Privacy Policy

Effective date: September 25, 2026 · Version 2026-09-25

Written in plain language, because privacy policies should be readable. This is a beta draft prepared by the Dripfolio team and not yet reviewed by an attorney.

1. Scope

This policy covers the Dripfolio website and application, including the demo and early-access program. It explains what we collect, how we use it, and the choices you have. We collect information to operate the service and for no other purpose. We do not sell personal information, and we do not share it for targeted advertising.

2. Information you provide

Your account and portfolios

When you register and use Dripfolio, we collect:

• your first and last name and your email address;

• a hash of your password, never the password itself;

• registration and invitation records;

• the portfolios, holdings, transactions, and related details you enter or import from CSV files;

• support tickets and the messages you send us;

• account settings, display preferences, and projection assumptions; and

• a record of which Terms and Privacy versions you accepted, and when.

Registration does not ask for your street address, city, state, or ZIP code.

Demo and early access

The demo is for people who do not already have an account. We check whether the submitted email belongs to an existing account when granting or using demo access. Creating an account ends demo eligibility for that email.

Requesting the demo creates an email contact record, not an account. The demo shows sample portfolios with market data from the same providers as the application. Those portfolios are stored separately from customer portfolios. You do not provide any financial information of your own, and demo access does not include account settings or portfolio editing.

For a demo contact we record your email confirmation, the days you visited, early-access offers and requests, review decisions, invitations, and your product-update preference. We may also record a short source or campaign label taken from the link you used. If you later create an account with the same confirmed email address, we associate that registration with your demo contact so we can count sign-ups.

We also record the Terms of Service and Privacy Policy versions submitted with a demo request and when it was submitted. These records are separate from email confirmation and product-update consent.

If you register with an approved early-access invitation tied to your confirmed email, we carry that email confirmation into your new account. Sign-in security checks still apply.

Product updates are a separate, optional choice that you confirm by email. You can use the demo and request early access without subscribing to product updates.

Billing

If you purchase a paid plan, Stripe processes the payment. We send Stripe your email address, your account identifier, the product name, and the plan, price, and billing interval you chose. Stripe collects your payment details in its own checkout and billing portal. Dripfolio never receives or stores your full card number or security code.

We keep your subscription status, billing dates, payment and refund records, amounts, currency, and Stripe identifiers so we can manage your plan and show your billing history.

3. Connected brokerage accounts

Connecting a brokerage account is optional and, where available, uses Plaid or SnapTrade. You choose which when you connect.

• You sign in to your institution inside Plaid Link, or on SnapTrade's own connection page. Dripfolio never receives or stores your brokerage username or password.

• We receive the investment information you authorize: account details, balances, holdings, securities, and valuations. If you turn on transaction imports, we also receive the investment transaction history that is available.

• We store connection identifiers, connection status, and the encrypted credentials needed to keep the connection working. For SnapTrade, that includes a registration Dripfolio creates for you at SnapTrade under a random identifier, never your email address.

• Prices your brokerage reports through SnapTrade are used for your own holdings only. They are never added to the market data other users see.

• Access is read-only. Dripfolio cannot trade, or move money, through the connection.

Disconnecting stops access once the provider confirms the removal. When you remove a connection you choose whether the information already imported from it is deleted or kept as read-only history; deletion happens once the provider confirms the removal. When nothing is connected through SnapTrade, you can also have your SnapTrade registration deleted; SnapTrade completes that in the background. Plaid, SnapTrade, and your institution handle your information under their own privacy policies.

4. Market-data providers

Market-data providers supply prices, dividends, historical prices, and security details. Our requests to them contain security identifiers, such as ticker symbols, and the parameters needed to retrieve that data. We do not send them your name, email address, account identity, portfolio balances, holding quantities, or transaction history.

Demo portfolios use the same market-data service and shared cache as the rest of the application. A provider request never identifies an individual demo visitor.

5. Technical information collected automatically

We collect the information needed to secure and operate the service, including:

• IP addresses, browser details, and timestamps attached to security events and consent records;

• sign-in attempts, account security changes, and remembered-device records;

• request and error details in operational logs, and status, timing, and usage records for requests to integrated services;

• email recipients, message types, delivery attempts, results, and the records needed to stop delivery to addresses that bounce or report complaints; and

• the demo activity and source labels described in section 2, plus hashed client identifiers used to limit abusive email requests.

Our own demo reports count requests, visits, invitations, and sign-ups. We do not use third-party advertising trackers, tracking pixels, or third-party analytics tools in the application. We do not request precise device location. We do not track you across other websites, and we do not respond to browser Do Not Track signals because we have no tracking to turn off.

6. Cookies

Dripfolio sets only the first-party cookies it needs to run. Every one of them is HttpOnly, so page scripts cannot read it, is sent only over HTTPS, and includes protections against cross-site misuse. None of them is used for advertising or for tracking you on other websites.

• Account session. Keeps you signed in. It expires 14 days after you sign in and is not extended by activity. Signing out ends it immediately.

• Form security. Protects forms against cross-site request forgery. It lasts 14 days and identifies no one.

• Sign-in verification. Holds your place for up to 10 minutes while you enter a sign-in verification code. It cannot be used to reach any account page.

• Remembered device. Set only if you choose to remember a device when verifying a sign-in. It lasts 30 days. You can remove remembered devices from your account settings.

• Demo access. Set when you open a confirmed demo link. Demo access itself expires seven days after it is granted. The cookie may persist for up to 21 days, but an expired demo cannot be used to reach any account.

Display preferences such as your theme are stored with your account, not in a cookie. We do not set analytics or advertising cookies.

