Privacy policy.

Short version: we store what's needed to run your net-worth tracker, encrypt sensitive financial fields at rest, and never sell or rent your data. We share it only with the service providers listed below. No ad networks. Product analytics (PostHog EU) run only if you accept them in the cookie banner.

Who's the data controller

Millefold is operated by Paulius Reutas from Lithuania. Contact: hello@millefold.com.

Millefold is built and operated as a solo project. Reach the controller directly using the email above. There is currently no designated Data Protection Officer (not required at this scale, but this section will be updated if/when one is appointed).

What we collect

• Account: your email and (if you used Google) the basic Google profile fields — name and avatar URL.
• Portfolio: what you tell us about assets and liabilities — name, category, value, currency, optional notes — plus pies, wishlist items and transactions you import from a broker.
• Snapshots: a daily snapshot of your totals so the history chart works.
• Public profile (only if you turn it on):profiles are private by default. If you make yours public, anyone with the link can see your slug, display name, level, optional bio, avatar and badges, and it's listed on the Millefold leaderboard. Public profiles aren't in our sitemap and ask search engines not to index them. No amounts, balances or holdings are shown, and the activity feed never includes your discipline score.
• Social + support: who you follow, your activity feed entries (such as level-ups) and any problem reports you send.
• Choices you make: your cookie choice (with a random ID, the notice version and a timestamp), the Terms version you accepted and when, whether the weekly summary email is on, and push-notification subscriptions if you enable them.
• Imports: broker CSV files are parsed server-side then discarded — never stored on disk.
• Logs: our host, Cloudflare, keeps request logs (for example URL, status, timing and network details such as IP address) for up to 7 days for debugging. No request bodies.

What we encrypt at rest

Sensitive financial fields — asset and liability names, values, cost basis, income, payments, interest rates and notes, wishlist items, pie names and descriptions, and snapshot totals and breakdowns — are encrypted with AES-256-GCM before they reach the database, using a per-user key derived from a master key. The master key is held by the operator as a server secret at Cloudflare, separate from the database at Supabase. The server decrypts your data to show it to you, to build your data export, and to send the weekly summary email if you turn it on. This is encryption at rest, not zero-knowledge encryption: it protects the stored data, but the operator holds the key. Other data — for example categories, currencies, imported broker transactions, your profile and your settings — is not encrypted this way.

What we don't collect

• No device fingerprinting, no advertising or cross-site trackers.
• No click autocapture, heatmaps, scroll tracking or session recordings. If you accept analytics, PostHog receives the pages you view (with secret tokens and profile handles removed from URLs), errors that happen in your browser, a handful of named events (for example "CSV import completed", "profile updated" or "sign-in link requested") and technical details such as browser, device type, screen size and referring site — never your email, name or account ID.
• No advertising IDs. We don't sell to advertisers — ever.
• Server-side error monitoring (PostHog EU) records errors without personal data: no email, no IP address, and secret tokens removed from URLs.

Legal basis we rely on (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — for the core service (signing you in, storing what you ask us to store, running the features you opted into).
• Legitimate interest (Art. 6(1)(f)) — for security logging, error capture, and minimal anti-abuse signals. Balanced against your privacy.
• Consent (Art. 6(1)(a)) — for product analytics cookies, newsletter emails, the weekly summary email and web-push notifications. Withdraw any time: cookie settings, the unsubscribe link in each email, or the switches in Settings.

Where it lives + sub-processors

• Supabase — database + auth, EU region (Ireland). supabase.com/privacy
• Cloudflare — hosting (Workers) + DNS + CDN, including short-lived request logs. cloudflare.com/privacypolicy
• Brevo — transactional + newsletter email, and the weekly summary email if you turn it on (EU-based, Paris). brevo.com/legal/privacypolicy
• PostHog EU— product analytics only after you click "Accept" in the cookie banner; server-side error monitoring and security logs without email addresses (IP addresses in security logs are shortened). EU region (Frankfurt). Like any web service, PostHog receives your IP address when your browser sends it analytics and may use it to estimate your approximate location. posthog.com/privacy
• Google — only if you sign in with Google. Standard OAuth profile read.
• Browser push services— only if you enable push notifications. Your browser's push service (for example Google, Mozilla or Apple) receives your subscription endpoint and delivers the notification content, which is encrypted.

