The short version
- FolioVIP is a private tool for seeing your own accounts, returns and budget. It is for education and information only.
- You sign in with a passkey. No password is ever created or stored.
- Bank and brokerage data arrives through Plaid and SnapTrade only after you connect an account, and you can disconnect at any time.
- Everything saved on the server is encrypted. We don’t sell your personal data, and the signed-in app shows no ads.
- The free pages (Sandbox, budget, wealth and loan calculators) need no account. The feedback and invite forms store no IP address.
Who runs FolioVIP
FolioVIP (foliovip.com) is operated by Dustin Hurlbut, an individual in Washington State (“we”, “us”). FolioVIP is an education and information tool. It is not a broker-dealer, investment adviser or bank, it does not hold your money, and it does not place trades or move money. Nothing on FolioVIP is financial, investment, tax or legal advice. See the disclaimer for more.
Accounts and sign-in
Accounts are by invitation only. To sign in you use a passkey (for example Face ID, Touch ID, Windows Hello or a security key). The server keeps only the passkey’s public key and a sign-in counter. Your fingerprint, face and device PIN never leave your device, and FolioVIP has no passwords to steal.
The home page and the app use one session cookie for signing in and staying signed in. It is strictly necessary, can’t be read by page scripts and is only sent to foliovip.com. A normal sign-in ends after 12 hours without use, and always within 7 days. If you choose Keep me signed in on a personal device, the cookie lasts up to 30 days, and after 12 hours unused the app locks until you use your passkey again. The server stores only a one-way fingerprint of the cookie, with the browser type and sign-in times, so you can see and sign out your devices on the Connections page.
If you install FolioVIP as an app, your browser keeps a small offline page on your device. It contains no account data.
Data from accounts you connect
FolioVIP only receives account data after you choose to connect an account:
- Banks (Plaid). Account names, balances and transactions, used for the budget and cash-flow views.
- Brokerages (SnapTrade). Account names, balances, holdings and account activity such as buys, sells, dividends, deposits and withdrawals, used for returns, strategy alerts and history.
- Market prices (Massive). Daily closing prices for the ticker symbols you hold or watch. Only ticker symbols are sent to Massive, never your account details.
You sign in to your bank or brokerage on Plaid’s or SnapTrade’s own screens. FolioVIP never sees or stores your bank or brokerage login. It saves the connection tokens those providers issue, encrypted, so it can refresh your data. Access is read-only: FolioVIP cannot move money or trade.
You can disconnect any account on the Connections page. Disconnecting asks the provider to revoke FolioVIP’s access and stops new data. You can also revoke access through the provider or your bank or brokerage. Plaid and SnapTrade handle your data under their own privacy policies.
Information you add
FolioVIP also saves what you set up in the app, such as strategies and alert levels, budget choices, categories, a watchlist, imported statements and notification settings.
The free pages, feedback and invite requests
Sandbox and calculators
The Sandbox uses fictional accounts and prices, and the budget, wealth and loan calculators work from the numbers you type. All of them run in your browser and need no account. What you do there is not sent to FolioVIP, except a note you choose to send with Send feedback. Your browser may remember small preferences on your device, such as light or dark mode and the order of the demo accounts.
Send feedback
When you send feedback we store your message, the email address if you add one for a reply, which page it came from, the time, and your browser family and platform (for example “Safari · iOS”), not the full browser string. Your IP address is not stored. Only the newest 500 notes are kept.
Request an invite
When you request an invite we store your email address, whether it is confirmed, and the times it was requested, confirmed and due to expire. The emailed links are stored only as one-way fingerprints, never the links themselves. Your IP address is not stored. To make sure the address can receive mail, the server looks up its domain (the part after the @) in public DNS, and it sends one confirmation email. Requests that are not confirmed within 48 hours are deleted. Every email includes a link to remove your address at any time.
When a bot check is turned on, the home page loads Cloudflare Turnstile. Cloudflare processes information such as your IP address and browser characteristics to tell people from bots, under Cloudflare’s privacy policy. FolioVIP does not send your IP address to Cloudflare when it checks the result.
To stop abuse, the forms count recent requests in memory using a salted one-way hash of your network address. That count is never written to storage and is discarded when the server restarts.
How your data is stored and protected
- FolioVIP is hosted on Render. Data is sent over HTTPS.
- Every record in FolioVIP’s database is encrypted at rest with AES-256-GCM. The encryption key is kept in the host’s secret settings, separate from the database.
- The server keeps daily encrypted snapshots of the database. Once off-site backups are enabled, a nightly copy is also stored in Cloudflare R2, encrypted a second time with a separate key before it leaves the server.
- Pages use strict browser security settings, and the signed-in app loads no third-party scripts.
No system is perfectly secure, but we work to protect your data and will tell affected users about a breach as the law requires.
Email and notifications
FolioVIP sends email through Resend: alert emails you turn on, invite confirmation emails, and system alerts to the operator. Resend receives the recipient’s address and the message. Alert emails are deliberately generic and tell you to open FolioVIP for details, so they don’t contain balances or holdings.
If you turn on push notifications, your browser’s push service (for example Apple, Google or Mozilla) delivers a short, generic notification.
Advertising and cookies
The signed-in app has no ads and no third-party analytics or tracking.
Ads may appear only on the free public pages, and only once ads are enabled. They would be served by Google AdSense. Google and its partners may use cookies or similar identifiers to show and measure ads, including ads based on your visits to this and other websites. See how Google uses information from sites that use its services, and turn off personalized ads in Google’s ad settings. FolioVIP never uses your account data for advertising.
How long data is kept and how to delete it
- Account data is kept while your account is open. Disconnecting an account stops new data from it.
- Feedback: the newest 500 notes are kept.
- Invite requests: unconfirmed requests are deleted after 48 hours; confirmed ones are kept until you remove them or invites are no longer offered.
You can ask us to show you, correct or delete your data at any time: use the Send feedback link on any free page (at the bottom of this page, the Sandbox or either calculator), or email hello@foliovip.com. We delete it from the live database promptly. Copies in encrypted backups are removed as those backups expire on their rolling schedule.
Children
FolioVIP is not for anyone under 18, and accounts are not offered to them. We don’t knowingly collect personal information from children. If you think a child has sent us information, let us know and we will delete it.
Changes to this policy
If this policy changes, we will update this page and the “Last updated” date. For significant changes we will also give notice on the site or by email to account holders.
Contact
Questions or requests about privacy: use the Send feedback link on any free page (at the bottom of this page, the Sandbox or either calculator), or email hello@foliovip.com. FolioVIP is operated by Dustin Hurlbut, an individual in Washington State.