Privacy Policy

• Account data — your email address and hashed password when you register, or your Google account name and email if you use Google Sign-In.
• Portfolio data — holdings, transaction history, pies, and AutoInvest plans you add or import via CSV upload, stored in our database so your portfolio is available across devices.
• Transaction log — buy/sell records you manually log inside the app, stored in your browser's localStorage (never sent to our servers).
• Usage data — anonymous page-view events collected via Google Analytics (see section 4).

• To authenticate you and load your portfolio on any device.
• To display real-time prices, news, and AI-generated analysis relevant to your holdings.
• To improve the app based on aggregate, anonymised usage patterns.
• We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

Your account and portfolio data is stored in Supabase (PostgreSQL), hosted in the EU. Supabase encrypts data at rest and in transit using TLS. Access is restricted by row-level security policies so each user can only read their own records.

Transaction history you log by hand, and certain preferences (theme, hidden values), are stored only in your browser's localStorage — this data never leaves your device. Portfolio data you import or sync is stored in the database described above.

To keep the app fast we cache some results in Upstash Redis for short periods. Most of what is cached is market data that has nothing to do with you — prices, charts, company profiles. The one exception is your portfolio value history, which is cached against your account ID for at most one hour so the dashboard chart does not have to be rebuilt on every visit. Deleting your account clears it immediately rather than waiting for it to expire.

HaboFi uses session cookies set by Supabase to keep you signed in. We do not use advertising or tracking cookies. Google Analytics uses its own cookies (_ga, _gid) to count anonymous visits — you can opt out via the Google Analytics opt-out browser add-on.

Your account and portfolio data is kept for as long as your account is active. Deleting your account from the Account page permanently erases all associated data immediately — every stored row, your login itself, and any cached copy of your portfolio history. There is no waiting period. localStorage data is stored on your device indefinitely until you clear it manually, and clearing your browser data removes it.

Under the GDPR (if you are in the EU/EEA) you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (edit any imported transaction from the Transactions page).
• Request deletion of your account and data — self-serve from the Account page, effective immediately.
• Export your portfolio data — self-serve as a JSON download from the Account page.
• Withdraw your consent to analytics at any time, by rejecting cookies in the banner or using the Google opt-out linked under Cookies below. Withdrawing consent does not affect anything processed before you withdrew it.
• Object to, or ask us to restrict, processing that relies on our legitimate interests rather than on your consent.

You don't need to contact us for the self-serve items above — they're available directly in your account. For anything else, reach us at the email below.

You also have the right to lodge a complaint with a data protection supervisory authority — normally the one in the EU or EEA country where you live or work. The European Data Protection Board publishes the list of national authorities. You are welcome to raise it with us first, but you are not required to.

HaboFi is not intended for anyone under the age of 16. We do not knowingly collect personal data from children.

We may update this policy occasionally. When we do, we'll update the "Last updated" date at the top. Continued use of HaboFi after changes constitutes acceptance of the updated policy.

Questions about this policy? contact@habofi.eu