Market data sources (not processors — they receive no personal data): our servers request stock and crypto prices from Yahoo Finance first, with CoinGecko as the fallback for crypto (Data provided by CoinGecko) and Stooq as the fallback for stocks, and exchange rates from the European Central Bank via Frankfurter. They receive only ticker symbols, coin IDs or currency codes.

International data transfers

Our primary data store and email are EU-resident. Some processors — Cloudflare, Google, PostHog, and browser push services — operate globally and may handle data outside the EEA. Where this happens, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and the processor's own safeguards. We do not transfer data to jurisdictions without an adequacy decision or SCCs in place.

How long we keep your data

• Account data:while your account is active. Delete your account in Settings and your sign-in account and every row tied to it are removed from the live database right away, together with your avatar files, other people's follows of your profile and their "started following" activity entries about it, and any waitlist entry for your email; invite attributions to your profile are cleared.
• Backups:copies of deleted data can remain in Supabase's database backups until those backups expire on Supabase's backup schedule.
• Hosting logs: kept by Cloudflare for up to 7 days.
• Email delivery logs:kept by Brevo under its own retention policy. Our own error logs for failed sends record only the recipient's email domain, never the full address.
• Analytics, error and security logs:kept in PostHog EU under the data-retention period of our PostHog plan. Security logs (honeypot / scanner-probe hits, admin-page access attempts, sign-in attempts with a trap address) contain a shortened IP address, browser user agent, country, network (ASN), page path and referrer — no email or account ID. Analytics events aren't linked to your account, so deleting your account doesn't remove them.
• Consent records: kept as proof of the choices made; records linked to your account are deleted with it.

Your rights (EU/UK GDPR + equivalents)

• Access & export a JSON file of your account data, any time, from Settings.
• Delete your account + all data from Settings. Irreversible.
• Correct anything we have on you by editing it in the app, or by emailing us.
• Object or restrictprocessing done on legitimate-interest basis — email us and we'll review.
• Unsubscribe from the newsletter via the link in any newsletter email, or by emailing us. Turn off the weekly summary with the one-click link in any summary email or the switch in Settings. Sign-in emails you request keep working.
• Change your cookie choice any time: Cookie settings.
• Complain to a supervisory authority — the Lithuanian State Data Protection Inspectorate (VDAI), or the data protection authority where you live. You do not need to contact us first.

Cookies + storage

Nothing is stored in your browser when you first open the site. These are set only when you do the thing that needs them, and none of them track you across other sites:

• Sign-in (Supabase): sb-…-auth-token cookies keep you signed in (set when you sign in, removed when you sign out; up to 400 days). During sign-in, a short-lived sb-…-auth-token-code-verifier cookie (email link) or __google_oauth cookie (Google, 10 minutes) protects the login flow.
• Your cookie choice: mf_consent stores Accept or Reject, the notice version and a random ID. Set only when you click one of the buttons; 180 days.
• Preferences: lc.theme (cookie + local storage) for light/dark mode, lc.mode for decade mode and lc for language — each set only when you change that setting; 1 year.
• Push notifications: a service worker (/sw.js) and push subscription, registered only when you enable push in Settings.

Analytics — only after you click "Accept": PostHog stores a random ID and session information in a ph_…_posthog cookie (1 year) and in ph_… entries in local storage and session storage, and may store its opt-in state as __ph_opt_in_out_…in local storage. If you reject — or later switch to reject — PostHog doesn't run and these entries are deleted from your browser.

Change cookie settings

Children

Millefold is for adults managing their own finances: you must be 18 or older to use it. We don't knowingly collect data from anyone under 18. If you believe a minor has signed up, email us and we'll delete the account.

Changes

When this policy changes, we update this page and the "Last updated" date at the top. For material changes, signed-in users are asked in the app to review and accept the current Terms and Privacy policy before continuing.

Contact

Questions, complaints, takedown requests, data-subject requests: hello@millefold.com.