Security practices

Account access is handled through the app’s managed authentication service. Protected pages verify the active user before access is allowed.

Assets, liabilities, net worth snapshots, goals, income, expenses, and profile settings are tied to an account identifier. Database access rules restrict signed-in users to their own rows.

Data access is enforced in the database, not only by what the interface displays. Sensitive administrative operations, including account deletion, run on the server after the user’s session is verified.

Current financial tables use row-level access policies and authenticated-only permissions. Deleting an account also deletes its linked financial records through database relationships.

TurtFolio does not require bank, brokerage, or crypto account credentials. Users enter and maintain financial values themselves.

We use focused access controls, avoid exposing private administrative credentials to the browser, and keep public pages separate from private financial records.

Security practices may evolve as TurtFolio grows. Please report a suspected security issue through the contact channel listed in the Privacy Policy.