Privacy notice
In short
- Wara.folio has no user accounts and does not store your financial figures on its server. The figures you enter stay in your own browser on your own device. Hosting and security services process technical request data as described below.
- We count visits with Cloudflare Web Analytics, which sets no cookies and does not identify you. We use no advertising or tracking cookies.
- Your browser loads public ECB exchange rates from Wara.folio’s shared cache. No financial amounts are sent. If you enable dividend-date lookups, your browser sends public ticker/ISIN identifiers to Wara.folio’s shared DivvyDiary cache. Quantities, balances, account names and your personal API keys are not sent with those requests. Wara.folio fetches and caches public instrument records from DivvyDiary; the provider sees Wara.folio’s server request rather than your direct browser request. See the data sources page for provider status. If you add your own Finnhub key, it also contacts Finnhub for prices, news and dividend payment history. Only public ticker symbols and currency codes are sent, never your amounts. If you press "Look up" on an Estonian property, it sends that property's cadastral number or address to the Estonian Land Board.
Wara.folio also stores small request counters and cooldown times in this browser’s IndexedDB to limit external lookups across tabs and reloads. These contain no symbols, API keys or financial figures and are not sent to us.
Your acknowledgement of the current Terms version, the time you agreed and your optional dividend-lookup preference are stored only in this browser. They are not sent to Wara.folio’s server. This acknowledgement does not subscribe you to marketing.
Who is responsible
Magrix. Contact: [email protected].
What stays on your device
Bank credentials and financial responses must never pass through Wara.folio servers. The optional background connector runs on your computer and contacts providers directly. Its one-time setup installs public code, starts it at computer login and registers a local app link. Sync normally stays in the website; your browser may ask permission for local access. Browsers that block in-page local access, including Safari, can use an explicitly selected reader window. Background startup alone makes no bank requests. Uninstall instructions are included with the download.
If you connect IBKR with the optional local connector, its reporting token and Query ID are saved separately in your browser’s encrypted vault and excluded from ordinary portfolio JSON exports. On an eligible seven-day check after unlock, or when you choose Sync now, the unlocked vault passes the credentials directly to the local connector. It uses them in memory to retrieve a report from IBKR and returns it to your browser. The connector uses no macOS Keychain, pairing keys, credential files or saved report files. Wara.folio’s public server does not receive the credentials or reports. Imported positions, cash and sync status remain in your encrypted vault. Removing saved credentials makes no provider request and does not revoke the token at IBKR.
The optional LHV connection uses the same local reader. Access and rotating refresh tokens stay in your encrypted vault and are excluded from ordinary portfolio exports. Choosing Sync LHV passes the credentials temporarily to the reader, which contacts LHV directly. Replacement tokens must be saved in the encrypted vault before a report is read. Optional cash requests retrieve today’s statement balances; transaction details are removed by the reader. Imports require your review and keep an encrypted pre-import recovery copy on this device. LHV checks are manual in this version. Removing credentials here does not revoke access at LHV; revoke it through your LHV account.
Wise Personal and Business connections store their tokens separately in your encrypted vault, outside ordinary portfolio exports. The local reader contacts Wise directly to check permitted profiles, balances and jars, and removes unrelated profile identity details before returning the result. Your explicit first mapping identifies which assets belong to each Wise profile. Optional weekly checks on unlock can update previously approved balances; new, missing or reclassified balances require review. Access failures retain saved figures. No checks run while your vault is locked or browser closed, and Wara.folio’s server receives no credentials or bank reports. Removing a connection clears its saved token here but does not revoke it at Wise.
Provider selections and connection labels are stored with your profile on this device. Adding a provider alone makes no bank request. Revolut entries currently provide manual/import setup only, without collecting Revolut credentials.
Standard bank statement imports (ISO 20022 camt.053/.052, MT940 and OFX) are read on this device. Provider names, account identifiers, booked balances, statement dates and the saved conversion rates used for foreign balances are stored with your figures. Available funds and credit limits are excluded. File contents are not uploaded. Imports create a pre-import recovery copy, encrypted when using the personal vault. Downloaded recovery backups are unencrypted.
Swedbank investment statement import reads a UTF-8 CSV or pasted spreadsheet table on this device. You select the columns and confirm a complete holdings snapshot and its invested EUR total before applying it. Cash is unchanged. No bank login, statement contents or account reference are sent to us. Holdings and the pre-import recovery copy stay in your encrypted vault. Downloaded recovery backups are unencrypted.
