TL;DR

We don't sell your data or use it for advertising.

FinBoard is a portfolio tracker run by Sébastien Fontaine (FuryBee), who is the data controller. We store your account details and the portfolio data you enter or import. If you choose to connect a broker or a bank, we also store the access token needed for that connection. Everything below describes exactly what that means.

Your Account

When you sign in with Google, we receive and store:

• • Your Google account identifier, name and email address (to identify your account)
• • Your profile picture URL (for display)
• • Your preferences, such as your display currency

Your name, email and picture are refreshed from Google each time you sign in. We never receive your Google password and we don't access your Gmail, Drive or contacts.

Your Portfolio Data

To provide the service, we store what you create or import:

• • Portfolios, positions and transactions (buys, sells, dividends, fees, dates, prices)
• • Sale journal entries, transaction templates and watchlists
• • Transactions extracted from statement files you upload (for example Excel or CSV exports from your broker). Files are parsed to extract transactions; we keep the resulting transactions, not the file.

Optional Broker & Bank Connections

These are off unless you set them up yourself.

Interactive Brokers (Flex Web Service)

If you add an IBKR Flex token and Flex Query IDs in Settings, we store them and use them, when you start a sync, to download the Flex reports you configured at Interactive Brokers (positions and trades). A Flex token only gives access to those reports: it cannot place orders, move money or change your IBKR account. You can remove it at any time by clearing the fields in Settings and saving; the token is then deleted from our database. You can also revoke it on the IBKR side.

Bank connections via Powens

Where this feature is available and you choose to use it, bank connections go through Powens, a payment services provider regulated in France (account information service). You enter your bank credentials in the Powens interface, not in FinBoard; we never see or store them. We store the Powens user access token created for your account, which lets FinBoard read, through Powens, the accounts, balances and transactions of the banks you connected. It does not allow payments or transfers.

When Powens synchronises your accounts, it sends a notification (webhook) to FinBoard containing the account and transaction data. We record each notification (its content and basic request headers such as the sender's IP address) so imports can be checked and retried. To disconnect, email us: we delete the stored token and the related notification records.

AI Assistants (MCP)

You can connect an AI assistant (such as Claude or ChatGPT) to FinBoard through its MCP server. This only happens if you add the connector in your assistant and approve it by signing in to FinBoard with Google.

• • We store the assistant's registration (its name and redirect address) and the access tokens issued to it. Access tokens expire after 1 hour, refresh tokens after 30 days.
• • A connected assistant acts on your behalf, limited to your own data: it can list your portfolios, positions, transactions and performance, look up quotes, and add transactions or close positions when you ask it to.
• • It cannot read your broker or bank tokens.
• • What you then share with that assistant is governed by its provider's own privacy policy.

To cut access, remove the connector in your assistant; its tokens will expire on their own. To revoke them immediately, email us.

Share Links

If you share a portfolio, FinBoard generates a random link. Anyone who has the link can view that portfolio read-only, without signing in: its name, holdings, quantities, average prices, current values and gains. Your name and email are not shown. Clicking share again revokes the link immediately.

Cookies & Sessions

• • One session cookie keeps you signed in for up to 30 days. Its content is encrypted and it is used for nothing else.
• • Short-lived technical cookies are set during the Google sign-in and AI assistant connection flows.
• • Cloudflare may set its own strictly necessary security cookies.

There are no analytics, advertising or tracking cookies, and no fingerprinting, so no consent banner is needed.

Market Data

Quotes, charts, exchange rates and company profiles come from Yahoo Finance. Those requests are made by our server, not by your browser, and contain only ticker symbols, currency pairs and date ranges. No personal information is sent to Yahoo.

Who Processes Your Data

• • Google: sign-in.
• • Scaleway: server hosting in France, where the database runs.
• • Cloudflare: content delivery and protection. All traffic to FinBoard passes through Cloudflare, which processes your IP address and request data.
• • Amazon Web Services: storage of encrypted backups (Paris region).
• • Interactive Brokers: only if you add a Flex token.
• • Powens: only if you connect a bank.
• • Yahoo Finance: market data only, no personal data (see above).

We don't sell or rent your data, and we don't share it with anyone for advertising or profiling.

Storage & Security

• • Data is stored in a PostgreSQL database and a Redis cache on our server in France. Neither is reachable from the internet.
• • All connections to FinBoard, and from FinBoard to Interactive Brokers, Powens and Yahoo, are encrypted in transit (HTTPS).
• • Administrative access to the server and database is limited to the operator.
• • Broker and bank tokens are not currently encrypted at the application level in the database; they are protected by the access restrictions above.
• • The database is backed up nightly. Off-site copies are encrypted before upload.

Retention

• • Account and portfolio data: as long as your account exists.
• • Broker and bank tokens: until you remove them or your account is deleted.
• • Server access logs (including IP addresses): 30 days.
• • Backups: 7 days on the server, 90 days for the encrypted off-site copies. Deleted data disappears from backups once they rotate out.

Your Rights (GDPR)

You can at any time ask to:

• • Access your data or receive a copy of it in a portable format
• • Correct it
• • Delete your account and all associated data, including tokens, share links and AI assistant access
• • Restrict or object to a processing

To exercise these rights, including account deletion, email [email protected] from the address linked to your account. We answer within one month. If you are not satisfied with our answer, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.