financial data is never publicly reachable. Sensitive financial fields are also encrypted at rest — but the key is held by the operator, so Millefold is not zero-knowledge: the server decrypts your data to show it to you and to send the optional weekly summary email. The technical side is in encryption at rest. This page covers the policy side: what we keep private, what we expose, and what controls you have.
What's private
- Every asset value
- Every liability principal + APR + payment
- Every snapshot (net-worth history)
- Every imported transaction
- Your wishlist and pies
Row-level security in the database limits these rows to your own account. Your email, country, default currency and exact discipline score are never shown on your public profile or the leaderboard.
Millefold's operator runs the database and holds the encryption key, so none of this is a promise that the operator can't see your data.
What's public (only if you turn it on)
Profiles are private by default. If you toggle is_public on /dashboard/profile, anyone with the link can see your profile page and it's listed on the leaderboard. It shows:
- Your slug (the handle in /u/<slug>)
- Your display name
- Your discipline level (not the score)
- Your bio (if you wrote one)
- Your avatar (if you uploaded one)
- Your OG / L11 / L12 badges (if claimed)
- Your member-since date and follower count
Public profile pages and the leaderboard are marked noindex and left out of the sitemap, so search engines are asked not to index them. People who follow you see your level-ups, OG badge and who you start following in their activity feed — never your score or your money.
What we do *not* do
- No Plaid, no bank passwords. Broker imports are CSV-driven. Your bank credentials never touch our servers because we never ask for them.
- No analytics without consent. Product analytics (PostHog, EU region) load only after you click Accept in the cookie banner. Before you choose, or after Reject, nothing is sent to PostHog. We never send your email or another direct identifier to PostHog, and session recording is off. No Segment, no Google Analytics, no Mixpanel. Server-side errors are reported to PostHog EU without personal data.
- No data sales, no ad partners. The product is the workbench. There is no second business model.
Sessions + cookies
Nothing is stored in your browser on your first page load. After that, only:
- Sign-in cookies (Supabase, plus a short-lived one during Google sign-in) — strictly necessary to keep you signed in.
- Your cookie-banner choice — saved in a cookie after you click Accept or Reject.
- Preferences such as theme — saved only when you change them.
- PostHog analytics storage — only if you clicked Accept.
Where the data physically sits
- Database: Supabase, EU region (Ireland). Sensitive financial fields are encrypted at rest — see encryption at rest.
- Web tier: Cloudflare Workers. Pages are rendered — and your data decrypted in memory to show it — on Cloudflare's global network.
- Email: Brevo (EU) sends the optional weekly summary (off by default) and the newsletter if you subscribed. Sign-in codes are sent through Supabase Auth.
- Market data: prices and exchange rates come from public market-data services. They receive ticker symbols and currency codes only — never your personal data.
Supabase and Cloudflare are US-headquartered companies. Your database is stored in the EU, but decryption and page rendering run on Cloudflare's network, so a US company processes your financial data when you use the app.
Want it gone?
/dashboard/settings has a one-click JSON export of your data and account deletion, which removes your sign-in record and everything tied to it and can't be undone. The weekly summary can be turned off in Settings or with the unsubscribe link in the email; the newsletter has an unsubscribe link in every email.
Read more
- Encryption at rest — the technical side: what's encrypted, the key model, and who can decrypt.
- Full privacy policy — the legal version with controller info + your GDPR rights.