Privacy policy

What data the Portfolio Tracker app processes, why, for how long, and what your rights are.

VERSION OF 13 OCTOBER 2026

This is an English translation. If it differs from the Polish version, the Polish version prevails.

1. Controller

The controller of your personal data is Maksymilian Kolber, e-mail: maksymiliankolber@outlook.com. You can write to this address about anything concerning your personal data. No data protection officer has been appointed.

2. What data we process

1. Account data: e-mail address, password as a bcrypt hash (we never know the password itself), display name, account creation date, whether the e-mail address has been confirmed, and the version and date of your acceptance of the terms. If you sign in with Discord: your Discord account ID, username, e-mail address and profile picture address, which Discord passes on after you approve it on Discord’s page.
2. Data you enter: income, expenses with their descriptions (e.g. shop names from a statement), fixed costs, debts and repayments, investments, cash balances, exchange rates, vehicle data (including the VIN, if you enter it), fill-ups, trading journal entries, backtesting sessions, prop firm accounts and their events, settings, remembered import category rules, and counters of how much of a plan’s limits has been used (the dates of statement imports and the number of descriptions sent for category suggestions).
3. Liquidity+ subscription data: the customer and subscription identifiers in Stripe, the price and billing period, the subscription status, the end of the paid period and whether it has been cancelled. We do not receive card details — you give them directly to Stripe. From Stripe we read only the country that issued the card, to check it matches the region of the price chosen (Terms, section 7.1); if it does not, we note it on the subscription in Stripe. The pricing region is suggested by your browser from your device’s time zone — that is not sent to our server.
4. Weekly review: the text of the latest review, its date, language and the name of the model that wrote it.
5. Demo account: created without an e-mail address. It contains sample data and any changes you make.
6. Notification list: e-mail address, chosen language, sign-up status and dates.
7. Payment reminders: for each browser in which you turn them on — the address its push service gives for delivering notifications to it, the keys the notifications are encrypted with, its time zone, and which reminder was sent and when; for the account — how early the reminders come and what they cover.
8. Technical data: IP address, date and time of the request, the address of the page requested and browser information, recorded in server logs. The IP address is also held briefly in the server’s memory to limit sign-in attempts.

A CSV bank statement is read in your browser and never uploaded. We store only the rows you approve: month, description, amount, currency and category.

3. Purposes and legal bases

• Creating and running your account, storing data, calculations, import and export, signing in with Discord — performance of a contract (Art. 6(1)(b) GDPR).
• Account e-mails, i.e. address confirmation and password reset — performance of a contract (Art. 6(1)(b) GDPR).
• Category suggestions in Liquidity+, which you start with a button on the import review screen — performance of a contract (Art. 6(1)(b) GDPR).
• The weekly review in Liquidity+, which you start with a button on the Overview — performance of a contract (Art. 6(1)(b) GDPR).
• Liquidity+ subscription: concluding and performing the agreement, handling payments, cancellation and withdrawal — performance of a contract (Art. 6(1)(b) GDPR); keeping sales records and issuing bills — a legal obligation under tax law (Art. 6(1)(c) GDPR).
• Payment reminders, which you turn on yourself on each device — performance of a contract (Art. 6(1)(b) GDPR).
• Notification list — your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the link in any message. Withdrawal does not affect the lawfulness of processing before it.
• Security of the Service, preventing abuse, server logs and backups — the controller’s legitimate interest (Art. 6(1)(f) GDPR).
• Evidence of accepting the terms and establishing, exercising or defending legal claims — the controller’s legitimate interest (Art. 6(1)(f) GDPR).

An e-mail address and password, or a Discord sign-in, are required to create an account. Everything else you provide voluntarily.

4. Who receives the data

We do not sell data, pass it to advertisers, or use it for profiling or automated decision-making. Data may reach only:

