Privacy Policy

1. Introduction

Swingfolio ("we," "us," or "our") operates the Swingfolio platform at https://swingfolio.com (the "Service"). Swingfolio is an Australian business.

This policy covers the Service wherever you use it: the Swingfolio website, the Swingfolio mobile app for iOS and Android, and the Swingfolio browser extension. The extension reads trade details from a broker page only when you explicitly ask it to capture them, and sends them to your Swingfolio account; it does not monitor your browsing.

We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable privacy laws including the General Data Protection Regulation (GDPR) for EU/UK residents and the California Consumer Privacy Act (CCPA) for California residents.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By creating an account, you enter into a contract with us that enables us to provide the Service. Some features may require your specific consent, which you can withdraw at any time.

Important: Swingfolio is a portfolio tracking and trade journaling tool only. We do not provide financial advice, investment recommendations, or trading signals. We do not hold an Australian Financial Services License (AFSL). Always consult a licensed financial advisor before making investment decisions.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Password (stored in encrypted/hashed form - we never store plaintext passwords)
• Profile preferences and settings

2.2 Financial and Trading Data

To provide our portfolio tracking and trade journaling services, we collect:

• Portfolio information (names, currencies, broker details)
• Trade entries and exits (symbols, dates, prices, quantities)
• Trading strategies and rules you define
• Trade notes, ideas, and journal entries you create
• Calculated metrics (profit/loss, R-multiples, win rates)
• Cash transactions (deposits, withdrawals, dividends)
• Notification preferences

Important: Trading data reaches Swingfolio in one of three ways — you enter it by hand, you upload a file, or you connect a brokerage account through SnapTrade and we import it for you. Broker connections are optional, and where you use one our access is read-only: we can read your accounts, holdings, and transactions, but we cannot place trades, move money, or transfer securities. See Broker Connections.

2.3 Broker Account Data

If you connect a brokerage account, we receive from that broker via SnapTrade:

• Account names, numbers, types, and base currency
• Cash balances and total account value
• Holdings (symbol, quantity, average cost, market value)
• Transaction history (buys, sells, dividends, fees, interest, deposits, and withdrawals)
• Brokerage name and connection status

We never receive or store your broker username, password, or multi-factor codes. You enter those on SnapTrade's own connection page.

2.4 Technical and Usage Data

We automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Time spent on the Service
• Referring website or source
• Error logs and performance data

2.5 AI Interaction Data

When you use our AI-powered features (such as trade analysis or the AI assistant), we collect:

• Questions and prompts you submit
• AI-generated responses
• Portfolio and trade data shared with the AI for analysis (summary metrics, not raw account credentials)

2.6 Communication Data

We collect information when you:

• Contact us for support
• Respond to surveys or feedback requests
• Subscribe to newsletters or updates

2.7 Payment Information

When you subscribe to a paid plan, your payment card details are collected and processed directly by Stripe, our payment processor, on Stripe's own hosted checkout pages. Your card number never reaches Swingfolio's servers and we never store it. We receive and store only:

• A Stripe customer and subscription reference
• Your subscription tier, status, and billing period
• Whether a cancellation has been scheduled

2.8 Anti-Abuse Signals

When you sign up or submit our contact form, Cloudflare Turnstile processes your IP address and browser characteristics to distinguish genuine users from automated abuse. This happens before an account exists and is necessary to protect the Service from bots, spam, and credential-stuffing attacks.

