my portfolio

Privacy Policy

Version 2.0. Effective 13 August 2026. This replaces the policy dated 9 November 2025.

The short version

You type your household's figures into My Portfolio yourself. We store them so they are there on your other phone, and on your partner's phone if you share a portfolio with them. The app adds them up and shows you the result.

We do not connect to your bank. We do not ask for a bank login. We do not sell your figures, we do not advertise to you, and we do not use your figures to train anything. The rest of this page is the detail, written plainly, because a page about your money should be readable by you and not only by a lawyer.

Three things worth knowing before you start. If you share a portfolio with your partner, they see and can change everything in it, and there is no partial view. Deleting your account does not cancel a subscription you bought from Apple or Google, and you cancel that with them. And we are not end-to-end encrypted: we can reach your figures if we need to fix something, and we say so plainly further down.

One more. Australian privacy law treats a business this small differently from a big one, and that changes where you can take a complaint about us. We explain it under "Where Australian privacy law leaves you", near the bottom of this page.

Who we are

My Portfolio is run by Jesse Thomson, trading as Emerald Websites, ABN 68 410 407 820. That is a sole trader, not a company. There is no Pty Ltd, no parent company and no group of related businesses, so nothing on this page refers to "affiliates" or "our companies" — there aren't any. When this policy says "we", it means that one person.

You can reach us about anything on this page at info@emeraldwebsites.com.au.

Post: [REVIEW — BLOCKING: insert the postal address for privacy and legal requests], Emerald, Queensland, Australia.

What we collect and hold

Your account

When you create an account we hold your email address, the display name you give (or the one your sign-in provider gives us), the account identifier Firebase assigns you, and the times your account was created and last signed in. Those sit in Firebase Authentication, which is Google's sign-in service. The current app does not keep a separate profile record of its own about you.

If you sign in with Apple or with Google, we receive the identifier that provider gives us and the email address and name you allow them to share. If you use Apple's Hide My Email, what we hold is the private relay address Apple generates, not your real one. We never receive your password from any of them.

If you sign in with an email address and password, Firebase Authentication handles the password. We never see it and we cannot recover it.

The figures you enter

Everything financial in My Portfolio is typed in by you or by someone you have invited into your portfolio. Specifically, we hold:

  • Assets. The name you give each one, which kind it is (property, shares, cash, bonds or other), and its value in dollars.
  • Liabilities. The name, the balance owing, and where you have entered them, the interest rate and the monthly repayment.
  • Income. The name of each income source, the amount, how often it arrives, and whether you marked it as income that pays you whether or not you work.
  • Expenses. The name of each one, the amount, how often it is paid, and which category you put it in.
  • Things you have named but not given a figure for. If you add an expense and leave the amount blank, we record that. That way the app can leave it out of your totals instead of pretending it is zero.
  • Your portfolio itself. The name you gave it, who owns it, who is in it, and when it was created.

The name of every asset, loan, income source and expense is a free-text box. Whatever you type into it is what we store. If you name a property by its street address, or a loan by your bank, then we hold your street address or your bank's name — not because we asked for it, but because you wrote it there. There is no field in the app that asks for an address, an account number, a bank, a super fund or a share ticker, and we would rather you did not put them in the name.

Those figures are personal information. They are not anonymous statistics: every one of them is stored against your account, so they are information about you.

Records carried over from the older version of the app

My Portfolio's earlier version asked for more detail than this one does. If you used it, your records may include things the current app never asks for: a property's street address and type, a purchase date and purchase price, a bank name, a superannuation provider, a share ticker, quantities and per-share prices, a bond issuer, and free-text notes.

If your household has moved to the new version, those older records were copied across in full and kept alongside the figures the new app uses, so that nothing you had entered was lost in the move. If your household has not moved across yet, they are still held under the older layout. Either way we still hold that extra detail, everything on this page covers it, including the deletion section, and when we delete your records it goes with them.

