Privacy Policy

Novafolio is built to need as little of your data as possible. No email or password is required to use it, and there is no advertising or cross-site tracking. This page describes exactly what is stored, where, and why.

Guest mode (not signed in)

Everything stays in your browser. Net-worth history and manually tracked positions live in localStorage on your device; we store nothing about you on our servers. Clearing browser storage erases this data.

When you sign in

Signing in with your wallet (Sign-In With Ethereum) creates an account keyed to your wallet address — that address is the only identifier we hold. We then store, associated with it:

• daily net-worth snapshots (dates and USD totals),
• DeFi positions you track manually,
• subscription state if you buy Pro (plan, status, and Stripe customer/subscription IDs — never card details).

Sessions use a signed, http-only cookie containing your wallet address and an expiry. We never see or store your private keys.

Third parties

• Blockchain RPC— reading balances sends your wallet address to a Base RPC endpoint (Coinbase's or a public one).
• Price & pool data — CoinGecko and DeFiLlama are queried by our server for market-wide data; your address is not sent to them.
• Token detection — your wallet address is sent to Alchemy when an API key is configured, so tokens can be listed across chains. Without that key, Novafolio reads a short list of major tokens from public RPCs instead. Wallet addresses are already public onchain.
• Payments — Stripe processes payments and holds your payment details under its own privacy policy.
• Analytics — if enabled, we use cookie-less, privacy-respecting analytics (Plausible) that counts aggregate page views only; it does not identify you or follow you across sites.

Waitlist

If you join the Pro waitlist we store the email you submit, solely to contact you about Pro. Ask us to delete it at any time.

Retention and deletion

Account data is kept while the account is active. To have your server-side data deleted, contact us via the support pagewith a message signed by the wallet in question, and we'll remove it.

Changes

If our data practices change, this page and its “last updated” date will change with them.