Privacy Policy

1 bis. Client-Side End-to-End Encrypted (E2EE) Architecture

GlassFolio is designed from the ground up around the end-to-end encryption (E2EE) paradigm. All your sensitive financial data (transactions, holdings, unit cost basis, tax declarations, goals and private AI API keys) is encrypted directly in your browser memory through the WebCrypto API using AES-256-GCM. Key derivation relies on PBKDF2-SHA256 (600,000 iterations) and HKDF-SHA256.

2. Data Processed

Cloud mode — data we process to run your account:

• Account identity: email address, display name, technical identifier, sign-in method (email or Google).
• Security data: two-factor authentication factors (TOTP, passkeys) and authentication logs kept by Supabase (sign-in dates, IP address, browser).
• Encrypted vault: vault header (salt, derivation parameters) and encrypted envelopes holding your financial data, unreadable on the server side.
• Interface preferences (theme, language) stored locally in your browser.
• Local mode (Docker): none of this data leaves your machine.

3. Purposes and Legal Bases

• Create and manage your account, sync your encrypted vault: performance of the contract formed by the Terms of Use (Art. 6.1.b GDPR).
• Send transactional emails (verification code, confirmation link, security notifications): performance of the contract (Art. 6.1.b).
• Secure the service (strong authentication, abuse limiting, authentication logs): legitimate interest in protecting accounts (Art. 6.1.f).
• Optional anonymous audience measurement (Vercel Web Analytics, cookieless: page views, country, device and browser type): only with your consent (Art. 6.1.a), which you can withdraw at any time. Never loaded in self-hosted mode.
• Comply with legal obligations and handle your rights requests (Art. 6.1.c).
• No automated decision producing legal effects is made; the AI assistant provides non-decisional information.

4. Recipients and Processors

Your data is neither sold nor rented. It is processed by the following technical providers, strictly to operate the service:

5. Server Location and Transfers Outside the European Union

Your account data and encrypted envelopes are stored in the European Union (Supabase, Ireland). Application hosting (Vercel, Dublin) and email delivery (Resend, Ireland) are also configured in the Ireland region; only the site's static files are delivered by a global CDN.

Server location alone does not rule out every transfer, however: Supabase, Vercel, Resend, GitHub and Google are companies established in the United States, whose staff may access data from that country (support, administration). These accesses rely on the EU-US Data Privacy Framework adequacy decision or on the European Commission standard contractual clauses, depending on the provider. Because vault data is end-to-end encrypted in your browser, no provider receives your financial data in clear.

6. External Network Calls & Market Data

To provide live portfolio valuations and AI capabilities, your browser may establish direct network connections to the following endpoints:

• Yahoo Finance & CoinGecko: HTTP requests from your browser (or via the local proxy) for real-time market prices and currency exchange rates (locally cached with a 15-minute TTL). These services receive your IP address and the requested ticker symbols, but no information about your balances, quantities, or transactions.
• User-Configured AI Providers: If you configure a personal API key (OpenAI, Anthropic, Groq, OpenRouter), requests are sent directly from your browser to the selected provider, under its own terms. Alternatively, you can use Ollama locally for 100% offline AI assistance with no data leakage.
• Static resources: Tailwind CSS and all bundle assets are compiled at build time and served strictly from GlassFolio ('self'). No third-party CDN is used for CSS. The Inter font is self-hosted by GlassFolio and calls no Google service.

7. Retention Periods

• Account and encrypted data: kept as long as your account exists, deleted when the account is deleted.
• Unfinished sign-ups (unconfirmed email or vault not created): automatically purged after 24 hours.
• Technical authentication and email-delivery logs: kept by Supabase and Resend for service security, for a limited period set by each provider.
• Backups: after deletion, encrypted copies may remain with the host until the end of their rotation cycle, then are permanently erased.
• Cookie consent choice: 13 months maximum, then asked again.
• Local mode: until you purge the vault or delete the Docker volume.

8. GDPR Rights & Data Portability

In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act, you have full sovereignty over your data. Every request is answered within one month; if there is reasonable doubt about your identity, proof of identity may be requested.

• Right of access and portability (Art. 15 and 20): export a ZIP archive (profile, consent, JSON backup and CSVs) at any time from Settings > Data & Backups. The demo account holds no personal data and cannot be exported.
• Right to rectification (Art. 16): edit your name, email and preferences from Settings > Profile.
• Right to erasure (Art. 17): "Delete my account" in Settings > Data & Backups permanently erases your account, your encrypted data on our servers and the local data on this device (a security confirmation is required). The "Purge vault" action only clears this device.
• Rights to restriction and objection (Art. 18 and 21) and withdrawal of consent (Art. 7): write to privacy@glassfolio.dev or manage your consent in the Cookies tab.
• Directives on what happens to your data after your death: write to privacy@glassfolio.dev.
• Right to lodge a complaint: You have the right to lodge a complaint with the French supervisory authority, the CNIL (Commission Nationale de l'Informatique et des Libertés — www.cnil.fr).

9. Security

Client-side AES-256-GCM encryption, TLS connections, per-user database isolation (Row Level Security), two-factor authentication (TOTP, passkeys) and strengthened confirmation for sensitive actions (export, email change, account deletion). End-to-end encryption means that if you lose both your master password and your recovery key, your data is permanently unrecoverable, including by the publisher.

10. Cookies and Local Storage

GlassFolio uses no tracking cookie. The full inventory of local storage and the management of your consent are in the "Cookies & Storage" tab.

11. Minors

The service is reserved for adults (18 years or older). We do not knowingly collect data from minors; if you believe a minor created an account, write to privacy@glassfolio.dev to have it deleted.

12. Changes to this Policy

This policy may change. The date and version appear at the top of the page; for significant changes, you will be informed in the application.