Privacy Policy

Quantfolio is a portfolio analytics tool. We collect only what is needed to run your account and compute your own analytics: your email, name, and the portfolio data you enter or import. We never ask for broker logins or trading credentials, we do not sell or share your data with advertisers, and you can permanently delete your account and all its data yourself at any time.

Quantfolio is run by Smit Bhansali, Mumbai, Maharashtra, India (“we”, “us”), who decides how your data is used and is responsible for it. Write to support@quant-folio.com about anything in this policy. Using Quantfolio is also covered by our Terms of Use.

• Account data — your email address, name, and a securely hashed password (we never store the password itself). If you enable two-factor authentication, we store the related secrets and hashed backup codes.
• Portfolio data you provide — transactions you add or import from broker CSV files (symbols, dates, quantities, prices), F&O entries, target allocations, and portfolio settings. CSV files are parsed on your device; only the normalized rows you confirm are sent to our servers. A mutual fund statement (CAS PDF) and its password are sent to our server only to read it: it is processed in memory and never stored or logged, and only the rows you confirm are saved.
• Derived analytics — daily portfolio-value snapshots and cached computations we generate from your data to power charts and risk metrics.
• Anonymous usage counts — which sections of the app are opened, counted as the number of distinct signed-in people per day using a method (HyperLogLog) that can't list who visited. Kept for 90 days to learn which features are useful.
• Visitor statistics — our own copy of Umami, open-source visitor statistics that runs on our server (no third party sees it), counts page visits: the page address without anything after “?”, the site you came from, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city) worked out from your IP address. It also counts three steps: creating an account, starting an import and finishing one, with the import type and broker but never amounts or holdings. It sets no cookies, doesn't store your IP address and can't identify you. If your browser sends “Do Not Track”, nothing is counted.
• Technical logs — standard server logs (IP address, timestamps, requested endpoints) kept briefly for security, rate-limiting, and debugging.
• Error reports — when something breaks, a report of the error (its message and stack trace, the page or endpoint path without any query string, your browser type, and which part of the app failed) goes to our error-monitoring provider, Sentry, so we can fix it. Reports carry no portfolio data, passwords, tokens, cookies or account details, and email addresses in them are masked.

We do not collect broker credentials, bank details, PAN/Aadhaar numbers, contacts, precise location, or advertising identifiers. Quantfolio contains no ads and no third-party analytics or tracking SDKs (visitor statistics run on our own server); the only third-party code reports errors, as described above.

• To operate your account: sign-in, email verification codes, two-factor and password-reset codes.
• To send a weekly summary of your portfolio (Saturdays), and occasional product update emails (a few a year) about new features. Each kind can be turned off on its own: every one has a one-click unsubscribe link, and you can turn them off in Settings; sign-in and security codes still arrive.
• To compute your own analytics: performance, risk, allocation, benchmarking, tax summaries, projections.
• To keep the service secure: rate limiting, abuse prevention, and debugging.

We do not sell your data, use it for advertising, or share it with third parties for their own purposes. Market prices are fetched from market-data providers using instrument symbols only — never together with your identity or holdings quantities.

All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed with bcrypt. Sessions use signed tokens, which are revoked when you reset your password or turn two-factor off. Optional two-factor authentication (email codes or an authenticator app) is available on every account. Your portfolio data is only ever readable by your own account.

Your data is kept only while your account exists. You can permanently delete your account and everything in it — portfolios, transactions, snapshots, and settings — at any time, without contacting us:

• Sign in and open Settings → Danger zone → Delete account.

Deletion is immediate and irreversible. If you cannot access your account, email support@quant-folio.com from the account's email address and we will delete it for you. Transient server logs age out automatically.

We use infrastructure providers to run the service (hosting, email delivery for codes, summaries and update emails, market-data lookups, and error monitoring by Sentry). These providers process data only on our behalf. The app does not integrate ad networks, social SDKs, or data brokers.

Quantfolio is intended for adults (18+) and is not directed at children.

If this policy changes materially, we will update this page and its effective date. Questions or requests: support@quant-folio.com.

Reminder: Quantfolio is an analytics tool — not a broker, adviser, or tax consultant. Back to Quantfolio