Privacy Policy
Effective September 21, 2026
This policy describes how the Orbitfolio mobile apps, web service, and website process information. Orbitfolio is the service operator and data controller for the information whose purposes it determines. Contact us at info@orbitfolio.org for privacy questions or requests.
The public coming-soon website does not use account forms, analytics, behavioral advertising trackers, or non-essential cookies.
Information we process
Orbitfolio processes an account email and password hash; simulated portfolio holdings, lots, cash entries, favorites, currency and language preferences; device-session identifiers and security events; support communications; and subscription status or provider transaction identifiers. Apple, Google, and Stripe process payment details; Orbitfolio does not receive complete payment-card numbers.
Account-free guest use creates a pseudonymous, device-bound record for the three-day preview. Creating an account starts a separate 14-day account trial. If you save a chart to Photos, Orbitfolio requests add-only permission to write the JPG and does not read or upload your photo library.
How and why we use information
We use this information to provide and synchronize simulations, authenticate and secure accounts, enforce device and trial limits, verify subscription access, answer support requests, prevent abuse, and comply with law. Where applicable, these uses rely on performance of our contract, legitimate security and service interests, legal obligations, or consent for an optional feature. Orbitfolio does not sell personal information, use behavioral advertising, or make automated decisions producing legal or similarly significant effects.
Market data, news, and external services
Market and news requests may send an instrument symbol, search term, selected language, and currency to relevant providers through the Orbitfolio server. Providers do not receive your password or complete portfolio. Optional automatic headline translation sends the headline and target language to the configured translation service. Opening a publisher, payment, or other external site is governed by that site's privacy practices and may reveal your IP address and browser details.
Storage and security
Production connections use HTTPS, passwords are hashed, synchronized database records are encrypted at rest, native private caches use platform-protected storage, and web sessions use secure HttpOnly cookies. Authorized systems and personnel can access data when needed to operate, support, secure, or legally administer the service; this is therefore not end-to-end encryption. No service can guarantee perfect security.
Service providers and international transfers
Hosting, email, market-data, news, translation, payment, Apple, and Google service providers process limited information for the purposes described above. Information may be processed outside your country using contractual, statutory, or other safeguards required by applicable law. Service providers acting for Orbitfolio are required to protect personal data consistently with this policy and applicable law and may process it only for authorized purposes. They are not authorized to use Orbitfolio account or portfolio data for their own behavioral advertising.
Retention and deletion
Account and synchronized portfolio data are deleted after a verified deletion request, except for limited records required for security, fraud prevention, accounting, tax, disputes, or law. Residual encrypted backups and security logs are removed through scheduled rotation. Exported files, device backups, and records held independently by payment or data providers may require separate deletion.
In the app, open Settings → Account & security to delete an account or guest identity and its associated Orbitfolio data. You may also delete individual portfolios and favorites without deleting the account. If you cannot access the app, use the account-deletion page.
Your privacy rights
Depending on where you live, you may request access, correction, deletion, portability, restriction, objection, or withdrawal of consent, and may complain to your privacy regulator. We may verify identity before acting and will not discriminate because you exercise a privacy right. Email info@orbitfolio.org.
Children and policy changes
Orbitfolio is not directed to children under 13 or the higher minimum age required where they live. We do not knowingly collect their data. Material policy changes will be communicated through the service or another appropriate notice. This policy does not limit rights or responsibilities that cannot legally be waived.