Privacy policy
Effective 28 October 2026
In short: your portfolio is yours. We store what you enter so we can show it back to you and keep it safe across your devices. We never sell it or use it for advertising, and screenshots never leave your phone.
Who we are
Folio is an app for keeping track of the shares and other investments you hold with your brokers, on the Nairobi Securities Exchange and offshore. It brings them into one portfolio, valued in Kenya shillings.
Folio is powered by PhillQins Hub, which is responsible for your personal data (the data controller) under Kenya's Data Protection Act, 2019. You can reach us at folio@phillqinshub.com.
What we collect
- Your account: your email address and the nickname you choose. If you sign up with a password, our sign-in provider stores it only as a secure hash; we can never see it.
- If you continue with Google: the name and email address on your Google account, which Google shares with us when you choose to sign in that way. We use your first name as your nickname.
- Your portfolio: the brokers you add, an optional nickname for each account, the last 4 digits of its CDS number if you choose to enter them, the cash you record, and your holdings (which shares, how many, and their average cost).
What stays on your phone
Your settings, such as app lock, hide balances and the theme, are kept on your phone only. App lock uses your phone's own fingerprint or screen lock; we never receive your fingerprint or PIN.
What we never collect
- Your broker logins or passwords. Folio doesn't connect to your broker accounts.
- Your full CDS number: only its last 4 digits, to tell your accounts apart.
- Your screenshots or photos. When you import holdings from a screenshot, it's read on your phone and discarded; only the rows you confirm are saved.
- Analytics, advertising identifiers or tracking data. The app contains no analytics, advertising or crash-reporting tools.
How we use your data
Only to run Folio for you:
- to show your portfolio and its value, and keep it in sync between your devices;
- to sign you in and keep your account secure;
- to send you account emails, such as confirming your address or resetting your password.
We don't sell your data, share it for advertising, or use it to profile you. We rely on your consent, given when you create an account, and on what's needed to provide the service you asked for.
Who processes it for us
We use a small number of service providers, each bound to protect your data and use it only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in: stores your account and portfolio | Europe |
| Resend | Sends account emails (confirmation, password reset) | Ireland, EU |
| Only if you choose "Continue with Google": confirms who you are | Google's global infrastructure | |
| Cloudflare | Hosts this website and handles email sent to us | Global network |
Share prices and exchange rates come from market data sources. We don't send them any of your personal data.
Storing your data outside Kenya
Our database provider has no data centre in Africa, so your account and portfolio are stored in Europe, the nearest region to Kenya it offers. This is a transfer of personal data outside Kenya under the Data Protection Act, 2019. To protect it:
- data is encrypted in transit (TLS) and at rest;
- access rules in the database let each account read and change only its own data;
- our providers are bound by data protection terms, and Europe's data protection law (the GDPR) applies where the data is held.
When you create an account, you consent to this transfer. You can withdraw that consent by deleting your account.
How long we keep it
We keep your data for as long as you have an account. When you delete your account in Settings, your account and portfolio are deleted from our database straight away. Copies in our provider's encrypted backups are removed as those backups expire, usually within a few weeks. Settings kept on your phone are removed when you uninstall the app or clear its data.
Security
Besides encryption and per-account access rules, you can lock Folio with your fingerprint or screen lock and hide balances on screen. Keep your password private, and tell us straight away if you think someone else has used your account.
Your rights
Under Kenya's Data Protection Act, 2019, you have the right to:
- be told how your data is used (this policy);
- see the data we hold about you, and get a copy of it;
- correct data that's wrong: you can edit your profile, accounts and holdings in the app;
- have your data deleted: Settings › Delete account removes it all;
- object to how we use your data, or withdraw your consent.
To use any of these rights, or for a copy of your data, email folio@phillqinshub.com from the address on your account. We'll reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Data Protection Commissioner.
Age
Folio is for people aged 18 and over. We don't knowingly collect data from anyone younger; if you think we have, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change affects how we use your data, we'll tell you in the app before it applies.
Contact
Folio, powered by PhillQins Hub · folio@phillqinshub.com