Lightyear statement import parses a copied portfolio table on this device and previews the holdings before you confirm. Cash balances are entered and reviewed separately. No Lightyear credentials or statement contents are sent to us, and no raw PDF is uploaded. Applied holdings and the pre-import recovery copy stay in your encrypted vault. Downloaded recovery backups are unencrypted.
Everything you enter or import (assets, loans, holdings, notes, settings, profile names) is saved in your browser's local storage on your device, encrypted with a key that only your passphrase or recovery key can unlock. It is not sent to us, and we cannot see, recover or delete it. If you lose both your passphrase and your recovery key, nobody can open the figures; only a backup file you exported can restore them. Backup files you export are not encrypted, so keep them somewhere private. This storage is needed for the service to work, so it does not need consent.
Personal OpenAI, Anthropic or Google Gemini API keys are also stored in your encrypted vault on this device, separately from portfolio data, and excluded from ordinary JSON exports. They are available to the app while the vault is unlocked. Saving or removing a key makes no provider request. Clearing this device removes the saved key; revoking it at the provider is a separate action.
The same applies to an optional Finnhub key you save. It stays in your browser and is not included in backups you export.
Optional transfer to a new site address copies your existing encrypted vault directly between windows in this browser, after you confirm it at the previous address. The encrypted copy includes your saved provider keys; your passphrase and recovery key remain the same. No vault contents or keys are uploaded to our server or put in a URL. The original remains at the previous address. Replacing an existing destination vault requires confirmation and keeps an encrypted rollback copy on this device. This is a one-time copy, not continuing synchronisation.
You can delete everything at any time with Data → Clear this device in Wara.folio, or by clearing this site's data in your browser. Clearing browser data or using a private window also removes it, so export a backup if you want to keep your figures.
What our host processes
The site is served by Hetzner Online GmbH. As with any website, the host receives technical data when you load the pages: your IP address, browser type, the pages requested and the time. This is used only to deliver the site and keep it secure. Our legal basis is our legitimate interest in running a secure website (GDPR Article 6(1)(f)). The host acts on our behalf and keeps these logs under its own retention rules: Hetzner Online GmbH privacy information.
Pages pass through Cloudflare, Inc., which protects and speeds up the site. Cloudflare sees the same technical data while delivering the pages and processes it on our behalf: Cloudflare privacy policy. Your figures never pass through Cloudflare or our server.
To know how many people use Wara.folio, we use Cloudflare Web Analytics. When a page loads, a small script from Cloudflare (static.cloudflareinsights.com) reports the page address, where you came from, your browser and device type, and page load times. It sets no cookies, does not store anything on your device, and does not build a profile of you or follow you across sites. We only see totals, such as visits per day and visits per country. It never sees your figures. Our legal basis is our legitimate interest in knowing how the site is used (GDPR Article 6(1)(f)). You can block it with a content blocker without affecting Wara.folio.
Tax rules and exchange rates
When you open Wara.folio, your browser loads the current tax rules and exchange rates from this site (the files under /data/). These are the same public files for everyone; nothing about you is sent with the request beyond the technical data described above. Our server keeps them up to date on its own: it reads the European Central Bank's published rates and the official pages the rules cite, and it may ask Anthropic's Claude to check a rule against those official sources. None of this involves you or your figures. The local edition of Wara.folio, which runs on your own computer, loads the same files from this site each time it starts; the request is the same and carries nothing else.
Services your browser contacts
- Wara.folio’s shared ECB cache, for latest and historical euro reference exchange rates. Latest rates are the same public snapshot for everyone; historical files are selected by currency and calendar year. Our server receives those public identifiers and the technical request data described above, never your quantities or amounts. The ECB receives a scheduled bulk download from our server, rather than a request from each visitor.
- Maa- ja Ruumiamet, the Estonian Land and Spatial Development Board (inaadress.maaamet.ee and gsavalik.envir.ee), only when you press "Look up" next to an Estonian property's address. The request contains the cadastral number or the address you typed for that property, to fetch its public land value. The Board receives your IP address as part of the request.
- Estonian Building Register (devkluster.ehr.ee), only when that lookup is by address and the floor area, or a flat's share of the plot, is left blank. The request contains the building's register code, found from the address, to fetch the public floor areas of the building and its flats. The register receives your IP address as part of the request.
- Finnhub (finnhub.io), only if you add your own key. The request contains public ticker symbols and your key. Finnhub is based in the United States and processes these requests under its own terms and privacy policy, which you accepted when you created the key.