3. How We Use Your Information

We use your information to:

• Provide the Service: Create and manage your account, track portfolios, record trades, and calculate performance metrics
• Power AI Features: Analyze your trading data to provide personalized insights, identify patterns, and offer suggestions
• Improve the Service: Understand how users interact with Swingfolio to enhance features and user experience
• Provide Market Data: Display current and historical prices for securities you track
• Send Communications: Service updates, security alerts, and (with your consent) marketing communications
• Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
• Comply with Legal Obligations: Meet regulatory requirements and respond to lawful requests
• Generate Aggregated Insights: Create anonymized statistics about trading patterns (never identifying individual users)

4. Legal Basis for Processing

Under Australian Privacy Principles and applicable international laws, we process your personal information based on:

• Contract Performance: Processing necessary to provide the Service you requested
• Legitimate Interests: Improving our Service, ensuring security, and conducting business operations, balanced against your privacy rights
• Legal Compliance: Meeting our legal and regulatory obligations
• Consent: Where you have given explicit consent (e.g., marketing communications, optional AI features)

5. AI Features and Data Processing

Swingfolio uses artificial intelligence to provide trading insights and analysis. Here's how your data is handled:

AI Providers

We may use the following AI service providers to power our AI features. The specific provider used may vary based on feature requirements and availability:

• Google Generative AI (Gemini) - Primary AI provider for trade analysis and insights. Privacy Policy
• OpenAI - AI-powered analysis features. Privacy Policy
• Anthropic - AI-powered analysis features. Privacy Policy
• Moonshot AI (Kimi) - Stock research summaries and marketing content generation. Processed in China. We do not send your personal information, portfolio, or trade data to Moonshot AI. Privacy Policy

What We Send, and What We Never Send

Depending on the feature you use, we may send:

• The question or prompt you typed
• Trade records relevant to the request — symbol, dates, prices, quantities, profit and loss, and any notes or reflections you wrote on those trades
• Aggregate performance metrics such as win rate, average win and loss, and R-multiples
• Portfolio composition and allocation
• Your stated strategies and trading rules

We never send:

• Your password or authentication tokens
• Your broker credentials — we do not hold them (see Broker Connections)
• Your payment card details — we do not hold them
• Your brokerage account numbers or the identity of your broker

We send the minimum needed for the feature you invoked. Note that trade notes and reflections are free text: if you write personal information into them, that text is included when the feature you are using needs your notes.

AI Conversation History

Conversations with the AI assistant are stored against your account so you can return to them. You can delete any conversation from within the Service, and deleting your account removes them all. See Data Retention.

You Are Interacting With an AI System

Where you use a chat, coaching, or insight feature, you are interacting with an artificial intelligence system rather than a person, and the content it returns is machine-generated. We label AI-generated content as such within the Service.

AI-Generated Insights Disclaimer

Our AI features analyze historical data and patterns but do NOT constitute financial advice. AI-generated insights are based on past performance (which does not guarantee future results), may contain errors or inaccuracies, and should not be the sole basis for investment decisions.

Automated Decision-Making

Our AI features provide analytical insights to assist your decision-making. We do NOT make automated decisions that produce legal or similarly significant effects, and no computer program we operate makes, or does anything substantially relevant to making, a decision that affects your rights or interests. You remain in full control of all trading and investment decisions. AI insights are suggestions only and always require your review.

For transparency, the kinds of personal information our AI features process are those listed under "What We Send, and What We Never Send" above: your prompts, your trade records and notes, your aggregate performance metrics, your portfolio composition, and your stated strategies. The output is advisory. Nothing is decided, approved, priced, restricted, or refused on the basis of it.

Opting Out

AI features are optional. You can use Swingfolio's core portfolio tracking and journaling features without using AI analysis.

6. Broker Connections (SnapTrade)

Swingfolio lets you connect a brokerage account so your holdings and transactions can be imported into your journal instead of being typed in by hand. This is optional — the Service works fully without it.

How the Connection Works

Broker connections are provided by SnapTrade, a service of Passiv Inc. When you connect a broker:

• You choose your broker and are taken to SnapTrade's secure connection page to sign in.
• You enter your broker credentials on SnapTrade's page, never on Swingfolio's. Swingfolio never sees, receives, or stores your broker username, password, or multi-factor codes.
• Once you authorise the connection, SnapTrade returns your account data to Swingfolio.

