Short version: Valto collects only what it needs to provide the service. We never sell your data, never access your funds, and only connect to exchanges with read-only API keys you provide. You can delete your account and all associated data at any time.
1. Who This Policy Applies To
This Privacy Policy explains how Valto ("Valto," "we," "us," or "our") collects, uses, stores, and shares information about you when you use our mobile application and related services (collectively, the "Service").
By using the Service, you agree to the collection and use of your information as described in this policy. If you are located in the European Economic Area (EEA) or the United Kingdom, Valto acts as the data controller for your personal data.
2. Information We Collect
We collect information in three ways: information you provide directly, information generated automatically when you use the Service, and information from third-party services you connect.
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, hashed password | Account creation, authentication, and support |
| Portfolio data | Portfolio names, manual transactions, asset quantities, cost basis | Core portfolio tracking functionality |
| Exchange API keys | Read-only API key and secret for connected exchanges | Syncing exchange balances. Keys are encrypted at rest and never used to trade or withdraw. |
| Subscription data | Subscription status, plan type (via RevenueCat) | Gating Pro features; we never receive your payment card details |
| Usage data | App features used, session timestamps, device type, OS version | Analytics and service improvement |
| Crash and error data | Stack traces, error logs | Diagnosing and fixing bugs |
We do not collect: government-issued IDs, payment card numbers, wallet seed phrases, or private keys of any kind.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your account;
- Provide, operate, and improve the Service;
- Sync your portfolio with connected exchange accounts;
- Process subscription status and unlock Pro features;
- Send transactional communications (account confirmation, security alerts, password resets);
- Analyze usage patterns to improve product features and performance;
- Detect and prevent fraud, abuse, and security incidents;
- Comply with applicable legal obligations.
We do not use your portfolio data or holdings information for advertising purposes, and we do not sell your personal data to third parties.
4. Legal Bases for Processing (EEA / UK Users)
If you are located in the EEA or UK, we process your personal data under the following legal bases:
- Contract performance: Processing necessary to provide the Service you have signed up for;
- Legitimate interests: Analytics, security monitoring, and product improvement, balanced against your rights;
- Legal obligation: Where required by law;
- Consent: Where you have expressly consented, such as for optional marketing communications.
5. Exchange API Keys
When you connect an exchange account, you provide Valto with a read-only API key and secret. We treat these with the highest level of care:
- Keys are encrypted at rest using industry-standard encryption (AES-256);
- Keys are transmitted exclusively over TLS-encrypted connections;
- We only ever use your keys to read balances and transaction history — never to place orders, transfer funds, or withdraw assets;
- We recommend you create exchange API keys with only "read" or "view" permissions and never enable withdrawal or trading permissions;
- You can revoke and delete your stored API keys from within the app at any time. We will permanently delete them from our systems within 30 days of your request.
6. How We Share Your Information
We share your information only in limited circumstances:
- Service providers: We engage trusted third-party vendors (cloud hosting, crash analytics, subscription management) who process data on our behalf under strict data processing agreements;
- RevenueCat: Manages subscription state. RevenueCat receives an anonymous app user ID and your subscription status — not your email or portfolio data;
- Legal requirements: We may disclose information when required by law, court order, or governmental authority;
- Business transfers: In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred to the successor entity, subject to equivalent privacy protections;
- With your consent: For any other purpose with your explicit consent.
We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.
7. Data Retention
We retain your personal data for as long as your account is active or as necessary to provide the Service. Specifically:
- Account data: Retained until account deletion;
- Portfolio and transaction data: Retained until account deletion;
- Exchange API keys: Deleted within 30 days of disconnection or account deletion;
- Usage and analytics data: Aggregated or anonymized after 24 months;
- Legal and compliance records: Retained for the period required by applicable law (typically 5–7 years).
When you delete your account through the app, we initiate deletion of all personal data within 30 days, except where retention is required by law.
8. Data Security
We implement technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction, including:
- TLS encryption for all data in transit;
- AES-256 encryption for API keys and sensitive data at rest;
- Bcrypt hashing for passwords — we never store passwords in plaintext;
- Role-based access controls, limiting internal access to personal data;
- Regular security reviews and dependency updates.
No method of transmission or storage is 100% secure. If you have reason to believe your account has been compromised, contact us immediately at security@valto.app.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you;
- Rectification: Request correction of inaccurate or incomplete data;
- Erasure: Request deletion of your personal data ("right to be forgotten");
- Portability: Request an export of your data in a machine-readable format;
- Restriction: Request that we restrict processing of your data in certain circumstances;
- Objection: Object to processing based on our legitimate interests;
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
You can exercise most of these rights directly within the app (account settings → data & privacy). For other requests, contact us at privacy@valto.app. We will respond within 30 days. EEA/UK users may also lodge a complaint with their local data protection authority.
10. California Privacy Rights (CCPA)
If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of the "sale" of personal information. Valto does not sell personal information as defined by the CCPA. To exercise your rights, contact us at privacy@valto.app.
11. Children's Privacy
The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
12. Third-Party Services and Links
The Service may display links to third-party websites or services (e.g., news sources, exchange websites). We are not responsible for the privacy practices of these third parties and encourage you to review their privacy policies independently.
13. International Data Transfers
Valto may transfer and process your data in countries other than your own, including countries that may not provide the same level of data protection as your home country. Where required, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards to protect your data during such transfers.
14. Cookies and Tracking Technologies
The Valto mobile app does not use browser cookies. Our website uses only essential session cookies required for authentication and security. We do not use third-party tracking cookies or behavioral advertising technologies on our website.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes via email or in-app notification at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
16. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:
- Email: privacy@valto.app
- Security issues: security@valto.app
- General support: support@valto.app