Privacy Policy
Effective Date: June 4, 2026
Ardfolio (“we,” “our,” or “us”) is an investment portfolio tracking service operated by PT Aplikasi Kertas Digital. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Ardfolio iOS app and related services.
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Handle — your unique public identifier (alphanumeric, 3–30 characters)
- WebAuthn credential — a public key bound to your device’s Secure Enclave, used for passkey authentication
No email address, password, or name is required. Authentication uses platform passkeys (iCloud Keychain on Apple devices). You may optionally provide a display name in your profile settings.
1.2 Device & Security Information
The Ardfolio iOS app authenticates using Apple’s App Attest framework. To secure your session we collect:
- Device identifier — a random UUID your device generates
- App Attest credential — ECDSA P-256 public key and credential ID used to verify your device’s integrity
- Assertion counter — a replay-protection counter that increments with each authentication
- Fraud risk score — provided by Apple’s fraud assessment service when you attest your device
This information is collected for security purposes and is not used to track you across apps or websites.
1.3 Portfolio Data
To provide portfolio tracking functionality:
- Asset holdings, liability records, portfolio structure, and preferred currency are stored in your personal iCloud account via CloudKit
- Portfolio calculations (total value, gains, returns) are performed entirely on your device
- The backend provides market price data only — it never stores your portfolio data
1.4 Subscription & Payment Data
If you purchase a premium subscription through the iOS App, we store:
- Apple StoreKit transaction data — transaction ID, product ID, subscription status, and expiry dates
- Receipt data — cryptographically signed App Store receipts for validation
Payment processing is handled entirely by Apple via StoreKit. We do not process or store payment card information.
1.5 Server Logs
When you visit this website or use the API, we automatically collect:
- IP address — logged for security purposes
- Request metadata — timestamps, endpoints accessed, error rates
- Session cookies — signed, encrypted cookies for web authentication (no third-party advertising cookies)
2. How We Use Your Information
| Purpose | Data Used |
|---|---|
| Account creation & authentication | Handle, WebAuthn credential, device ID, App Attest credentials |
| Portfolio tracking & sync | Asset holdings, liabilities, portfolio structure, preferred currency |
| Subscription management | StoreKit transaction data, receipt data |
| Security & fraud prevention | IP address, device ID, App Attest credentials, fraud risk score |
| Service improvement | Server metrics (anonymized), activity logs |
| Customer support | Account data as needed |
| Legal compliance | All data as required by applicable law |
We do not:
- Sell your personal information to third parties
- Use your portfolio data for advertising or marketing
- Share your financial holdings with external data brokers
- Train machine learning models on your portfolio data
- Access your iCloud-stored portfolio data (it remains on your devices)
3. Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Apple | App Attest device verification, StoreKit purchase validation, iCloud/CloudKit sync | Device attestation receipt, transaction ID, iCloud account identifier |
| Hetzner | Server hosting (Singapore) | Server logs, database storage |
4. Data Retention
| Data Category | Retention Period |
|---|---|
| Account information | Duration of account + 30 days after deletion |
| Device credentials | Until device is deauthorized or account deleted |
| App Attest nonces | 5 minutes (single-use authentication challenges) |
| Activity logs | 90 days |
| Session tokens | 15 minutes (JWT) + 30 days (refresh token) |
| Subscription records | Duration required for financial record-keeping (minimum 7 years) |
| Market data | Indefinite (public, non-personal data) |
5. Data Security
We implement security measures including:
- App Attest — hardware-backed device attestation to prevent unauthorized clients
- WebAuthn passkeys — phishing-resistant authentication using platform passkeys (Secure Enclave on Apple devices)
- Proof of Possession (PoP) — cryptographic binding between session tokens and device keys
- Short-lived sessions — JWT sessions expire in 15 minutes; refresh tokens expire in 30 days with rotation
- Rate limiting — API rate limits to prevent abuse
- TLS everywhere — all communications encrypted in transit
- iCloud end-to-end encryption — portfolio data stored in your personal iCloud account
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your account and associated data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to certain processing activities
- Withdraw consent — withdraw consent where processing is based on consent
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
Indonesia — UU PDP (Law No. 27 of 2022)
As a service operated from Indonesia, we comply with the Indonesian Personal Data Protection Law. You have the right to file a complaint with the Indonesian data protection authority if you believe your rights have been violated.
7. Children’s Privacy
The Service is not intended for individuals under the age of 17. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.
8. International Data Transfers
Your data is stored on servers located in Singapore. If you access the Service from outside Indonesia, your data may be transferred to and processed in Singapore. We ensure appropriate safeguards are in place for any cross-border data transfers.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy on this page
- Displaying an in-app notice (for mobile app users)
Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
10. Contact Us
- Email: [email protected]
- Operator: PT Aplikasi Kertas Digital
- Website: https://ardfolio.com
This policy was last updated on June 4, 2026.