Peerfolio

Privacy Policy

Effective September 26, 2026

Peerfolio lets you compare investment returns with friends. The rule the whole product is built on: percentages can be shared, dollar amounts never are. This page explains what we collect, what we do with it, who else touches it, and how to delete it.

What we collect

  • Your Google account basics. You sign in with Google. We receive your name, email address and profile photo. We never see your Google password.
  • Profile details you choose. Your handle, an optional bio, and whether your profile is public.
  • Data from accounts you link through Plaid. If you connect a brokerage or bank, Plaid gives us the institution's name and logo, each account's name, type and last four digits, account balances, and your investment holdings (security, quantity, cost basis and value). To keep returns honest we also read your investment transactions to total up deposits and withdrawals for each day. We store only that daily total, not the individual transactions.
  • Manual accounts. Accounts you add yourself, with a balance you type in or positions (ticker and quantity) that we price from market data.
  • Daily portfolio snapshots. Once a day we record your total assets, liabilities, invested amount and net deposits. This history is what your returns are calculated from.
  • Social activity. Leagues you create or join, reactions you send, and people you follow.
  • Waitlist sign-ups. If you joined the waitlist, the email, name and note you gave us.

We do not collect your bank or brokerage login credentials. You enter those directly into Plaid, and they never reach our servers.

How we use it

  • To show you your own portfolio, balances and holdings.
  • To calculate time-weighted returns, which leave out deposits, withdrawals and newly linked accounts so that only investment performance counts.
  • To rank members of your leagues and, if you opt in, the public board.
  • To keep linked accounts up to date and tell you when a connection needs attention.

We do not sell your data, share it with advertisers, or use it for advertising. We don't run third-party analytics or ad trackers.

What other people can see

Nobody else ever sees your balances, net worth, position sizes or email address. What others can see depends on where they see you:

  • Members of a league you're in see your name, handle, profile photo, percentage return and return chart. Unless you turn it off for that league, they also see your top tickers as a percentage of your portfolio, never as dollar amounts.
  • Anyone on the public board, only if you choose to go public, sees your name, handle, profile photo, bio, percentage return and top tickers as percentages. The board only ranks returns from accounts linked through Plaid, never manual accounts. You can make your profile private again at any time.

How Plaid connections are protected

  • When you link an institution, Plaid gives us an access token for it. We encrypt that token with AES-256-GCM before storing it, and the encryption key is kept separately from the database.
  • Access tokens are used only on our servers to fetch your data from Plaid. They are never sent to your browser or to anyone else.
  • When you disconnect an institution, we tell Plaid to revoke our access (Plaid's /item/remove) and delete that institution's accounts and holdings from our database.
  • All traffic between your browser, our servers and Plaid is encrypted in transit with TLS.

Plaid's own handling of your data is described in the Plaid End User Privacy Policy.

Services we rely on

These providers process data on our behalf, only as needed to run Peerfolio:

  • Google, for sign-in.
  • Plaid, to connect financial accounts.
  • Vercel, which hosts the app.
  • Neon, which hosts our Postgres database.
  • Massive, our market data provider. We send it ticker symbols to get prices. It receives nothing about you.
  • Anthropic, only when you paste holdings that aren't a plain table into the import box. We send it the text you pasted so it can pick out tickers, share counts and average costs. We don't send your name, email or login details, and we ask it to return only the holdings. Uploading a CSV or typing a simple list is read on our servers without it.

Cookies

We use cookies only to keep you signed in and to protect sign-in against forgery. We don't use advertising or tracking cookies.

Keeping and deleting your data

We keep your data for as long as you have an account. You can remove it at any time:

  • Disconnect an institution from your Portfolio page. We revoke access through Plaid and delete that institution's accounts and holdings.
  • Delete your account from Settings. We revoke every Plaid connection, then delete your profile, accounts, holdings, snapshots, league memberships, reactions, follows and any waitlist sign-up under your email. Leagues you created are handed to their longest-standing member, or deleted if you were the only one.

Deleted data may remain in our hosting providers' encrypted backups for a limited time until those backups expire. You can also email us to ask for a copy of your data or for deletion.

Children

Peerfolio is not intended for anyone under 18, and we don't knowingly collect data from children.

Changes

If we change this policy, we'll update the date above. For significant changes we'll also tell you in the app or by email.

Contact

Questions or requests: privacy@peerfolio.org.