Plaid Link, SnapTrade's connection page, and Stripe checkout are provided by those companies and may set their own cookies under their own policies. You can delete cookies in your browser, but doing so will sign you out and end any demo access on that browser.

7. How we use information

We use information to:

• create accounts, verify email addresses, and secure sign-ins;

• display portfolios and calculate portfolio, dividend, and projection results;

• maintain the optional brokerage connections and imports you set up;

• manage subscriptions, payments, and billing notices;

• provide demo access, review early-access requests, and issue invitations;

• send the service emails you request and the product updates you opt into;

• respond to support and privacy requests;

• prevent abuse, investigate errors, and keep the service running;

• understand demo use and sign-ups; and

• meet legal, accounting, and recordkeeping obligations.

Unsubscribing from product updates does not stop service emails needed for actions you request, account security, or billing.

8. How information is shared

We disclose information only as needed to:

• hosting, storage, backup, and infrastructure providers that run the service;

• email delivery providers, which receive recipient addresses and the messages they deliver;

• Plaid, SnapTrade, and the institutions you connect, for brokerage connections you authorize;

• Stripe, for payment processing and subscription management;

• market-data providers, limited to the requests described in section 4;

• authorities or other parties when disclosure is required by law, or is needed to protect users, investigate fraud, or protect the service; and

• a successor in a merger, acquisition, or other business transfer, with notice where the law requires it.

The service is operated from, and your information is stored and processed in, the United States.

Authorized personnel may access information needed for support, administration, security, and operations. Staff tools restrict access by role and record administrative actions. Ordinary staff tools do not display your portfolio values, holding details, or income. Anything you write in a support message is visible to the people handling it.

9. Data retention

We keep account and portfolio information while your account is active and for as long as needed to provide the service. Closing a login, disconnecting a brokerage, and deleting financial data are separate actions. Deleting financial data does not automatically delete billing, support, consent, security, or audit records.

Our scheduled demo cleanup applies these periods:

• An unconfirmed contact becomes eligible for deletion seven days after it is created.

• A confirmed contact that is not subscribed to product updates becomes eligible after 365 days without confirmed activity.

• A subscribed contact is kept while the subscription stands. An unused, still-valid invitation delays automatic deletion until it expires.

• Unsubscribing removes that exception without restarting the activity period.

• Expired demo access-link records are removed after seven days. Demo session records are removed seven days after they expire or are revoked. Unsubscribe-link records stay until the contact is deleted.

• Recipient addresses and message context in completed demo emails are removed after 30 days, or sooner when the contact is deleted. Short-lived email rate-limit records are removed after one day.

Deleting a contact removes its demo activity and early-access request records, cancels any pending emails to it, and invalidates its demo credentials. Consent and deletion evidence is kept, but without the deleted contact's email address or credentials. Deleting a demo contact does not delete a separately registered account.

Other records have no single fixed retention period. How long we keep them depends on their purpose, legal and accounting requirements, unresolved disputes, security needs, and fraud prevention. Backup copies may persist after a deletion until those backups expire. Before a restored backup returns to service, we reapply every recorded deletion.

10. Security

Our safeguards include HTTPS in production, password hashing, encrypted brokerage tokens, role-restricted administrative access, and security and audit records. If you use an authenticator app, its setup secret is stored encrypted. Recovery codes and remembered-device credentials are stored as protected digests rather than readable copies.

We use controls designed to keep passwords, access tokens, and other credentials out of logs and pages. No online service can promise perfect security. Use a unique password, and keep your verification and recovery codes private.

11. Your choices and requests

• You can change your account settings and security preferences in the app, including remembered devices.

• You can manage holdings and portfolios and export your recorded activity. Manual and CSV transactions keep a history of corrections. Voiding a transaction removes it from calculations, and archiving hides it from the default activity view. Neither erases the record.

• You can delete transactions imported from a linked brokerage (through Plaid or SnapTrade) where the app offers it. We keep an identifier so a later import does not restore a transaction you deleted.

• You can disconnect brokerage access from Linked accounts and choose there whether the imported data is deleted. Contact support for broader financial-data deletion or account closure.

• You can withdraw product-update consent with the link in any contact email, without signing in or reopening the demo. Support can also handle withdrawals and demo-contact deletion requests.

• You can ask us to access, correct, or delete your personal information using the contact details below. You do not need an account to make a privacy request.

We may ask for the information needed to verify a request and protect it from misuse. Some records may have to be kept for the reasons in section 9. Account closure is handled through support. There is no self-service account deletion button yet.

12. U.S. residents and state privacy rights

Dripfolio is intended for U.S. residents. Depending on your state and the laws that apply to us, you may have the right to know what personal information we hold about you, obtain a copy, correct inaccuracies, request deletion, or limit certain uses and disclosures. Applicable law may also let an authorized agent act for you, and may let you appeal a decision we make about your request.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We will not discriminate against you for exercising a privacy right. Use the privacy contact below to submit a request or an appeal.

13. Children

Dripfolio is for adults aged 18 or older, including demo visitors. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can investigate and remove it.

14. Changes to this policy

We publish each update with a new version and effective date. For material changes we will give notice by reasonable means, such as a notice in the app or an email. Your acceptance records name the version you accepted at the time. Publishing a new version does not rewrite them.

15. Contact

For account help, use the support ticket system or the public support email below. For privacy requests, demo-contact deletion, or account closure, use the privacy contact shown below. No account is required to contact us. Please never send passwords, verification codes, or brokerage credentials.

Contact

Account and product support: [email protected] or the support ticket system.

Privacy requests: [email protected] (no account required).

This service is operated by Wake Foundry LLC.