Last updated 13 August 2026
Pfoliolio tracks investment holdings across your accounts. It is a tracker, not a brokerage: it executes no trades and gives no financial advice. This policy describes exactly what leaves your device, where it goes, and how long it is kept.
The app has one server, bd-pfolio.fly.dev, operated by the
developer on Fly.io. All transport is HTTPS.
When you sign in, the app sends your Apple identity token. We keep Apple's per-app user identifier and, on first sign-in only, the email address Apple supplies. After that the app authenticates with a random session token stored in your device Keychain; the server holds only a SHA-256 hash of it. Sessions expire after 90 days and are revoked server-side when you sign out.
Your holdings travel server-to-server, not from your device. The server retrieves accounts, securities, and holdings from Plaid using a read-only access token.
You enter your brokerage credentials on Plaid's own hosted page in the browser. Neither the app nor our server ever sees your brokerage username or password. Read-only means the connection cannot trade, transfer, or withdraw — that is a property of the Plaid product scope, not a promise we are making on its behalf.
From your device, the server receives what you type: questions to the assistant, manually entered holdings, classification corrections, account nicknames, and allocation targets.
When you ask a question, our server sends to Anthropic's API: your question, up to the last six turns of your conversation, and a JSON snapshot of the same portfolio data the dashboard shows — tickers, security names, dollar values, account names and types, institution names, and the last-four account mask.
It does not include your name, email, Apple identifier, or any Plaid token.
The model runs on Anthropic's servers. Nothing about the assistant is on-device, and we do not claim otherwise. Under the Anthropic commercial API terms this app uses, submitted content is not used to train Anthropic's models.
The app contains no analytics, advertising, or tracking SDKs. Nothing is collected for advertising. Nothing is sold, and nothing is shared beyond the two service providers named here: Plaid and Anthropic.
Your data is not used to train any model — ours (we have none) or Anthropic's (excluded under their commercial API terms). It is not used for advertising or shared for tracking, in the App Privacy sense or any other.
Today the assistant uses one provider: Anthropic's Claude, via its commercial API, exactly as described above.
A user-selectable provider setting is planned, with three options and three different data paths. The app will state the active one plainly:
Until a provider option ships in a released build, the statement above stands: the assistant is Claude, server-side.