Privacy Policy
1. Overview
This privacy notice describes how PluriFin (Filippo Salemi, a private individual based in Italy) processes personal data in connection with the Portfolio Manager application and the related website.
The data controller is Filippo Salemi, reachable at [email protected]. For GDPR-specific requests: [email protected].
2. Data collected
2.1 App data (local)
All data you enter in the app -- portfolios, positions, goals, settings, API keys -- is stored exclusively on your device, in encrypted storage (AES-256 + HMAC-SHA256). The encryption key is kept in the operating system keystore.
2.2 Website data
The site contains no forms and collects no email or other data through the browser. The "Notify me at launch" button and the contact addresses open your email client with a pre-filled address: it is you who chooses whether and when to email us.
- GitHub Pages static server logs: IP address, user-agent (max 14-day retention, handled by GitHub).
- Emails you send us voluntarily (to info@, privacy@, gdpr@ or press@ plurifin.app): the sender address and the message content, processed solely to reply to you.
2.3 Anonymous crash data
To diagnose bugs and crashes in the app we use Firebase Crashlytics (Google Ireland Limited, sub-processor under Art. 28 GDPR). When the app crashes or hits an unhandled exception, the following is sent to Crashlytics:
- Stack trace of the function that caused the crash (obfuscated and re-mapped by the dev team via symbols generated at build time).
- Device model (e.g. "Pixel 7"), operating system version (e.g. "Android 14"), app version (e.g. "1.0.0+10").
- Anonymous installation identifier (Firebase Installation ID, not linked to user identity).
Not sent: portfolios, positions, goals, API keys, AI prompt content, raw IP address (Google truncates it before writing to disk).
Collection is off by default: no data is sent until you manually enable the "Anonymous crash diagnostics" toggle in Settings > Privacy. Retention: 90 days (Firebase Crashlytics default). Legal basis: legitimate interest of the controller in improving and debugging the app (Art. 6.1.f GDPR). Extra-EU transfer covered by Standard Contractual Clauses between the controller and Google Ireland Limited.
3. Processing purposes
- Emails you send us: respond to your requests (support, press, GDPR requests). Legal basis: legitimate interest in replying; for GDPR requests, legal obligation (Art. 6.1.f and 6.1.c GDPR).
- GitHub Pages logs: security and abuse prevention. Legal basis: legitimate interest.
4. Third parties
The app may send data to external services only if you enable the relevant optional features:
- Google Gemini -- AI analysis (user API key).
- EODHD / FMP -- market prices (user API key).
- Firebase Crashlytics (Google Ireland Limited) -- anonymous crash diagnostics. Off by default; enable from Settings > Privacy.
- Google Analytics for Firebase / GA4 (Google LLC) -- GA4 property linked to the Firebase project for future evolutions. No data transmitted in version 1.0.0+10 (the `firebase_analytics` SDK is not integrated). Will be activated only after an app update + user re-consent.
- GitHub Pages -- static hosting (USA, SCC).
5. User rights
You may at any time exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, objection. Write to [email protected].
For local data, you can wipe everything from Settings at any time.
6. Contact
General: [email protected]
GDPR requests: [email protected]
7. Changes
Material changes will be published on this page, updating the date and version number at the top of the document.