1. Who we are

BullionFolio (“BullionFolio”, “we”, “us”) operates the marketing site at bullionfolio.com and the web application at bullionfolio.com/app (together, the “Service”). We are the controller of the personal information described in this policy. You can contact us at hello@bullionfolio.com.

This policy applies to visitors, trial users, and subscribers. It does not apply to third-party sites we link to, including vaulting providers, payment pages, and identity providers.

2. Information we collect

We collect information in three ways: you give it to us, it is generated as you use the Service, and third parties provide it.

Account information

• Identity and contact details — your name and email address, plus the date your email was verified.
• Password — stored only as a bcrypt hash. We never store your plaintext password. Your password is also used in your browser to derive an encryption key; that key is never sent to us.
• OAuth identifiers — if you sign in with Google, GitHub, or Facebook, we receive your name, email address, and a provider identifier. We do not receive your password for those services. Which providers are enabled depends on the deployment.
• Preferences — display currency, weight unit, and similar settings. These are stored as ordinary account data, not encrypted transaction payloads.

Portfolio records

• Encrypted transaction payloads — when you save a transaction, your browser encrypts the record with AES-256-GCM before sending it. We store the ciphertext, its IV and authentication tag, and an optional keyed HMAC used to detect duplicate BullionVault deal IDs. We do not receive readable dates, metals, weights, prices, premiums, commissions, lots, vaults, or locations.
• Wrapped key material — we store a salt and a wrapped copy of your random data-encryption key, plus a recovery salt and a second wrapped copy for your 24-word recovery phrase. We do not receive your password-derived key or the unwrapped data key. The data key exists only in your browser’s memory while your vault is unlocked.
• Metadata — ordinary database fields needed to operate the Service, such as row identifiers and record timestamps. This metadata does not reveal the contents of your transactions.

Imported files

BullionVault PDFs, BullionVault accounting CSVs, and generic CSVs are parsed in your browser. The raw files never leave your device. Only the normalised, encrypted rows you choose to import are sent to the Service.

Billing information

Payments and subscriptions are processed by Paddle. We receive and store a Paddle customer identifier, subscription identifier, plan interval, status, trial dates, renewal dates, and limited payment-method metadata (for example the card brand and last four digits where provided). We do not receive or store full card numbers. Paddle handles payment details under its own privacy policy.

Information generated by your use

• Session information — a random bearer token stored in your browser’s local storage and a corresponding session row on our server with a seven-day lifetime.
• Rate-limiting data — your IP address and, on some endpoints, your email address are processed temporarily in memory to limit abuse. This state is not written to our database and is lost when the server restarts.
• Operational logs — diagnostic and error messages. We do not deliberately log transaction contents or passwords. Like most web servers, our infrastructure may record request metadata such as IP address, time, and requested path for security and reliability.
• Analytics events — if analytics is enabled, Google Analytics receives page views and interaction events such as sign-in, registration, feature navigation, and whether an estimator was opened. Analytics events do not include your transaction amounts, weights, prices, or other portfolio contents.

Information from third parties

• Identity providers — Google, GitHub, or Facebook when you choose social sign-in.
• Paddle — subscription and payment-method status.
• Market data providers — gold, silver, currency, and Bitcoin market data. This relates to markets, not to you.

We do not ask for special category data, and we ask that you do not enter third-party bank account numbers or other sensitive identifiers into free-text fields.

3. How we use your information

• To create and secure your account, verify your email, authenticate you, and keep you signed in;
• To provide the portfolio: storing encrypted records, returning them to your browser, and supporting imports and preferences;
• To manage trials, subscriptions, billing status, and access to the Service;
• To send service emails such as verification, password reset, security notices, trial reminders, and billing reminders;
• To detect, prevent, and respond to abuse, fraud, duplicate accounts, and technical problems, including rate limiting;
• To understand how the marketing site and app are used in aggregate, so we can improve them;
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for targeted advertising.

4. Cookies, analytics & consent

We use browser storage and a small number of cookies. The marketing site loads analytics through Google Tag Manager under Google Consent Mode v2: all four consent signals — analytics_storage, ad_storage, ad_user_data, and ad_personalization — default to denied. Only analytics_storage can be granted, and only if you choose “Allow analytics”. The advertising signals remain denied. You can reopen the choice via “Cookie settings” in the footer.

• Essential local storage — token (your session token), bf-theme (light or dark theme), liquidationCostPct (your liquidation-cost slider), and bf-consent (your analytics choice).
• Transient session storage — auth_notice, used once to show a sign-in message.
• Analytics cookies — if you allow analytics, Google Analytics may set _ga and related cookies to distinguish visitors and count page views. Analytics is served through Google Tag Manager. We do not enable Google advertising or remarketing features.
• Third-party embeds — the marketing site embeds a BullionVault market chart, which may set BullionVault cookies. Paddle Checkout and the Paddle customer portal may set Paddle cookies when you open them. OAuth sign-in takes place on the provider’s site under its own cookies.

Blocking optional analytics does not affect your ability to use the Service. You can also block or delete cookies through your browser settings and opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on.