What we do not collect

  • No bank connections. My Portfolio does not connect to any bank, broker, super fund or open banking feed. We do not ask for a banking login, and there is nowhere in the app to give us one. If anything ever asks you for a bank password in our name, it is not us.
  • No location. The app does not ask for or record where you are.
  • No contacts, photos, camera or microphone.
  • No push notification tokens. The app does not send push notifications, so there is nothing to collect. The previous policy said otherwise and was wrong.
  • No advertising identifiers, and no advertising or marketing trackers of any kind.
  • No analytics or crash-reporting tools. The app does not carry one. The previous policy disclosed crash logs and performance data; the rebuilt app collects neither.
  • No third-party fonts, tag managers or embedded scripts. The app loads its own files and nothing else.

Subscriptions

My Portfolio's paid features are bought through the App Store or Google Play, not from us directly. We never see your card, your bank account or your billing address. Apple and Google handle payment and never pass those details to us.

To know whether your subscription is active, we use RevenueCat, which sits between the app and the two stores. RevenueCat holds an identifier for your app install, which product you bought, whether you are in a free trial, and whether your subscription is currently active. It does not receive any of your financial figures. Nothing you type into My Portfolio is ever sent to it.

How we collect it, and where it is held

We collect it two ways only: you type it into the app, and your sign-in provider passes us the details described above when you sign in. We do not buy data about you, we do not receive it from data brokers, and we do not build a picture of you from anywhere else.

Your portfolio's figures are stored in Cloud Firestore, a Google service, in the region [REVIEW — BLOCKING: read the Firestore location off the Firebase console for project my-portfolio-app2 and write it here. Do not publish this paragraph, or the overseas section below, until someone has looked]. The small pieces of code that run on our behalf — the ones that handle invitations and account deletion — run in Google's Sydney region (australia-southeast1).

Your sign-in record — your email address, your account identifier and your sign-in times — is held by Firebase Authentication, which is a Google service we do not get to pin to a particular country. We would rather tell you that than imply everything is onshore.

The app itself, and this website, are delivered to your device by Cloudflare. Cloudflare sees the internet address your device connects from and which page you asked for, and keeps a short technical log of that. It does not see your figures: those travel from your device straight to Google's database, not through us.

A copy of your portfolio is also kept on your own device, so the app opens instantly and keeps working when you have no signal. That copy lives inside the app's own storage on your phone or computer and goes when the app does.

When our code runs, Google keeps a technical log of it. Those logs record account and portfolio identifiers and what the code did. They do not contain any of your financial figures, your asset names or your expense names.

Why we hold it

  • Your figures are held to do the arithmetic you asked for, show it back to you, keep it in step across your own devices, and share it with anyone you have invited into your portfolio. That is all.
  • Your email address and account details are held to create your account, sign you in, let you reset your password, and contact you about the service or your billing.
  • Subscription details are held to know whether your paid features should be switched on.
  • Invitation records are held to let an invitation be accepted once, expire, and be withdrawn.

What we never do with your figures

These are commitments, not aspirations. Each is a statement we can be held to.

  • We do not sell your information. Not to anyone, not in any form.
  • We do not use your figures for advertising or marketing, ours or anyone else's.
  • We do not use your figures to train any model, ours or anyone else's.
  • We do not pass your figures to anyone except the infrastructure providers named on this page, who store and process them on our instructions.
  • We do not look at individual households' figures out of interest. We can reach them through the administration console — see the security section, where we say so plainly — and we open them only to fix a fault you have reported, to answer a request you have made, or where we are legally required to.

Sharing a portfolio with someone else

My Portfolio is built for a household, so a portfolio can have more than one person in it. This is the part of the app with the biggest privacy consequence, and it deserves its own explanation.

What the other person can see

Everything. A person who joins your portfolio sees every asset, every liability, every income source and every expense in it, including the names you gave them and any notes carried over from the older app. They can also add, change and delete any of it. There is no view-only role and no partial view. If it is in the portfolio, they have it.

That is deliberate — it is the point of a shared household record — but it means inviting someone is not like sharing a document. Invite the person you would hand your bank statements to, and nobody else.

How an invitation works

Only the owner of a portfolio can invite someone. When they do, the app creates an invitation link containing a secret. We store only a scrambled fingerprint of that secret, never the secret itself, so the invitation record on its own opens nothing.

