Privacy policy

In short

Allown shows you everything you invest in, in one place. To do that it has to keep your portfolio, and it keeps it for you alone.

• We use your data to run Allown for you, and for nothing else.
• We don't sell data, show ads or share anything with advertisers.
• Broker and exchange keys must be read-only, and are stored encrypted.
• Analytics counts visits; it sets cookies only if you say yes, and never sees your amounts, holdings or account names.
• Deleting your account in Settings removes everything at once.

Who we are

Allown (allown.app and the app at my.allown.app) decides how this data is used and is responsible for it: the "controller", in the language of data protection law. Write to support@allown.app about anything on this page.

What we keep, and why

Only what Allown needs to work:

• Your account: your name, email address, language and the currency for totals, so you can sign in and the app reads the way you want. Your password is stored only as a one-way hash; nobody can read it back.
• Your portfolio: the accounts, holdings and transactions you add or import, notes, price alerts, target mixes, paper accounts and the integrations you ask us for, so Allown can show and measure them.
• Connections: the read-only API keys you give for a broker or exchange (encrypted, see below), the public addresses of wallets you follow, and the history they bring in. Statements and CSV files you upload are read once to import them; the files themselves aren't kept.
• Where you're signed in: for each sign-in, the browser and system, the IP address and when it was last used. Settings shows them so you can sign out a device you don't recognise. Sign-in attempts are counted by IP address for a short time, to slow down password guessing.
• Telegram, if you link it: your chat ID, so the bot can send the alerts and summaries you asked for.
• Friends, if you use them: who you're friends with, your groups, and what you choose to share.
• Technical records: when something fails, a short log entry with what failed and a reference number, used to fix it. Performance measurements are kept as totals only, never per person.

Signing in with Google

If you choose "Continue with Google", or connect Google in Settings, Google tells us your name, email address, profile picture and an ID for your Google account. We use them only to create your account and sign you in. Google also issues sign-in tokens, which are stored with your account and used for nothing else; we don't ask for access to your Gmail, Drive, contacts or anything else in your Google account.

Allown's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting Google in Settings, or deleting your account, removes it all.

Cookies and analytics

Allown sets only the cookies it needs, plus analytics cookies if you allow them:

• Signing in: a cookie that keeps you signed in on this device.
• Your language (allown-locale) and a hint that you're signed in (allown_signed_in), so allown.app can offer "Open my portfolio". The hint says nothing about who you are.
• Your analytics choice (allown-consent), so you're asked only once.
• Google Analytics (_ga), only after you say yes. It counts visits and pages so we can see what's used. Until you say yes no analytics cookie is set, and Google receives only an anonymous signal that a page was viewed. Inside the app, page addresses are reduced to the kind of page ("an account page"), so no account names, tickers or amounts ever reach it. Advertising features are always off.

Changing your mind about cookies

Use Cookie settings at the bottom of allown.app at any time. Saying no later also removes the analytics cookies already set. Your browser also keeps a few display preferences on your device (such as whether amounts are hidden, and recent searches); those never leave it.

Who else sees any of it

Only the services Allown runs on, and only what each one needs:

• Hetzner Online (Germany) hosts the servers and the database. Your data is stored in the EU.
• Google, for signing in with Google and for analytics, as described above.
• Your brokers and exchanges (such as Interactive Brokers, Binance and Bybit) receive our requests made with your read-only keys, to send back your balances and history.
• Public blockchain services (mempool.space, Blockscout, TronGrid) receive the wallet addresses you follow, to read their public balances and history.
• Market data sources (such as Yahoo Finance and Binance) receive only the names of the instruments to price, never anything about you.
• Telegram delivers the messages you asked the bot for.
• Your friends see only what you choose to share with them, as percentages, never amounts.

What we never do

We don't sell or rent your data, use it for advertising, or give it to anyone not listed above. We hand data to authorities only when the law requires it. Some of the services above, such as Google, may process data outside the EU; they do so under their own legal safeguards (such as the EU–US Data Privacy Framework and standard contractual clauses).

How it's protected

Every connection uses HTTPS. API keys are encrypted with AES-256-GCM and decrypted only in memory, for the moment a sync runs. Passwords are hashed, and you can add two-factor sign-in with an authenticator app. Every request is checked to be yours before anything is read or changed. Only Allown's operator can reach the servers, with a key, never a password.

How long we keep it

Everything stays while you have an account. When you delete it in Settings, your account, portfolio, connections, keys, notes and alerts are removed at once. Nightly database backups are kept for 14 days and then overwritten, so a deleted account is gone from them within two weeks. Sign-ins expire on their own; technical log entries are kept only briefly.

Your rights

You can see and correct your data in the app, and delete your account in Settings. You can also ask us, at support@allown.app, for a copy of your data, to correct or delete something, or to stop a particular use of it. We answer within a month. You can withdraw consent to analytics at any time with Cookie settings. If you think we've handled your data wrongly, you can also complain to the data protection authority where you live.

The legal basis

For people in the EU, the UK and similar laws: we process your account, portfolio and connections to provide the service you signed up for (a contract); analytics cookies only with your consent; and sign-in records, attempt limits and error logs for our legitimate interest in keeping Allown secure and working. Where the law requires us to keep or disclose something, that obligation is the basis.

Children

Allown isn't meant for anyone under 16, and we don't knowingly keep data about them. If you think a child has made an account, write to us and we'll delete it.

Changes to this policy

When Allown starts handling data differently, this page changes first, and its date at the top moves. Important changes are also announced in What's new.