Privacy Policy
Last updated: 24 September 2026
Your privacy is central to ChainFolioAI. This policy explains what data we process and why.
1. Who we are
ChainFolioAI is a dashboard for tracking crypto and traditional investments. We are the controller of the data you provide when using the platform.
2. What data we collect
Account data (email and authentication via Supabase), public wallet addresses and read-only API keys you add (by default they stay only in your browser; they are stored on our server, encrypted, only if you choose that option), app preferences and basic technical usage data, including server logs such as IP address, device type and browser, kept for a limited time for security and diagnostics. We never collect private keys or seed phrases.
3. How we use the data
To authenticate your account, aggregate and display your portfolio, compute metrics and improve the service. We do not sell your data.
4. Legal basis (GDPR)
We process data on the basis of performance of the contract (providing the service), your consent and our legitimate interest in maintaining and improving the platform.
5. Sharing with third parties
We use sub-processors to operate: Supabase (authentication and database), Stripe (card payments), Helio/MoonPay (crypto payments, where applicable), Resend (email delivery), Vercel (hosting and cookieless anonymous analytics) and market and on-chain data providers. Each handles only what is needed for its function. We do not report your data to tax authorities or other public bodies, except where legally required: ChainFolioAI is not an exchange or a crypto-asset service provider and is not subject to their reporting duties (DAC8, CARF). Some of these sub-processors may process data outside the European Economic Area (for example, in the US), under appropriate safeguards such as the EU Standard Contractual Clauses.
6. Security and keys
The platform is 100% read-only: we do not custody your funds or access private keys. Data is transmitted over encrypted connections.
7. Your rights
You have the right to access, correct, export and delete your data and to withdraw consent at any time. You can remove wallets and your account directly in the app. You also have the right to lodge a complaint with the competent data protection supervisory authority (in Portugal, the CNPD).
8. Cookies
We use essential cookies to keep you signed in (Supabase authentication) — without them the platform does not work. We also store three first-party cookies, none of them holding any identifier of you: “cfa-lang” (one year) remembers the language you chose; “cfa-src” (30 days) contains only the name of the channel you arrived from and, if any, the campaign (for example “reddit” or “bluesky.exemption”), so we know which outreach works; “cfa-ev” (24 hours) is a technical stamp with the time you loaded a page and a signature of that time, used only so that our usage log accepts events coming from a browser that opened the site and rejects automated submissions — it holds no data about you and cannot follow you across visits. For usage statistics we use Vercel Analytics and our own log of pages visited and of a few steps along the way (for example, using the demo or submitting the sign-up): both record only the page address, the source and the domain of the site you came from (never the full address), with no IP address and nothing that identifies you. We do not use advertising cookies or third-party trackers (Google Analytics, Meta Pixel and the like).
9. AI, Telegram and data on your device
For the AI features we send the model providers (Groq, OpenAI or xAI, depending on availability) your question and a portfolio summary. Wallet addresses are never sent: a stable pseudonym goes instead of the address, used only to tell one wallet from another, and it cannot be turned back into the address. The beta Telegram bot and the internal sign-up notification receive the email, name and note you write. The manual portfolio and, by default, read-only exchange API keys are kept in your browser's local storage (and, if you are signed in, synced encrypted in transit with your account) — they only pass through our servers to read balances and are never stored in plain text. If you choose the “on the server” option, the exchange key is validated and stored encrypted (AES-256-GCM) in our database, with the encryption key held only on the server, so we can refresh balances while the app is closed; you can remove it at any time and it is deleted with the account. In the no-account demo on the home page, the public address you paste is sent to the blockchain data providers for that lookup only and is not stored. The address is kept only in your browser, so you can add it after creating an account.
10. Retention periods and emails
Technical logs (IP, device) and page statistics: up to 90 days. Beta signups (email, name, note, IP): up to 12 months after the beta ends. API usage counters: 24 hours. Account data: as long as the account exists; deleting the account removes it immediately, unless a legal retention duty applies. When you create an account you get, once and the next day, a welcome email with the first step and, if by day 3 you still have no wallet connected, a single reminder (part of the service). Beta emails (welcome, first step, a reminder when you have not signed in for two weeks, end-of-beta notices and the founder offer) are based on your signup request; you can object at any time via the unsubscribe link or by writing to suporte@chainfolioai.com.
11. Contact
For privacy questions, contact us at suporte@chainfolioai.com.