The link is the key. Whoever opens that link and accepts it joins the portfolio, whatever email address they sign in with. Whoever opens it also sees the portfolio's name and the name, or the email address, of the person who sent it, before they have joined anything.

We do record the address the invitation was sent to, so the owner can see who they meant to invite. But that address does not control who can join. That is deliberate. People often sign in with a different address from the one you sent it to, especially if they use Apple's Hide My Email. So treat an invitation link like a house key. Do not forward it, and do not post it anywhere.

An invitation expires after fourteen days, can only be used once, and the owner can withdraw it at any time before it is used. An invitation nobody accepted is not swept away on its own: the record of it — the address it was sent to, the portfolio's name and who sent it — stays until the person who sent it or the person it was addressed to deletes their account.

What the other people in your portfolio can see about you

Everyone in a portfolio can see the display name and email address of everyone else in it, and when each of them joined. If you signed in with Apple's Hide My Email, what they see is the relay address, not your real one.

They cannot see anything else about your account, and nobody outside the portfolio can see any of it.

Leaving, and removing someone

The owner can remove any member. Any member can remove themselves. Nobody can remove the owner, not even the owner: removing the last person would leave the household's records with nobody able to open them. If you own a portfolio and want out of it, delete the portfolio, or delete your account — and if other people are still in it, ownership passes to whoever has been a member longest and the portfolio carries on without you.

Removing someone stops them seeing anything new from that moment. It does not undo what they have already seen, and their phone may keep the copy it had already downloaded until they delete the app. It also does not remove figures they entered while they were a member: those are part of the household's record and they stay.

We do not mediate between people who share a portfolio. If a relationship changes, the owner should remove the other person, and then decide whether to keep the portfolio or delete it. If you are worried about someone's access to your figures and you are not the owner, email us and we will explain your options honestly, including that the fastest one is usually to start a portfolio of your own.

Who else receives your information

We name every recipient, and what each one gets. There is no "and our partners" on this list.

  • Google LLC (Firebase and Google Cloud). Stores your sign-in record and everything in your portfolio, runs our invitation and deletion code, and keeps the technical logs of that code running.
  • Cloudflare, Inc. Delivers this website and the app to your device. Sees the internet address your device connects from and which page you asked for. Receives none of your figures.
  • Apple Inc. If you sign in with Apple, Apple handles that sign-in and knows you have an account with us. If you subscribe on an Apple device, Apple processes the payment and holds the purchase record.
  • Google (Google Play). If you subscribe on an Android device, Google Play processes the payment and holds the purchase record.
  • RevenueCat, Inc. Receives your subscription and entitlement status and an identifier for your install. Receives none of your figures.

Each of those companies handles what it receives under its own privacy policy and its own contract with us. We chose them, we can stop using them, and we can require them to delete what they hold on our instruction. But we cannot promise you they will behave exactly as we would, and we are not going to pretend otherwise.

Beyond that list, we would only disclose your information if the law required it — a court order, a warrant, or a legal obligation we cannot refuse. If that ever happens and we are permitted to tell you, we will.

Information going overseas

Yes, some of it goes overseas, and here is where.

Google, Cloudflare, Apple and RevenueCat are all United States companies. Your sign-in record, your subscription status, your purchase records and the technical logs of this website and the app are handled on their own infrastructure, which means the United States and potentially other countries where they operate. Support and engineering staff in those countries may be able to reach systems holding your information. Where your portfolio's own figures are stored is set out under "How we collect it, and where it is held", above.

You should know what that means: once your information is with an overseas company, it is subject to that country's laws, and Australian privacy law does not follow it there. We have chosen well-known providers with published security practices, and we have contracts with them, but we are one person and we cannot audit a company the size of Google. We would rather say that than write "with appropriate safeguards" and leave you to guess.

Getting a copy, and fixing what is wrong

Most of correcting your information does not need us at all: you can edit or delete any figure in your portfolio yourself, at any time, in the app. That is the fastest fix and it costs nothing.

For anything you cannot reach yourself — your account record, your invitation history, or a full copy of everything we hold about you — email info@emeraldwebsites.com.au and ask. We will acknowledge within two business days and give you what we hold within thirty days, in a readable format, free of charge. Correcting something is always free, including asking.

