Privacy Policy
What we collect
Without an account, your settings, watchlists, simulator portfolios and alerts stay on your device. If you create an account we store: your email address, display name, an optional profile photo, and a salted password hash (or your Google / Apple account identifier if you sign in with them). If you are signed in we also store the data you sync across devices (settings, watchlists, simulator portfolios, alert preferences). If you connect an exchange or broker we store the label you choose and the API credentials you provide, encrypted. Our servers also process technical data such as your IP address to keep the service secure and to limit abuse.
How we use it
To run the app: sign you in, sync your data between your devices, show the balances and holdings of the accounts you connect, send verification and password-reset emails, and protect the service against abuse. We do not sell your data, do not show third-party ads and do not build advertising profiles.
Connected accounts (read-only)
Tokfolio only reads balances, holdings and open orders of the accounts you connect. It does not place, modify or cancel orders and cannot withdraw funds. Create read-only API keys at your exchange or broker, without trading or withdrawal permissions. Credentials are encrypted with AES-256-GCM on our server and are never sent back to your device. Disconnecting an account deletes its stored credentials.
Who we share data with
We do not share your personal data with advertisers. We use service providers to operate Tokfolio: Google Cloud (hosting), Google and Apple (optional sign-in), and an email delivery provider (verification codes). Market data, news and on-chain information come from third-party providers such as Binance, CoinGecko, Yahoo Finance, Twelve Data, Finnhub, CryptoCompare, alternative.me, StockTwits, X, Blockchair, Etherscan and DefiLlama; their servers may see your IP address when your device or our server requests data. Charts are provided by TradingView. We may disclose data if the law requires it.
Retention and deletion
You can delete your account at any time: in the app under Account > Delete account, or on the web at tokfolio.com/delete-account without reinstalling the app. Deletion permanently removes your profile, sessions, synced data and stored exchange credentials. Disconnecting a single account removes just its credentials.
Security
Traffic is encrypted with HTTPS. Passwords are stored as salted hashes, session tokens as hashes and exchange credentials encrypted. Fingerprint / face login is handled by your device: Tokfolio never receives your biometric data.
Children
Tokfolio is not directed to children under 16 and we do not knowingly collect their personal data.
Your rights and changes
Depending on where you live (for example in the EU/EEA under the GDPR) you can ask to access, correct, export or delete your data, or object to its processing. Use the deletion options above or contact us. We will post changes to this policy on this page and update the date above.
Delete account
Contact
Questions about this page? Use the Contact page.