What We Receive From Your Broker

• Account names, numbers, types, and base currency
• Cash balances and total account value
• Current holdings (symbol, quantity, average cost, market value)
• Transaction history (buys, sells, dividends, fees, interest, deposits, and withdrawals)
• The name of the brokerage and the status of the connection

What We Store and Why

We store the account and transaction data above so it can be reviewed and imported into your portfolio. We also keep records of each import — which accounts were fetched, what was proposed, what you approved or skipped — so that imports are not duplicated and so you and our support team can trace where a position in your journal came from.

We store an encrypted access token that identifies your connection to SnapTrade. It is encrypted at rest and is not a broker credential.

Disconnecting a Broker

You can disconnect a broker at any time from Settings. When you do:

• We instruct SnapTrade to remove the authorisation, and no further data is retrieved from that broker.
• The stored connection and its access token are deleted.
• Trades already imported into your journal stay in your journal — they are now your records, and you can edit or delete them individually like any other trade.

Deleting your Swingfolio account removes the broker connection and all associated broker data. See Data Retention.

SnapTrade's Role

SnapTrade processes your data on our instructions in order to provide the connection. SnapTrade's own privacy policy covers its relationship with us rather than with you directly, so this Privacy Policy governs how your broker data is handled, and you should raise any question about it with us. You can read SnapTrade's policy at snaptrade.com/privacy-policy.

SnapTrade stores and processes data in the United States and in other countries where it or its service providers operate. See International Data Transfers.

7. Third-Party Services

We work with trusted third-party service providers to operate Swingfolio:

We maintain Data Processing Agreements (DPAs) with all service providers who process personal data on our behalf, ensuring they comply with applicable data protection laws and only process data according to our instructions.

Market Data Disclaimer

Price data, charts, and fundamental data are provided by third-party sources (EODHD and TradingView) and displayed for informational purposes only. We do not guarantee the accuracy, completeness, or timeliness of this data. Always verify information with your broker before making trading decisions. We are not responsible for any errors, omissions, or delays in the data provided by these third-party services.

8. International Data Transfers

Swingfolio is operated from Australia, but your personal information may be transferred to and stored in the United States and other countries where our service providers operate.

If you connect a brokerage account, your account, holding, and transaction data is transferred to SnapTrade (Passiv Inc.), which stores and processes it in the United States and in other countries where it or its service providers maintain facilities. See Broker Connections.

When we transfer data internationally, we take steps to ensure your information receives adequate protection:

• We use service providers who participate in recognized data protection frameworks
• We implement Standard Contractual Clauses where applicable
• We apply appropriate technical and organizational security measures

When we disclose personal information to overseas recipients, we take reasonable steps to ensure they do not breach the Australian Privacy Principles. We remain accountable for their handling of your information under APP 8.1.

Please note that privacy laws in other jurisdictions may differ from those in Australia.

9. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account Credentials: Duration of account plus 30 days after deletion
• Trading Records: 7 years (to support Australian tax compliance requirements)
• Technical Logs: Up to 12 months
• AI Conversation History: Duration of account plus 90 days
• Marketing Preferences: Until consent withdrawn plus 30 days
• Broker Connection: Deleted when you disconnect the broker or delete your account
• Broker Import Records: Retained with your trading records, so imports are not duplicated and an imported position can be traced back to its source

Disconnecting a broker stops any further data being retrieved and deletes the stored connection, but trades already imported into your journal remain in your journal — they are your records, and you can edit or delete them individually.

After account deletion, we may retain certain information as required by law or for legitimate business purposes (such as fraud prevention or resolving disputes). Deletion requests are processed within 30 days unless legal retention requirements apply.

Tax Reporting

Swingfolio provides tools to track trading activity for your tax records. However, you are responsible for reporting capital gains/losses to tax authorities. We do not file tax reports on your behalf or provide tax advice. We recommend consulting a tax professional.

10. Your Rights

Under Australian Privacy Principles and applicable laws, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your account and associated data (subject to legal retention requirements)
• Data Export: Export your trading data in a portable format
• Opt-Out: Unsubscribe from marketing communications at any time
• Restrict Processing: Request that we limit how we use your data in certain circumstances
• Complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the Privacy Act

To exercise these rights, contact us at [email protected]. We will respond within 30 days. Your first copy of data is provided free of charge.

