Privacy policy
Last updated: 14 October 2026
Kinfolio combines several people's Parqet accounts into one household overview. We process as little data as possible, use no advertising or analytics trackers and store everything on servers in the EU.
1. Controller
Julius Wiedemann Öschweg 2 88276 Berg Email: juliuswiedemann01@gmail.com
2. Data we process
Account: email address, display name, language, appearance (light/dark), privacy mode, optional passkeys (a public key, no biometric data).
Parqet connections: your Parqet user id, the list of shared portfolios and access and refresh tokens. Tokens are stored encrypted with AES-256-GCM, never logged and never sent to your browser.
Portfolio data: values, holdings, activities and KPIs we fetch through the official Parqet API (read-only). We only keep them as a cache (usually 15 minutes to 24 hours) and delete them at the latest 24 hours after they were fetched.
Households: name, memberships, roles, sharing levels, ownership shares and invites (for email invites the invitee's email address).
Technical data: session cookie, IP address (briefly, for rate limits and in server logs), security events in an audit log (e.g. “account connected”) without amounts or email addresses.
3. Purposes and legal bases
Providing Kinfolio and the combined overview used by you and the people in your household: Art. 6(1)(b) GDPR (contract).
Security, abuse protection (rate limits), error analysis and the audit log: Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.
What others in the household see of your accounts is up to you via your sharing level (totals only, totals & allocation, full details). You can change it at any time.
4. Recipients and processors
IONOS SE (hosting and database, data center in Germany).
Sendinblue SAS / Brevo (sending sign-in and invite emails, EU).
Functional Software Inc. / Sentry, EU region (error monitoring, only if enabled; without amounts and without tokens).
Data processing agreements under Art. 28 GDPR are in place with all processors.
Parqet: at your request Kinfolio fetches data from Parqet GmbH. Parqet itself is responsible for the data in your Parqet account; Parqet's privacy policy applies.
5. Cookies
We only set strictly necessary cookies: the session cookie (sign-in, 30 days) and cookies for appearance, privacy mode and the collapsed sidebar. There are no advertising, analytics or tracking cookies and no third-party content. Consent is therefore not required (§ 25(2) TDDDG).
6. Retention
Account data: until you delete your account.
Parqet tokens and portfolio data: until you disconnect or delete your account; cached portfolio data additionally at the latest 24 hours after it was fetched.
Sign-in links: 15 minutes, single use. Invites: 7 days.
Audit log: 12 months. Server logs: at most 14 days.
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can trigger export and deletion yourself in the settings at any time.
You can also lodge a complaint with a data protection supervisory authority, e.g. the one where you live.
8. Security
All connections are TLS-encrypted. Parqet tokens are additionally stored encrypted, and access to Parqet is read-only (portfolio:read). More on our “Security” page.