Privacy Policy

This website sets no cookies and loads no trackers. See the Cookie Policy.

Effective date: May 20, 2026
Last updated: June 6, 2026

This Privacy Policy explains how OLEGUM SRL ("OLEGUM", "we", "us", or "our") collects, uses, discloses, stores, and protects personal data when you use Portfold, including the Portfold mobile applications, https://portfold.app, https://api.portfold.app, and related services (together, the "Service").

Portfold is a cryptocurrency portfolio tracking service. It helps users record investments, view estimated portfolio value, collaborate on shared portfolios, and optionally synchronize portfolio data from supported third-party services such as Bitget and Solana-related data providers. Portfold is not a broker, exchange, bank, wallet, custodian, financial adviser, investment adviser, tax adviser, or legal adviser.

1. Controller and Contact Details

The data controller for the Service is:

OLEGUM SRL
Registration/tax identifier: RO52838329
Address: Str. SERII, Nr. 2, Et. 3, Ap. 97, Romania
Email: info@koral.solutions

For privacy questions, account deletion requests, data access requests, or other privacy rights requests, contact us at info@koral.solutions.

2. Scope

This Privacy Policy applies to personal data processed through the Service. It does not apply to third-party websites, exchanges, blockchain networks, RPC providers, app stores, operating systems, or services that we do not control. Those third parties process data under their own privacy policies and terms.

3. Data We Collect

We collect the following categories of data, depending on how you use the Service.

3.1 Account and Authentication Data

We collect data needed to create, authenticate, and secure your account, including:

Email address.
Password authentication data. We store a password hash, not your plaintext password.
Access tokens, refresh tokens, token expiry data, and session state.
Account identifiers generated by the Service.

3.2 Portfolio and Investment Data

We collect the portfolio and investment information you enter, import, or generate through the Service, including:

Portfolio names.
Cryptocurrency symbols, token identifiers, mint addresses, and price lookup identifiers.
Investment amounts, purchase prices, fees, dates, platforms, external trade identifiers, and deletion status.
Estimated current prices, portfolio values, allocations, profit/loss calculations, and historical portfolio snapshots.
Portfolio owner, member, invite, role, and status data, including member email addresses and user IDs.

This data can reveal information about your financial interests and cryptocurrency activity. Do not add data to Portfold that you do not want processed by the Service or visible to authorized members of a shared portfolio.

3.3 Sync Connection Data

If you choose to connect external sync providers, we collect and process the data needed to operate those connections, including:

Bitget API key, secret, and passphrase.
Solana wallet address.
Sync status, last sync time, sync item counts, and sync error messages.

Bitget credentials and sync payloads are encrypted at rest on the backend. For Solana sync, you provide only a wallet address; provider API access is managed by Portfold on the backend and is not requested from you. You should use Bitget API keys with the minimum permissions needed for portfolio tracking and avoid granting withdrawal or trading permissions unless strictly necessary for your own separate purposes outside Portfold.

3.4 Third-Party Market, Exchange, and Blockchain Data

When sync or valuation features are used, we may obtain or request data from third-party providers, including:

Bitget account asset and trade data for connected Bitget accounts.
Solana wallet asset, signature, and transaction data for connected wallet addresses.
Market price data for cryptocurrency symbols and token identifiers.
Historical SOL price data used to estimate Solana transaction cost basis.

3.5 Device, App, and Technical Data

We may process technical data necessary to operate and secure the Service, including:

IP address, request metadata, timestamps, and server logs generated when your device communicates with our backend.
User agent and similar client/network metadata sent by the app or browser.
App version, platform, operating system, and diagnostic data that may be included in standard request or infrastructure logs.
Mobile crash reports and diagnostics collected through Firebase Crashlytics when the app crashes, such as stack traces, app version/build, operating system version, device model, crash timestamp, installation identifier, and basic device state.
Local device state needed to keep you signed in, select an active portfolio, and apply app lock settings.

As of the last updated date, the mobile app includes Firebase Crashlytics for crash reporting. It does not include advertising SDKs or third-party analytics SDKs. The Android app requests internet access. It does not request camera, microphone, contacts, precise location, photos, SMS, or call log permissions. The iOS app may use Face ID through the operating system to unlock a saved session; we do not receive or store your biometric templates.

3.6 Local Device Storage

The mobile app stores some data locally on your device to make the app work, including:

A local database cache of portfolios, investments, prices, snapshots, allocations, and coin metadata.
Authentication tokens and session settings in secure platform storage, such as Android encrypted preferences or iOS Keychain.
Biometric/app-lock settings.

Android app backup and data extraction are disabled in the app configuration.

3.7 Data We Do Not Intentionally Collect

We do not intentionally collect:

Payment card data. As of the effective date, Portfold does not offer paid billing, subscriptions, Stripe, PayPal, or similar payment integrations.
Advertising identifiers for advertising or tracking.
Precise geolocation, contacts, photos, microphone, camera, SMS, or call log data.
Private keys or wallet seed phrases. You should never enter private keys or seed phrases into Portfold.

4. How We Use Data

We use data to:

Create, authenticate, maintain, and secure user accounts.
Provide portfolio tracking, local caching, synchronization, valuation, allocation, and history features.
Enable shared portfolio collaboration, invites, roles, and permissions.
Store and manage optional Bitget and Solana sync connections.
Retrieve external market, exchange, and blockchain data needed for sync and valuation features.
Prevent unauthorized access, abuse, fraud, and security incidents.
Diagnose bugs, service errors, availability issues, and infrastructure problems.
Respond to support, privacy, and deletion requests.
Comply with legal obligations and enforce our Terms of Use.

