Privacy Policy

Last updated: May 13, 2026  |  App: Porty

1. Data We Collect

Porty collects the following data:

• Account information: Name, Email address and password (stored encrypted). If you sign in with Apple or Google, we receive only your unique user ID, name, and email address.
• Portfolio data: Assets you add to the app (ticker symbol, quantity, purchase price). This data belongs solely to you.
• App preferences: Language, theme, display currency, and settings (stored locally and synced to your account).
• Profile photo: If you choose to set a profile picture, the image is stored securely and linked only to your account.
• Goal data: Financial goals you set (target amounts, asset types, time horizons) and milestone progress. This data belongs solely to you.
• AI insight data: AI-generated analyses, prompts and outputs derived from your portfolio, goal and transaction data, along with cited public analyst/source metadata used to generate those insights.
• Usage data: In-app activity such as screens visited and actions taken, collected to improve the app experience. This data is linked to your account.
• Subscription data: Your subscription status and entitlement records, managed through RevenueCat. This includes anonymized transaction identifiers — no payment card data is stored by Porty.
• Technical data: Device type, operating system version, app version, and session tokens for authentication purposes.

2. Legal Basis for Processing

Purpose	Legal Basis (GDPR Art. 6)
Account creation and authentication	Performance of a contract (Art. 6(1)(b))
Portfolio data sync across devices	Performance of a contract (Art. 6(1)(b))
Saving app preferences	Legitimate interest (Art. 6(1)(f))
Generating requested AI insights and maintaining related quotas/logs	Performance of a contract (Art. 6(1)(b))
Technical error detection and improvement	Legitimate interest (Art. 6(1)(f))
Subscription management and purchase processing	Performance of a contract (Art. 6(1)(b))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

3. How We Use Your Data

Collected data is used only for the following purposes:

• Creating and authenticating your account
• Syncing your portfolio and goal data across devices
• Generating personalized AI insights and behavioral observations you request
• Remembering your app preferences
• Processing and verifying your subscription status
• Technical operations necessary for the app to function

We do not share, sell, or use your data for advertising or third-party profiling purposes. Limited in-app analysis of portfolio, goal, and transaction data may be performed to generate educational AI insights and behavioral observations.

4. Third-Party Services

Porty uses the following third-party services to operate:

• Supabase Inc. (USA): Cloud database and authentication infrastructure. Data is transmitted over TLS and stored with AES-256 encryption. Supabase acts as a data processor under our instructions.
• Financial data APIs: Market prices and asset information are fetched from third-party financial data providers. Only ticker symbols are sent to these APIs — no personal account data is shared.
• Google LLC / Gemini API (USA): AI analysis generation. Portfolio, goal, transaction and asset-context data necessary for the AI insights you request may be sent to this service. Grounded source links and public analyst references may also be retrieved.
• Apple / Google Sign-In: If used, we receive only your user ID, name, and email address. No other account data is accessed.
• RevenueCat Inc. (USA): Subscription management and in-app purchase processing. RevenueCat receives your app user ID and subscription/entitlement status. No payment card data is passed through RevenueCat — payments are handled directly by Apple or Google.

5. Data Retention

• Your data is retained for as long as your account is active.
• When you delete your account, all personal data is permanently deleted or anonymized within 30 days.
• Retention periods required by law are exempt from early deletion.

6. Data Security

We implement technical and organizational measures to protect your data:

• All data transmitted over HTTPS/TLS
• Passwords stored using bcrypt hashing — never in plain text
• Row-Level Security (RLS) ensures users can only access their own data
• In the event of a data breach affecting your personal data, you will be notified within 72 hours of discovery.

7. Your Rights

Under GDPR and KVKK, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request that we restrict processing of your data

You can delete your account directly from app settings. For other requests, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

8. Contact

For privacy-related questions: [email protected]