- Wara.folio’s shared DivvyDiary cache, only when you enable dividend-date lookups. Public ticker/ISIN identifiers and technical request data reach Wara.folio’s server; your portfolio amounts and account details do not. Shared records are cached independently of users. You can stop future requests under Data source; this does not remove records previously saved in your browser or public server cache.
- Optional AI research (api.openai.com, api.anthropic.com or generativelanguage.googleapis.com), only when you save your own API key and explicitly send a research question. Your browser sends the key as authentication directly to your chosen provider, along with your question, preferences, saved ideas, recent conversation and any investment holdings/allocation totals you choose to include. Wara.folio’s backend does not receive this key or research payload. Provider API billing, access, privacy and retention rules apply; enabling current-source research may also use the provider’s web-search tools. Questions, notes and earlier conversations can contain information you typed, so review the context before sending.
- Links you open, such as news links to Yahoo Finance, Google News or a publisher, take you to those sites, and their own privacy policies apply.
Market-data lookups do not send your financial amounts or account details. Optional AI research sends the selected context described above directly to your chosen provider, only when you request it.
Your rights
Under the GDPR you can ask for access to, correction or deletion of personal data we hold, object to its processing, or ask us to restrict it. Apart from the host's technical logs, we hold none. Write to the contact address above.
You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or to the data protection authority where you live.
Changes
If how Wara.folio handles data changes, we update this page and its date.
Wara.folio keeps a shared PostgreSQL registry of verified public listing identities (ticker, exchange, ISIN, currency, source and verification time), ECB daily exchange-rate history, and public per-share dividend events with source provenance and revision history. These records are the same for everyone; they contain no users, portfolios, holdings, quantities, balances, account details or personal keys. Database-backed caches serve normal requests. The backend can reuse dividend facts in memory for up to seven days, with writes invalidating the affected security immediately; missing results use a shorter cache lifetime. This memory cache is separate from external-source refresh deadlines. Dividend lookups check shared stored history first; only missing or due data triggers an external lookup, and validated results are stored automatically by the server. Missing records do not imply cancelled payments, and failed checks retain the last usable facts and their original fetch time. Personal API responses, received amounts and manual schedules are not uploaded into this shared registry. A verified identity is reused across visitors; source dates control revalidation. ECB is downloaded in one shared publication-day snapshot, with its daily attempt recorded so a missing cache file or restart does not multiply source requests. Database or upstream failures retain usable cached data.
Stock price refreshes use weekdays in the listing’s time zone. Weekends reuse the last known quote; failed or deferred refreshes retain that price and its original timestamp, or the saved statement value when no quote exists. Weekday prices are cached for three hours, reference prices for six hours. One bounded backend batch returns cached reference prices; only missing or expired prices enter the shared source queue. Cache reads do not consume external-provider allowances. Exchange holidays are not inferred from the weekday rule.
Optional reference prices: if you enable these under Data source or at start-up, Wara.folio first resolves supported European listings from official Xetra and Euronext stock/ETF catalogues, matching the full ticker and exchange to a unique, checksum-valid ISIN. Saved ISINs are checked for conflicts. The catalogues are shared public bulk downloads, reused for one day; no portfolio is sent to an exchange. Wara.folio then checks the exchanges’ dedicated MiFIR delayed-trade services. Delayed trade timestamps are shown explicitly; retrieval time is not substituted for trading time. DivvyDiary is the last price fallback when no usable official quote is available. Another listing is used only for the verified same ISIN and is labelled with its source listing. Discovered identities are reused automatically; ambiguous matches require an explicit ISIN. Successful reference prices and shared trade summaries are reused for six hours; empty/outage responses back off and retain the last usable data. Only public security identifiers reach Wara.folio and the relevant exchange service, never quantities, balances, account names or keys. Currency conversion uses ECB reference rates in your browser. Dividend history remains a separate optional source; exchange trade feeds do not provide dividend payment schedules.
The dedicated delayed-trade services have specific terms for free, non-commercial use and distribution; this does not grant unrestricted rights to the exchanges’ other website content or real-time data. Wara.folio is offered without a fee. Paid redistribution, charging for access, or commercialising a derived data service requires the appropriate exchange licence. Deutsche Börse delayed-data terms; Euronext delayed-data terms. The experimental DivvyDiary fallback still has unconfirmed provider permission and may be suspended.