We do not use your portfolio data to provide personalized investment advice, execute trades, custody assets, or make financial decisions for you.

5. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases:

Performance of a contract: to provide the Service, authenticate your account, sync portfolio data, and operate core features you request.
Legitimate interests: to secure the Service, prevent abuse, maintain logs, improve reliability, troubleshoot errors, and protect legal rights.
Consent or user direction: where you choose to connect optional third-party sync providers or provide optional data.
Legal obligation: where we must retain or disclose data to comply with applicable law, regulatory requests, court orders, or lawful government requests.

You may withdraw consent for optional processing where applicable, but this will not affect processing already performed before withdrawal or processing based on another legal basis.

We do not sell personal data. We do not share personal data for third-party advertising or cross-app tracking.

We may share data in the following situations.

6.1 Service Providers and Infrastructure

We may use infrastructure and operational providers, such as hosting, database, deployment, networking, logging/monitoring, email, crash reporting, or support providers where applicable, to run the Service. These providers process data on our behalf to operate infrastructure and provide support. For example, the mobile apps use Google Firebase Crashlytics for crash diagnostics.

6.2 External Sync and Market Data Providers

When you use sync or valuation features, relevant data may be sent to or requested from external providers, including:

Bitget, for account assets, trade fills, and market price data.
Helius/Solana RPC infrastructure, for wallet assets, signatures, transactions, and token price metadata.
Jupiter price API, for token price data.
Binance market data endpoints, for historical SOL price data.

For example, if you connect a Solana wallet, the wallet address and related request metadata may be processed by Solana RPC infrastructure. If you connect Bitget, Bitget receives API-authenticated requests from or on behalf of your account. These providers may process data under their own terms and privacy policies.

6.3 Shared Portfolio Members

If you create, join, invite users to, or participate in a shared portfolio, authorized portfolio members may see portfolio data according to their role. This can include portfolio names, owner/member emails, roles, investment holdings, valuation data, allocations, and history.

6.4 Legal, Safety, and Business Transfers

We may disclose data if required by law, court order, legal process, or lawful government request; to enforce our Terms; to protect the rights, safety, or security of users, OLEGUM, or others; or in connection with a merger, acquisition, financing, reorganization, or sale of assets.

7. International Transfers

OLEGUM SRL is based in Romania. The Service may be used worldwide, and our service providers and third-party data providers may process data in countries other than your country of residence. Where required by applicable law, we use appropriate safeguards for international transfers, such as contractual protections or other lawful transfer mechanisms.

8. Security

We use technical and organizational measures designed to protect personal data, including:

Password hashing.
Token-based authentication.
Encrypted storage for mobile session tokens on supported platforms.
AES-GCM encryption at rest for backend sync payloads such as exchange credentials.
Role-based portfolio access controls.
HTTPS for production API traffic.
Limited mobile permissions.

No system is perfectly secure. You are responsible for keeping your account password, device, API keys, and wallet information secure. Do not share credentials with unauthorized people, and do not enter private keys or seed phrases into the Service.

9. Retention

We retain personal data for as long as needed to provide the Service, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

In general:

Account data is retained while your account remains active.
Portfolio, investment, snapshot, allocation, member, invite, and sync data is retained while needed for the Service or until deleted or de-identified.
Refresh tokens are retained while valid or until rotated, expired, replaced, or deleted.
Deleted investments may be retained as soft-deleted records to preserve sync behavior and prevent re-importing previously removed external trades.
Sync connections are deleted when you disconnect the provider, subject to backups and logs.
Operational logs and backups may be retained for a limited period for security, reliability, and disaster recovery.

If you request account deletion, we will take reasonable steps to delete or de-identify personal data associated with your account, unless retention is required or permitted by law, security, fraud prevention, dispute resolution, backup integrity, or other legitimate reasons. You can request deletion by emailing info@koral.solutions.

10. Your Choices and Rights

Depending on where you live, you may have rights to:

Access personal data we hold about you.
Correct inaccurate or incomplete personal data.
Delete personal data.
Object to or restrict certain processing.
Receive a portable copy of certain data.
Withdraw consent where processing is based on consent.
Lodge a complaint with a data protection authority.

To exercise rights, contact info@koral.solutions. We may need to verify your identity before fulfilling a request.

If you are in the European Economic Area, United Kingdom, or Switzerland, you may contact your local supervisory authority. As a Romanian company, our lead authority may be the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), depending on the circumstances.

If you are in a U.S. state with an applicable privacy law, you may have rights to know, access, correct, delete, or receive a copy of certain personal data, and to opt out of certain processing such as sale, sharing for cross-context behavioral advertising, or targeted advertising. We do not sell personal data and do not share personal data for cross-context behavioral advertising or targeted advertising.

11. Account Deletion Requests

To request deletion of your Portfold account and associated personal data:

Email info@koral.solutions from the email address associated with your Portfold account.
Use the subject line "Portfold account deletion request".
Include enough information for us to identify and verify the account.

After verification, we will process the request within a reasonable period required by applicable law. Some data may be retained where required or permitted for legal, security, fraud prevention, dispute, backup, or accounting reasons. If you are a member of a shared portfolio, deletion may affect your membership and access, but other members' data and independently controlled portfolio data may remain where legally appropriate.

12. Children

The Service is intended for users who are at least 18 years old or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact info@koral.solutions and we will take appropriate steps.

13. Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects about you. Portfolio calculations, allocations, and valuations are automated estimates based on user-provided data and third-party market data; they are informational only and may be inaccurate or delayed.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users, such as by updating the effective date, publishing the updated policy, or providing in-app or website notice where appropriate. Your continued use of the Service after an updated policy becomes effective means you acknowledge the updated policy.

15. Contact