Withdrawing Consent

Where we process your data based on consent, you can withdraw consent at any time by:

• Adjusting settings in your account preferences
• Clicking "unsubscribe" in marketing emails
• Disabling AI features in your settings
• Contacting us at [email protected]

Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

11. Cookies and Tracking

Swingfolio takes a privacy-first approach. We use only essential and functional cookies/storage technologies:

• Essential Cookies: Required for authentication and security (Supabase authentication)
• Functional Storage: Remember your settings and preferences (theme, table customisations, last viewed page)

What We Don't Use

We do NOT use analytics tracking cookies (such as Google Analytics), advertising cookies, or third-party marketing pixels. Your browsing behaviour on Swingfolio is not tracked or shared with advertisers.

Managing Preferences

You can manage cookies through your browser settings. Disabling essential cookies will prevent you from logging in. Clearing browser storage will reset your preferences to defaults.

For full details, please see our Cookie Policy.

12. Security Measures

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest
• Secure password hashing
• Row Level Security (RLS) for database access control
• Regular security assessments
• Access controls and authentication requirements

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Breach Response

In the event of a personal data breach that is likely to result in serious harm:

• Australian Users: Under the Notifiable Data Breaches (NDB) scheme, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable
• EU/UK Users: We will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay
• California Residents: We will notify affected residents in compliance with California Civil Code § 1798.82

All breach notifications will include the nature of the breach, categories of data involved, likely consequences, and measures taken to address the breach.

13. Children's Privacy

Swingfolio is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

During account registration, we require users to confirm they are at least 18 years old. If we discover that a user is under 18, we will immediately suspend the account and delete all associated personal information within 30 days.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• For significant changes, sending an email notification to registered users
• For material changes, asking you to review and accept the updated policy the next time you sign in

We record which version of this policy you accepted, and when. For changes that are not material — corrections, clarifications, and updates to the list of service providers — your continued use of Swingfolio after the changes become effective constitutes acceptance.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Email: [email protected]

Office of the Australian Information Commissioner
If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the OAIC:
Website: www.oaic.gov.au
Phone: 1300 363 992

16. Additional Rights for EU/UK Residents (GDPR)

If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing

We process your data based on:

• Contract: To provide the Service you signed up for
• Legitimate Interest: For security, improvement, and business operations
• Consent: For marketing and optional AI features
• Legal Obligation: To comply with applicable laws

Additional Rights

Beyond the rights listed in Section 10, you may also:

• Data Portability: Receive your data in a structured, commonly used, machine-readable format
• Object to Processing: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Automated Decision-Making: Not be subject to decisions based solely on automated processing (we do not make such decisions)

International Transfers

When we transfer your data outside the EEA/UK, we rely on Standard Contractual Clauses approved by the European Commission and UK ICO to ensure adequate protection.

Supervisory Authority

You have the right to lodge a complaint with your local data protection authority. For the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

17. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

Categories of Personal Information

We collect the following categories of personal information:

• Identifiers (email, name, IP address)
• Commercial information (trading records, portfolio holdings)
• Internet activity (usage data, browsing history on our Service)
• Inferences (trading patterns, performance metrics derived from your data)

Sources of Information

• Directly from you (account registration, trade entries)
• Automatically from your device (usage data, IP address)
• From third parties (market data providers like EODHD for symbol information)

Sensitive Personal Information

We do not collect "sensitive personal information" as defined by CPRA (such as social security numbers, precise geolocation, or financial account login credentials). Your trading data (holdings, transactions) is commercial information, not sensitive PI under CPRA definitions. However, we treat all financial data with enhanced security measures.

Your Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

Sale of Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Exercising Your Rights

To exercise your CCPA rights, contact us at [email protected]. We will verify your identity before processing your request. You may designate an authorized agent to make requests on your behalf.