If we cannot give you something — because it would expose another person in your portfolio, or because we do not hold it — we will tell you in writing which it is and why, rather than simply not answering. If you think we were wrong to refuse, the complaints section below is your next step.

How long we keep it, and what deletion actually does

We keep your information for as long as your account exists. There is no "inactive account" purge — if you come back after two years your figures are still there. When you delete your account, this is exactly what happens.

Before you delete: cancel your subscription first

Deleting your account does not cancel a subscription and does not stop you being billed. Your subscription is with Apple or with Google, not with us, and only they can cancel it. If you delete your account without cancelling, you will keep being charged for an account that no longer exists, and we cannot stop it or see it.

So cancel first, in your store account:

  • iPhone or iPad: Settings, then your name, then Subscriptions.
  • Android: the Google Play app, then your profile picture, then Payments and subscriptions, then Subscriptions.

Then delete your account. The previous version of these documents implied deletion ended billing. It did not, and that was wrong.

What deletion removes

When you delete your account, we remove:

  • Your sign-in record with Firebase Authentication.
  • Any records still held under the older version's layout — assets, liabilities, income, expenses and portfolio-level figures. An account created on the current version has none of these.
  • If you are the only person in your portfolio: the whole portfolio and everything in it. Every asset, liability, income source and expense, and the carried-over records from the older app. All of it.
  • Every invitation you sent, and every invitation that was sent to your account's email address, whether or not anyone accepted them.

This runs automatically, in code, and starts within moments of you deleting your account. Afterwards it re-reads the records held under the older version's layout and records a fault if anything survived. It usually finishes within a few minutes. If you can still see anything of yours an hour later, that is a fault — tell us.

What deletion does not remove, and why

We would rather be specific here than promise you a clean slate we cannot deliver.

  • A shared portfolio survives you. If anyone else is still in your portfolio when you delete your account, the portfolio and everything in it stays, and ownership passes to whoever has been in it longest. You are removed from it and you lose access, but the household's figures are not deleted, because they are that other person's records too, and wiping them because one person left would be worse. If you want the whole portfolio gone, remove the other members first, or ask the owner to delete it.
  • Backups. Google keeps backups of the database, and your records may sit inside one for a period after deletion. We cannot reach into a backup to pick out one household. Those copies are not used for anything, access to them is restricted, and they are destroyed as they age out.
  • Technical logs. The logs of our code running, and Cloudflare's logs of requests to the app and this site, hold identifiers for a period after deletion. They contain no financial figures.
  • Purchase records. Apple, Google Play and RevenueCat hold their own records of what you bought. Those are not ours to delete. You would need to ask them.
  • Tax records. Where you have paid for a subscription, we keep the record of that sale — the date, the amount and the product — for as long as Australian tax law requires. That record does not include any of your financial figures.

Signing in with Apple

If you signed in with Apple, deleting your account here does not by itself end the connection between your Apple ID and My Portfolio. You can review and remove it under your Apple ID settings, in the section listing apps that use Sign in with Apple.

How to delete your account

You can delete your account from inside the app, and you do not have to ask us first. If you cannot get into the app — you have changed phones, or lost access — email info@emeraldwebsites.com.au from the address on the account and ask us to delete it. We will confirm when it is done.

Security

Here is what actually protects your figures, without adjectives.

  • Everything travels between your device and Google over an encrypted connection. Google encrypts it again where it is stored.
  • Sign-in is handled by Firebase Authentication. We never see or store your password.
  • The database says no to everything by default. To read or change anything, you have to be signed in, and the server has to confirm you are a member of that portfolio. It checks that against the portfolio record itself. It does not take the app's word for it.
  • Nobody can add themselves to a portfolio. Membership can only be changed by our own server-side code, never by the app on someone's phone.
  • Invitations are protected by a long random secret that only ever travels in the link. We store a one-way fingerprint of it, so reading the invitation record gives an attacker nothing.
  • Access to the administration console, which can read every household's figures, is limited to [REVIEW — BLOCKING: state who holds console access, whether multi-factor authentication is enforced on that account, and whether any contractor has ever had it. Brief P9 requires this in the body].