1. AWHost — the provider of the server the Service runs on (located in Poland), processing data on our behalf.
2. Brevo (Sendinblue SAS, France) — sending e-mails: address confirmations, password resets and notification list messages, on our behalf.
3. Google (Google Ireland Limited) — the Service uses Google Fonts, so your browser connects to Google’s servers, which receive your IP address and browser information.
4. Discord (Discord Inc., USA) — only if you sign in with Discord. You sign in on Discord’s page, and Discord passes us the data described in section 2(a). Discord processes your data as a separate controller under its own privacy policy.
5. Anthropic (Anthropic PBC, USA) — two Liquidity+ features, each only when you start it:
   • category suggestions — we send only transaction descriptions, without amounts, dates, e-mail address or account details; the model may look an unfamiliar name up on the web, and Anthropic performs that search;
   • the weekly review — we send only aggregate figures: total income and spending, the savings rate, spending by category, changes in net worth and debt, and aggregate trading journal statistics (number of trades, result, plan adherence, results by weekday); no descriptions, names, instruments, e-mail address or account details. The model does not use the web for this feature.
   Anthropic processes this data on our behalf and does not use it to train models.
6. Stripe (Stripe Payments Europe, Limited, Ireland) — handling payments for Liquidity+. On the payment page you give Stripe your e-mail address, name and card details. For processing payments Stripe acts on our behalf; for fraud prevention and its obligations under payment services law it acts as a separate controller, under its own privacy policy.
7. The push service of your browser’s maker — Google (Chrome, and Edge on Android), Microsoft (Edge on Windows), Mozilla (Firefox) or Apple (Safari) — only if you turn payment reminders on, to deliver them to your device. The content of a reminder is encrypted so that the push service cannot read it; it receives the delivery address and the time of sending. The push service acts as a separate controller, under its maker’s privacy policy.
8. Public authorities — only where the law requires it.

Instrument prices come from Yahoo Finance, exchange rates for the PIT-38 summary from the National Bank of Poland, and the server’s member count from Discord. No personal data is sent in those requests.

5. Transfers outside the European Economic Area

Transaction descriptions and the weekly review’s aggregate figures sent to Anthropic go to the USA. The transfer relies on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), included in our data processing agreement with Anthropic. Stripe may also process payment data in the USA, under the EU-U.S. Data Privacy Framework or standard contractual clauses. Google may process data in the USA under the EU-U.S. Data Privacy Framework. A browser maker’s push service, which delivers payment reminders, may be located outside the EEA, including the USA; it receives only the delivery address and the time of sending, and the reminder itself is encrypted so that it cannot read it. You can ask the controller for information about these safeguards and a copy of the clauses.

6. How long we keep data

• Account data and your entries — until you delete your account. Deleting removes them from the database immediately, and from backups within 30 days.
• Demo account — deleted automatically after 3 days without use. Before that you can delete it or turn it into an account.
• Subscription data — until you delete your account. Data needed for sales records and bills is kept — in Stripe as well — for 5 years from the end of the calendar year in which the payment was made, as tax law requires.
• Database backups — made every day and kept for 30 days.
• Notification list — until you unsubscribe.
• Payment reminders — a browser’s data until you turn reminders off in it, sign out in it, or its push service reports that it no longer accepts them; the record of which reminder was sent — 60 days.
• Server logs — 14 days.
• IP address in server memory (limiting sign-in attempts) — up to a minute.
• Weekly review — only the latest is kept: a new one replaces the previous one, and it is deleted with the rest of your data when you delete your account.
• Data in your browser’s storage — until you sign out or clear the site’s data in your browser.

7. Browser storage and cookies

The Service uses no cookies and no analytics. It keeps the following in your browser’s local storage: the session token, a copy of your data for working offline, changes not yet sent to the server, and interface preferences such as the language and the month on screen. Storing this is strictly necessary for the service you ask for, so under the Polish Electronic Communications Law it does not require consent.

The Service shows no advertising, on the free plan included. Stripe’s payment page, which you visit to order Liquidity+, may use its own cookies — Stripe’s privacy policy describes them.

8. Your rights

You have the right to:

• access your data and receive a copy — in the App: Preferences → Your data → Download a copy of your data;
• rectification — most data can be corrected directly in the App;
• erasure — Preferences → Your data → Delete account;
• restriction of processing;
• data portability — a copy of your data as JSON, and income and expenses exported as CSV;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of earlier processing;
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority where you live.

For anything you cannot do in the App, write to the controller’s e-mail address. We reply within one month.

9. Security

Connections to the Service are encrypted (HTTPS). Passwords are stored as bcrypt hashes, and payment card details are not stored at all. Access to the server is protected by a firewall and authentication, and one account’s data cannot be reached from another account. The database is backed up every day and backups are kept for 30 days. Backups are encrypted with a key that is not kept on the server, so they cannot be read even with access to it.

10. Changes to this policy

We will announce changes in the App. Significant changes will require renewed acceptance when you sign in. This version is dated 13 October 2026. Compared with the version of 10 October 2026, it adds payment reminders: sections 2, 3, 4, 5 and 6.