Privacy

What My Portfolio Tracker knows about you, where it keeps it and for how long. The short version first, then all of it.

In short. The app keeps your email and the accounts, transactions and targets you enter. It never asks for your bank or broker login, shows no ads, sells no data and doesn't track you across apps and websites. Portfolio data lives on a server in Italy; sign-in goes through Google's Firebase. You can download a copy of your data and delete everything from the app.

Who is responsible

The data controller is Marco Cotrufo, who develops the app as a private individual. For any question about your data, write to info@devncode.it.

What data

Your account

Your email address and, if you enter it or share it with Apple, your name.
Your password, which Firebase handles: the app never sees or keeps it.
If you sign in with Apple, the identifier Apple gives the app and the email you choose to share, Apple's hidden one included.

Your portfolio

The accounts, transactions, target allocation and preferences (language, tolerance) you enter.
The files you import from a broker, kept with the import's report.

Technical data

The IP address of requests that fail or are slow, in the server's logs.
An app integrity check (Apple's App Attest, through Firebase App Check), which confirms requests come from the real app.

The app doesn't collect bank logins, phone numbers, location, contacts or advertising identifiers. Today it uses no analytics and no crash reporting: if that changes, this page will say so first.

Why, and on what basis

To provide the service: sign you in, keep your portfolio and do the maths. The basis is our contract with you (GDPR art. 6(1)(b)).
To keep the service secure: error logs, request limits and the app check. The basis is the legitimate interest in protecting the service and its users (art. 6(1)(f)).

Where it lives

Portfolio data and logs: on a server in Italy run by the controller.
Backups: encrypted before they leave the server, on the server's own disk and in Amazon Web Services S3 in Ireland (European Union). Amazon can't read them.
Sign-in: Google's Firebase Authentication processes your email, password, IP address and sign-in times on the controller's behalf. Google may process them outside the European Union, under the EU-US Data Privacy Framework and standard contractual clauses.
Sign in with Apple: if you use it, Apple processes your Apple ID data under its own privacy policy.

For how long

Account and portfolio: for as long as you keep the account. When you delete it, the app deletes the Firebase user and everything you own in the database at once.
Backups: the copies in Ireland expire within 30 days, those on the server within 12 months. They are used only to restore the service after a failure.
Error logs: 30 days.

Your rights

You can ask to access your data, correct it, delete it, restrict its processing, object to processing based on legitimate interest, and receive it in a readable format. Two of these you do yourself, in the app:

A copy of your data: Settings › Profile › Export my data, a zip of CSV files.
Delete everything: Settings › Profile › Delete account.

For the rest, write to info@devncode.it. If you think your data is mishandled, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Children

The app is meant for adults.

Changes

If this policy changes, we update this page and the date below. If something important changes, we tell you in the app too.

Last updated: 17 October 2026