And here is the honest limit. My Portfolio is not end-to-end encrypted. We hold the keys, which means we can reach your figures through the administration console, and so could anyone who compromised that access. That is true of almost every app like this, and any app that tells you otherwise while offering you a password reset should be read carefully. We do not claim our security is perfect, because no one can, and a business that promises you an unbreakable system is telling you something it cannot know.

If something goes wrong

If we ever discover that someone has got at your information who should not have, we will find out what happened and how far it went, tell you what we know as soon as we reasonably can, tell you plainly what it means for you and what to do about it, and fix the hole.

That is a commitment we are making to you voluntarily. The Notifiable Data Breaches scheme in the Privacy Act does not currently apply to us, so we are not promising you a statutory notification with a statutory deadline. We are promising you that one person will tell you the truth quickly. If our situation changes and the scheme does apply to us, we will update this page and say so.

Where Australian privacy law leaves you

[REVIEW — BLOCKING: do not publish this section, or the one after it, until the small business exemption has been checked and confirmed in writing. If it does not hold, both sections are false and must be rewritten.]

Australia's Privacy Act only applies to businesses above a certain size, and we are below it. So the Act does not apply to us today.

We have still set this page out the way the Act asks bigger businesses to set theirs out. That is our choice, not a legal duty. What we have not done is tell you we "comply with the Privacy Act", because we are not bound by it and saying so would be worth nothing. A plain description of what we actually do is worth more, and that is the rest of this page.

What it means for you: everything promised here is a promise we made as a business, and Australian Consumer Law holds us to it like any other thing a business says about its service. It also means one door is shut to you. We say which one under "Complaints", just below, rather than letting you find out the hard way.

Complaints

If you think we have mishandled your information, tell us first. Email info@emeraldwebsites.com.au with "Privacy complaint" in the subject line. We will acknowledge within two business days and give you a written answer within fourteen days. If we got it wrong we will say so and tell you what we have changed.

If you are not happy with our answer, we have to be straight with you about where you can take it next.

The Office of the Australian Information Commissioner, which handles privacy complaints in Australia, cannot take a complaint about us. The Privacy Act does not apply to businesses this small, so the OAIC would turn you away. We would rather you heard that here than from them.

Here is what you can do. Everything we have promised on this page, we have promised as a business, and Australian Consumer Law holds us to it. You can report us to the Australian Competition and Consumer Commission, or to the fair trading or consumer affairs office in your own state or territory. You can also take a matter to a court or a consumer tribunal. Nothing on this page stops you doing any of that.

Age

My Portfolio is for people aged 16 and over. We do not knowingly hold information about anyone younger. If you believe a child has created an account, email us and we will delete it.

Automated decisions

Nothing in My Portfolio makes a decision about you. The app does arithmetic on figures you typed in: it adds them up, converts weekly and fortnightly amounts to a common period, splits a loan repayment into the interest part and the part that goes into what you own, and works out how much of your spending is covered by income that pays you whether or not you work.

It does not score you, rate you, classify you, judge whether you are on track, or decide whether you are eligible for anything. It does not profile you and it does not compare you to other users. Every number it shows you can be checked by hand, and it is meant to be.

My Portfolio is not financial advice. It does not recommend a product, a provider or a course of action. It shows you your own figures and the arithmetic on them, and what you do about them is yours to decide.

Changes to this policy

We will update this page when what we do changes. Small corrections we will simply make, with the version number and date at the top updated.

If we change something that materially affects you — a new recipient of your information, a new category of information collected, a change to how deletion works — we will tell you inside the app and by email before it takes effect, and we will not treat you carrying on using the app as you agreeing to it. Where your agreement is genuinely needed, we will ask for it properly.

Previous versions of this policy are kept and we will send you any of them on request.

Getting hold of this policy

This page is free, public, and does not require you to sign in or have an account. If you would like it in another format, ask us and we will send it.

Contact

Jesse Thomson, trading as Emerald Websites
ABN 68 410 407 820
[REVIEW — BLOCKING: postal address], Emerald, Queensland, Australia
info@emeraldwebsites.com.au