Privacy Policy

We collect information in the following ways:

• Account information: When you create an account, we collect your name, email address, and password.
• Google Sign-In: If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Profile information you provide: Date of birth, country of residence, income range, employment status, investment experience, investment goals, risk tolerance, number of dependents, monthly expenses, retirement targets, and safe withdrawal rate.
• Financial information: Portfolio data, transaction history, account balances, and investment preferences you input into the platform.
• Automatically collected information: IP address, browser type, device information, and pages visited.

We use the information we collect for:

• Providing and improving our services
• Creating and maintaining your account
• Personalising your dashboard, insights, and financial projections
• Powering features like the FI calculator, retirement planner, and portfolio analytics
• Sending you service-related announcements and updates
• Responding to your inquiries and customer support requests
• Detecting and preventing fraud or security issues
• Complying with legal obligations

Authorised personnel (including Anchorfolio's founder/operator) may access your account data to provide support, debug issues, prevent fraud, or comply with legal obligations. Your individual account data is never used to inform personal investment decisions or shared with anyone in an identifiable form.

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for data in transit
• Encrypted storage for sensitive data
• Secure authentication mechanisms (including OAuth 2.0)
• Optional two-factor authentication with an authenticator app. The secret behind your codes is stored encrypted and your recovery codes are stored only as keyed hashes; both are deleted when you turn two-factor authentication off or your account is deleted.
• Security emails, for example when your account is signed in from a new device, your password changes, or two-factor authentication is turned on or off. They are always sent, whatever your email preferences, because they protect your account.
• Limited access to personal data (need-to-know basis)

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal information as long as your account is active or as needed to provide services. You can request deletion of your account at any time, and we will remove your personal data within 30 days, except where we are legally required to retain it.

Transaction history and financial records may be retained longer for:

• Compliance with financial regulations
• Tax and accounting purposes
• Legal and dispute resolution

Signed-in sessions (browser and operating system, sign-in time, last activity and IP address) are kept while the session is active and deleted 30 days after it ends. To recognise a new device for sign-in alerts, we keep a hashed identifier for each browser you sign in from, for 400 days after it was last used.

We do NOT sell your personal information, and we do not share it with advertisers. We may share your information with:

• Infrastructure providers: Cloud hosting services that store data on our behalf
• Authentication providers: Google (only during sign-in, to verify your identity)
• Product analytics: PostHog, only after you consent, to understand how the product is used and to improve it, including session recordings. Monetary amounts, holdings, and account names are masked in your browser before a recording is sent — see "Cookies and similar technologies" below for details
• Legal requirements: When required by law or to protect our rights
• Business transfers: In case of merger, acquisition, or sale of assets

Under GDPR and Romanian data protection law, you have the following rights:

• Right to access: You can request a copy of your personal data
• Right to rectification: You can correct inaccurate information
• Right to erasure: You can request deletion of your data ("right to be forgotten")
• Right to restrict processing: You can limit how we use your data
• Right to data portability: You can request your data in a portable format
• Right to object: You can object to certain types of processing
• Right to withdraw consent: You can withdraw consent at any time

To exercise these rights, contact us at support@anchorfolio.com

Your information is processed in accordance with the General Data Protection Regulation (GDPR). Our legal basis for processing your data includes:

• Contractual necessity: Processing needed to provide the service you signed up for
• Legal compliance: Processing required by law
• Your explicit consent: For optional profile data you choose to provide
• Legitimate business interests: Platform security and fraud prevention

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will delete such information and terminate the child's account.

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review the privacy policies of any third-party sites before providing your personal information.

You can control how we communicate with you:

• Marketing emails: You can opt-out at any time using the unsubscribe link
• Service notifications: Essential service emails cannot be disabled

We will respect your preferences within 10 business days.

If you subscribe through a landing-page or calculator form, we collect only your email address for this purpose. The legal basis for sending marketing emails is your consent: you give it by submitting the form and then confirming your address through the email we send.

Resend processes the address on our behalf as our email-service provider. You can withdraw consent at any time, in one click, through the unsubscribe link included in every marketing message. If you do not confirm, your address is never stored in our marketing list.

We may update this Privacy Policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of significant changes by email or through a prominent notice on our platform.

Your continued use of the platform following the posting of a revised Privacy Policy means that you accept and agree to the changes.

Strictly necessary storage does not require consent. We use authentication session cookies and a device cookie (af_device) that recognises your browser for security alerts, and we store your theme preference, locale preference, and cookie-consent decisions so the service and your choices work correctly.

With your consent, we use PostHog first-party cookies whose names begin with ph_ for product analytics and session recording. Recording runs across the application, including pages inside your signed-in account, not only public pages. Monetary amounts, holdings, and account names are masked in your browser before a recording is sent, so the recordings PostHog processes never contain them. These cookies last for approximately 12 months. Analytics and session recording load only if you grant that consent, whether by choosing Accept all or by saving your choices with analytics turned on. PostHog may process data in the United States under Standard Contractual Clauses.

Advertising measurement is a separate cookie category from analytics. It shows us whether an ad led to a signup, and you can accept or refuse it independently — granting one does not grant the other.

You can withdraw or change either consent at any time by selecting Cookie preferences in the footer. Withdrawing analytics consent stops new session recordings and removes PostHog storage from this browser.

Vercel Speed Insights measures anonymous, aggregated site performance without using cookies.

If you have questions or concerns about our Privacy Policy or our privacy practices, please contact us:

Email: support@anchorfolio.com

Location: Bucharest, Romania

We will respond to your inquiry within 30 days.