Privacy Policy

Effective October 26, 2026

1. Who we are

Portfolio Galaxy ("Portfolio Galaxy", "we", "us") operates the website at portfoliogalaxy.xyz and the portfolio visualization service offered there (the "Service"). We are based in Canada and handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Questions or requests about your information can go to our privacy contact at eugenefds3@gmail.com.

2. Information we collect

From your Google account, when you sign in

We use Google Sign-In and request only the basic openid, email and profile permissions. Google shares with us:

• your Google account identifier (a number that identifies your account to us),
• your email address and whether Google has verified it,
• your name and the address of your profile picture.

We never receive your Google password, and we don't get access to your Gmail, Drive, contacts or any other Google data.

Subscription and payment information

When you subscribe, Stripe collects your payment details on its own secure checkout page. Stripe tells us whether your subscription is active and gives us a customer reference so you can manage billing. We link your subscription to your Google account identifier and email address. We never receive or store your full card number, CVC or bank details.

Wallet addresses you look up

To draw a galaxy, we send the public blockchain address you enter to our data provider, Zerion, and show you the results. We don't save the addresses you look up to a database or link them to a profile of you. An address can appear briefly in our hosting provider's technical logs (for example, request logs or error reports), which we use only to keep the Service running and secure.

Wallets you save

If you use the "Saved wallets" feature, we store each wallet's address and the name you give it, along with your Google account identifier so that only you can see your list. New accounts start with a few public example wallets, which you can rename or remove. Saved wallets are stored in a database run by our provider Supabase.

Blockchain addresses and their holdings are public by nature. Anyone can see them on a block explorer. Even so, an address you look up may be linked to you or to someone else, so we treat it as potentially personal information.

Technical information

Like any website, our servers and hosting provider automatically receive standard technical information when you visit, such as your IP address, browser type, the pages you request and the time of the request. This is used for security, troubleshooting and preventing abuse.

3. How we use your information

We use your information only to:

• sign you in and keep you signed in,
• check whether you have an active subscription and let you manage it,
• fetch and display the portfolio data you request,
• store and show the wallets you save,
• respond to your questions and support requests,
• send important notices about your account, your subscription or changes to our terms or this policy,
• protect the Service and its users from fraud, abuse and security threats, and
• meet our legal, tax and accounting obligations.

We don't use your information for advertising, don't build marketing profiles and don't send you marketing email unless you have separately agreed to receive it.

4. Consent

By signing in and using the Service, you agree to the collection, use and disclosure of your information as described in this policy. You can withdraw your consent at any time by stopping use of the Service and contacting us (see section 9). Some uses are necessary to provide the Service, such as verifying who you are and whether you've paid. If you withdraw consent to those, we won't be able to keep providing the Service to you.

5. Who we share information with

We do not sell, rent or trade your personal information. We share it only with the service providers we rely on to run the Service, and only what each one needs:

These providers handle information under their own privacy policies and legal obligations. We choose providers that maintain reasonable security safeguards.

We may also disclose information if the law requires it (for example, in response to a valid court order), to protect the rights, property or safety of our users, the public or Portfolio Galaxy, or as part of a sale, merger or transfer of the Service. In a transfer, the new owner must keep protecting your information in line with this policy.

6. Storage outside Canada

Our service providers may store and process information outside Canada, including in the United States. While it's there, it is subject to the laws of that country, and authorities there may be able to access it. We rely on our providers' contractual and security commitments to protect it.

7. Cookies

We use a single, essential cookie that keeps you signed in. It's digitally signed so it can't be tampered with, it's only sent over secure (HTTPS) connections, and it can't be read by scripts on the page. It holds your sign-in details and a cached copy of your subscription status, and it expires after 30 days or when you sign out. The Service can't work without it.

We don't use advertising or analytics cookies. Stripe's checkout and billing pages, and Google's sign-in page, are run by those companies and may set their own cookies under their own policies.

8. How long we keep information

• Sign-in information is kept in your browser's cookie, not in a database of ours. Signing out clears it.
• Saved wallets, and the Google account identifier they're stored under, are kept until you remove them or ask us to delete them. If your subscription ends, we keep them so they're still there if you come back, unless you ask us to delete them.
• Subscription and payment records are kept by Stripe for as long as needed to provide billing and to meet tax, accounting and legal requirements, which can mean several years after you cancel.
• Technical logs are kept only for a limited time, according to our hosting provider's retention period, and then deleted.
• Messages you send us are kept as long as needed to deal with your request and any follow-up.

9. Your rights and choices

Subject to the law, you have the right to:

• ask what personal information we hold about you and how it has been used and shared,
• ask us to correct information that is inaccurate or incomplete,
• ask us to delete your information, unless we're required to keep it (for example, payment records needed for tax purposes),
• withdraw your consent, as described in section 4, and
• complain to us, or to the Office of the Privacy Commissioner of Canada at priv.gc.ca or your provincial privacy regulator.

To make a request, email eugenefds3@gmail.com from the email address on your account. We may need to confirm your identity first. We'll respond within 30 days, or tell you if we need more time and why, as the law allows.

You can rename or remove saved wallets yourself at any time from the visualizer. You can also cancel your subscription at any time from the billing portal, and remove Portfolio Galaxy's access to your Google account at myaccount.google.com/connections.

10. Security

We protect information with safeguards appropriate to its sensitivity. These include encrypted (HTTPS) connections, signed and secure session cookies, verified sign-in tokens, a saved-wallets database that only our server can access, keeping secret keys out of our code, and limiting data collection to what the Service needs. No method of transmitting or storing data is completely secure, so we can't guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm to you, we'll notify you and the Privacy Commissioner as the law requires.

11. Children

The Service is not intended for anyone under 18 or under the age of majority where they live. We don't knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we'll delete it.

12. Third-party links

The visualizer links to third-party sites such as block explorers. We don't control those sites, and this policy doesn't cover them. Check their privacy policies before giving them any information.

13. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll post the new version here with a new effective date and, where appropriate, notify you by email or on the site before the changes take effect. If you keep using the Service after changes take effect, the updated policy applies.

14. Contact us

Privacy questions, requests or complaints: eugenefds3@gmail.com.