Last updated: October 7, 2026
FolioSum ("we", "us", the "App") is a portfolio tracker for crypto and traditional assets. This policy explains what data the App handles, where it is kept, and what you can delete. We do not sell your personal data and we do not show ads.
What leaves your phone depends on how you use the App. You choose; nothing below is switched on for you without a clear prompt.
On your device (always). Everything you enter. Exchange, brokerage and wallet API keys and secrets are encrypted at rest on the device (Android Keystore / iOS Keychain). If the device's secure storage is unavailable, encryption can fail — treat a lost or compromised phone as exposing what is on it.
In your account, only if you turn the cloud copy on:
Never enter a private key or seed phrase anywhere in FolioSum. FolioSum only needs public wallet addresses and read-only API keys. If you enter secret material anyway, it is entirely at your own risk and we accept no responsibility for it.
Signing in is optional and is handled by Google Firebase Authentication (email and password, Google Sign-In, or Sign in with Apple). For email-and-password accounts we send a verification email and you must open its link before you can sign in. We store your email address (or the relay address Apple provides), a unique user ID, and sign-in metadata that Firebase keeps. We use these to identify your account and attach credit and cloud data to it.
When you top up credit we store an order record (your user ID, amount, payment status, timestamps) and your credit balance. Payments are processed by NOWPayments on their own checkout page; we do not receive or store your wallet, card or other payment credentials. When you delete your account, order records are kept for accounting and legal purposes but are disconnected from your account (the user ID is removed); see section 10.
If you connect a brokerage, we create a SnapTrade user for you. SnapTrade (a third-party provider) holds the connection to your brokerage under its own terms and privacy policy; the connection is read-only (holdings and balances). On our server we store the SnapTrade user ID and the secret needed to talk to SnapTrade on your behalf. Deleting your account deletes the SnapTrade user at the provider and our stored record.
If you use the optional server-assisted EVM wallet sync (paid with credit), the App sends the wallet address to our server, which forwards it to DeBank to read public on-chain balances. We use the address only for that lookup and do not store it afterwards.
To show prices and balances, the App on your device contacts third-party services directly, and those providers see the request and your IP address under their own policies. Depending on what you use, this includes: exchanges you connected (using your read-only API keys), price and market-data providers (such as CoinGecko, Twelve Data, Yahoo Finance), blockchain data providers (such as Helius, Alchemy, public node and explorer APIs, TON APIs), and brokerage providers you connected. Wallet addresses you track are public blockchain data but are sent to those providers to fetch their balances. We do not control these providers.
If you contact us from the App (Account → Support), we store your message, contact email, app version and basic diagnostics in our database. New support messages are also forwarded to a private Telegram chat used by the team so we can answer promptly; Telegram processes them under its own terms, and messages already forwarded there cannot be deleted by us when you delete your account. Never put API keys, passphrases or seed phrases in a support message. Support emails to support@foliosum.app are handled in our mailbox.
The Android app uses Google Firebase Crashlytics to collect crash reports (crash type, device model, OS version, app version). They are not used to identify you personally. The iPhone app does not send us crash reports; if you choose to share diagnostics with Apple, Apple handles them under its own policy.
We use data to run your account and credit, provide the optional cloud copy and web view, perform lookups you request, answer support, and fix crashes. We do not use it for advertising and do not sell or rent it. We share it only with the providers needed to run the App: Google Firebase (authentication, database, functions, crash reporting), NOWPayments (payments), DeBank (wallet lookups), SnapTrade (brokerage connections), and Telegram (support notifications). We may disclose information if required by law. Google Firebase may process data on servers outside your country.
You can use the App's free features without an account, decline or switch off the cloud copy, delete your cloud data or account in the App, and request access to, correction of, or deletion of your data by contacting us. If you are in Türkiye (KVKK), the EEA/UK (GDPR) or another region with similar rights, you may have additional rights such as objection, restriction and portability, and the right to complain to your data-protection authority. Our contact is below; we respond within the time required by law.
Keys are encrypted on your device; the optional passphrase-encrypted block protects exchange and brokerage keys in the cloud; transport to our servers uses HTTPS. No system is perfectly secure, and portfolio data in your cloud copy is stored readable by the account, so decide accordingly. Create exchange and brokerage keys with the least permission possible (see the Setup guide).
FolioSum is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their data.
We may update this policy. Material changes will be reflected by updating the "Last updated" date on this page.
FolioSum is the data controller for the data described in this policy. Questions or data requests: support@foliosum.app