Privacy policy

Wolfora is the controller of your personal data. DPO contact: contact@wolfora.app

We collect the following data:

• Account data: name, email address, password (bcrypt-hashed), avatar
• Financial data: transactions and portfolio positions entered manually
• Billing data: Stripe customer ID, subscription plan (no card numbers stored on our servers)
• Connection data: access logs, OAuth provider (Google if used)

Your data is used to:

• Provide and improve the service
• Manage your account and subscription
• Send portfolio-related notifications (dividends, alerts)
• Comply with our legal and contractual obligations

Processing is based on performance of the contract (GDPR Art. 6.1.b) for service features, and on your consent for optional communications.

Data is kept for the life of your account, then deleted within 30 days after closure. Billing data is retained for 10 years in line with legal accounting obligations.

We never sell your data. It may be shared with:

• Stripe — payment processing (policy: stripe.com/privacy)
• Google — OAuth authentication if you use it
• Vercel Inc. — application hosting (vercel.com)
• Neon, Inc. — PostgreSQL database (neon.tech)

Under the GDPR, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability (export available in your account)
• Right to object and to restrict processing

To exercise these rights: contact@wolfora.app. You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Wolfora only uses cookies strictly necessary for the service (authentication session). No advertising or third-party tracking cookies are used.

Data is transmitted over HTTPS and stored in an encrypted database. Passwords are hashed with bcrypt. Stripe payment keys never transit through our servers.

Any material change to this policy will be notified by email or via an in-app notification.