5. Legal bases for processing

Where GDPR, UK GDPR, or similar law applies, we rely on:

• Performance of a contract — to provide the Service, manage your account, and administer your subscription;
• Legitimate interests — to keep the Service secure, prevent abuse, maintain reliability, and improve the product, in a way that does not override your rights;
• Consent — for optional analytics, and where required for optional communications. You may withdraw consent at any time; withdrawal does not affect earlier lawful processing; and
• Legal obligation — to retain billing records, respond to lawful requests, or establish and defend legal claims.

6. Sharing & processors

We share personal information only with the categories of recipients below, and only as needed for them to provide their service to us:

• Hosting and infrastructure — the server and PostgreSQL database that run the Service;
• Email delivery — our transactional email provider (Fastmail), which sends verification, reset, reminder, and backup emails;
• Payments — Paddle, which processes checkout, subscriptions, payment methods, and billing events;
• Analytics — Google Analytics, operated by Google LLC, for aggregate usage measurement;
• Identity providers — Google, GitHub, and Facebook, if you use social sign-in; and
• Authorities — where we are legally compelled to disclose information, or where disclosure is necessary to protect rights, safety, or property.

Market data providers receive no personal information about you. We do not sell, rent, or trade your data.

7. International transfers

The Service and its database are hosted with our infrastructure provider. Our email, payment, analytics, and identity providers may process data in other countries, including the United States. Where personal data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s adequacy commitments, as applicable.

8. Data retention

• Account, preferences, and encrypted portfolio records — kept while your account is active, and deleted or anonymised within a reasonable period after you ask us to close it, subject to legal, billing, and backup retention needs;
• Sessions — expire after seven days and are deleted when they lapse or when you sign out;
• Rate-limiting state — held in memory only and lost on server restart;
• Unverified accounts — deleted automatically if email verification is not completed within seven days; a reminder is sent at six days;
• Billing records — retained as required for tax, accounting, dispute, and fraud-prevention purposes;
• Correspondence — kept for as long as needed to resolve your query and for a reasonable period afterwards; and
• Backups — when backup cron is enabled, a daily compressed SQL backup of account, OAuth, subscription, webhook, and encrypted transaction rows is emailed to the operator. Transaction contents remain encrypted. Backups are deleted or rotated on a reasonable schedule; an emailed copy may remain until it is deleted from the mailbox.

Because transaction contents are encrypted, deleting a transaction row removes the ciphertext but does not require us to read the deleted record.

9. Security & encryption

• All traffic between your browser and the Service is encrypted with HTTPS / TLS;
• Passwords are bcrypt-hashed; they are never stored in plaintext;
• Session tokens are random, stored server-side with an expiry, and never placed in URLs;
• Transaction payloads are encrypted in your browser with AES-256-GCM. Your password is stretched with PBKDF2-SHA256 at 600,000 iterations to unwrap a random data key; the unwrapped key is held only in memory while you are unlocked;
• The server stores ciphertext and wrapped key copies, not readable transaction contents or your password-derived key;
• A 24-word BIP-39 recovery phrase wraps a second copy of the data key. Regenerating the phrase invalidates the previous one;
• Authentication, registration, verification, and password-reset endpoints are rate limited; and
• Database access is restricted to the application.

Scope and limits. Encryption covers transaction payloads. Account details, email, preferences, billing status, and market data are ordinary server-side data. As with any encryption delivered through a web browser, a compromised device or a malicious frontend bundle could capture your password or data key while the vault is unlocked. If you lose both your password and your recovery phrase, the encrypted transaction history cannot be recovered; the only option is a wipe.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data, subject to legal retention obligations;
• receive a portable copy of your data;
• object to, or restrict, certain processing;
• withdraw consent at any time; and
• lodge a complaint with your local data protection authority.

Residents of California and other US states with comprehensive privacy laws may have similar rights to know, delete, correct, and opt out of “sale” or “sharing”. We do not sell or share personal information as those terms are defined there, and we do not use it for cross-context behavioural advertising.

There is no self-service data export at present. If you request a copy, we can provide your account information and the encrypted transaction rows we hold, but we cannot decrypt those rows for you. You can also copy records from the app before closing your account. To exercise any right, email hello@bullionfolio.com from the address registered to your account. We may ask you to verify your identity. We will respond within the period required by law, normally 30 days.

11. Children

The Service is intended for adults. It is not directed at children under 18, and we do not knowingly collect their data. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Third-party links & embeds

The Service links to external sites and embeds third-party content, including the BullionVault market chart on the marketing site and Paddle Checkout or portal pages for billing. Those services have their own privacy practices, which we do not control. We encourage you to read their policies before providing information to them.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be signalled by updating the “Last updated” date above and, where appropriate, by email or a notice in the Service. If a change requires consent, we will ask for it separately. Continued use after a change takes effect means you accept the revised policy.

14. Contact

For questions, requests, or complaints about privacy, email hello@bullionfolio.com or use the contact form. See also our Terms of Service and Refund Policy.