Privacy Policy

Last updated: June 2026

Data controller

MALA GESTION (SAS), SIREN 994 483 477, 1C Impasse des Osiers, 57100 Thionville, France.
Contact: contact@fireflyer.net

Data collected

• Google identity: email address, display name and unique Google identifier (sub) — collected during OAuth sign-in.
• Portfolio data: financial assets (name, ISIN, quantities, prices, average cost), dividends, real estate, loans, savings, cryptocurrencies — entered directly by the user.
• Technical logs: IP address, request timestamps — collected automatically for security purposes.

Purposes and legal basis

• Performance of contract (Terms of Service): authentication, portfolio storage and display.
• Legitimate interest: security logs, abuse prevention, rate limiting.

Retention

Portfolio data is retained while the account is active and permanently deleted upon account deletion.

Technical logs (access, errors, security events) are retained for a maximum of 90 days at Railway Inc. (infrastructure) and Sentry Inc. (monitoring). No financial values or portfolio data are present in these logs.

Security

Sensitive fields (asset names, notes, institutions) are encrypted at rest (AES-128-CBC via Fernet). All communications are secured by HTTPS (TLS 1.2+). Access to data is strictly limited to the authenticated user.

Data sharing

No personal data is sold, rented or shared with third parties for commercial purposes. Data is processed only by the following sub-processors:

• Railway Inc. (hosting, San Francisco, USA) — covered by EU Standard Contractual Clauses (SCCs) compliant with GDPR (Railway DPA);
• Google LLC (OAuth authentication, USA) — no portfolio data transmitted; covered by EU SCCs;
• Stripe Inc. (subscription payments, San Francisco, USA) — receives email address, billing data and a customer identifier; covered by EU SCCs (Stripe DPA);
• Sentry Inc. (error monitoring, San Francisco, USA) — receives only anonymised error traces (PII disabled, send_default_pii=False); covered by EU SCCs (Sentry privacy policy);
• Resend Inc. (transactional email, USA) — receives only email addresses for service emails (welcome, Pro activation); covered by EU SCCs — this sub-processor will be activated shortly.

Your rights (GDPR)

Under Regulation (EU) 2016/679 (GDPR), you have the following rights:

• Access and portability: export all your data via Account settings → Export my data.
• Erasure: delete your account and all data via Account settings → Delete my account.
• Rectification, restriction, objection: contact contact@fireflyer.net.

You may also lodge a complaint with your national supervisory authority (in France: the CNIL).

Third-party data sources

To fetch financial asset prices, FireFlyer queries:

• Yahoo Finance (finance.yahoo.com) — stock prices, ETFs, cryptocurrencies. Privacy policy.
• Financial Times Markets Data (markets.ft.com) — supplementary market data. Privacy policy.

These services receive no personally identifiable data: only security identifiers (ISIN, ticker symbols) are sent in requests.

Cookies

FireFlyer uses only strictly necessary cookies:

• Session cookie (session): maintains authentication during your browsing session. Deleted on browser close or sign-out.

No tracking, advertising or analytics cookies are placed without your explicit consent.

Data Processing Agreement (DPA)

Professional users wishing to enter into a Data Processing Agreement may submit a request to contact@fireflyer.net.

Contact

For any questions regarding your personal data: contact@fireflyer.net