Privacy notice

Last updated: 11 October 2026. This page is written in plain English. It is not legal advice.

This notice explains what PaceFolio stores about you, why, who else sees it, and how to delete it. The app is a personal tracker. It collects only what it needs to work.

What is stored

• What you type: your plan, holdings, monthly log, settings and currency symbol. These are money figures you enter yourself.
• Your chat: questions you ask in the chat and the answers. They are kept for 7 days, then deleted automatically.
• Keys you add: a Claude key and optional broker keys. They are encrypted before they are saved and are never shown again.
• Sign-in security: a scrambled (hashed) password, your two-step secret (encrypted), hashed backup codes, and a log of the last 40 sign-in attempts. The log holds the time, the result and a short scrambled piece of your network address. It does not hold your real address.
• The waitlist (waitlist.pacefolio.org): only your email address and the date you joined. It is used once, to tell you when your place opens, and it is kept in the same Supabase database. Ask the owner to remove it and it will be deleted.
• Your account (when this copy has sign-up): your email address, and the date you joined. Supabase, the account service we use, keeps your email and a scrambled copy of your password.
• When you were last here: one time stamp, updated while you use the app, and an on/off mark the owner can set on your account. The owner uses it only to see how many people are around. It does not record what you do or which pages you open.
• Share links: if you make a read-only link, a scrambled copy of the link, its name and its end date are kept. Anyone who has the link can see your holdings and the amounts you logged until it ends or you remove it. They cannot change anything and cannot see your plan, salary, keys or chat.
• Research updates: if you press Update, the new research figures are saved so they stay after a reload.

The app does not ask for your name, phone number, bank login or date of birth. On a copy with accounts it asks for an email address to sign you in. It has no advertising, no analytics and no tracking. The owner can see how many people have accounts and how many are around, plus each account's email, join date and last-seen time. The owner cannot see your holdings, amounts or settings from the owner dashboard.

Why it is stored

To show your figures back to you on any device, to keep you signed in, and to keep your account safe from guessing attacks. Nothing is used for marketing or sold.

Who else sees it

• Hosting: the app runs on Netlify. On a copy with accounts, your figures and account are stored with Supabase. Both keep the data on their servers for us.
• Emails: confirmation and password-reset emails are sent through an email service connected to Supabase.
• Price sources: to get prices, the server asks Yahoo Finance, Google Finance, Nasdaq.com and the Nigerian Exchange (and African Financial Markets as a backup) for the share symbols on your list. Only the symbols are sent, never your amounts or your identity.
• Claude (Anthropic): only if you add a Claude key. Then the questions you ask, and the figures on the screen you ask about, are sent to Anthropic to get an answer. If you never add a key, nothing is sent.
• Password leak check: when you choose a new password, a short scrambled piece (5 characters of a hash) is sent to haveibeenpwned.com to see whether the password appeared in a known leak. The password itself never leaves the server.
• Trading 212 or Alpaca: only if you connect one, using a read-only key you create. The app reads your positions to show them.

How long it is kept

Your figures stay until you delete them. Chat is deleted after 7 days. The sign-in log keeps the last 40 attempts. You can delete everything yourself at any time (see below).

Your rights and how to use them

• See and take your data: the Data page exports everything to a file.
• Correct it: change any figure in the app.
• Delete it: Settings, then "Delete all my data" (or "Delete my account" on a copy with accounts). It removes your figures, chat, keys, research updates and, with accounts, your email and sign-in, straight away. You can also ask the owner (details below) to delete it.
• Complain: you can contact the data protection authority where you live, for example the Nigeria Data Protection Commission, or the ICO in the UK.

Children

This app is for people aged 18 and over. It does not knowingly collect information from anyone under 18. If you think a child has used it, contact the owner and the data will be deleted.

Security

Connections use HTTPS. The sign-in cookie cannot be read by page scripts. Sign-in has two-step codes, lockouts after wrong tries and a check question. No system is perfectly safe, so use a strong, unique password.

Changes

If this notice changes in a way that matters, the date at the top changes.

Who runs this app

Loading the owner's details…