What this is, what you may do with it, and what happens to your data.

This is the long version of the notice at the foot of every screen. It is written so that each claim on it can be checked against the product rather than taken on trust — the same standard the rest of this site holds itself to, and the only one worth anything on a page like this.

Last updated 14 October 2026

1. What this is

Folionomiq performs descriptive analysis of price history for a portfolio you type in. It measures what a set of holdings has done — volatility, drawdown, concentration, how much each position contributed to the whole — over a window it names every time.

It is not, and does not attempt to be, any of the following:

• Investment advice. It makes no personal recommendation to buy, sell or hold anything.
• A suitability assessment. It knows nothing about your circumstances, your other assets, your obligations or your tolerance for loss, and it never asks.
• A prediction. No figure on this site forecasts a price, a return, or the probability of either.

Because it makes no personal recommendation concerning a financial instrument, it is not an investment service within the meaning of MiFID II or Law 126/2018, and it is not authorised or supervised by ASF. It does not need to be — but that boundary is the reason, so the boundary is kept deliberately.

That is a claim, so here is the evidence rather than the assurance: /method prints how every figure on the site is computed, its window, and what it does not support — generated from the engine itself rather than from prose kept beside it, so it cannot describe a figure the product does not actually produce. A tool that forecasts has no such page to show you.

What you do with the numbers is your decision, and yours alone.

2. Who runs it

Folionomiq is built and run in Romania by Mihai-Daniel Zainea, a private individual, as a non-commercial research and education project. The name Folionomiq, this domain and the Folionomiq apps for ChatGPT and Claude are his. There is no company behind it and no investor.

Contact: [email protected] — an address on this domain, forwarded to a mailbox kept only for this. Mail is read by the person who wrote the product. It is also the address for anything in the privacy section below.

If this ever stops being free — which it cannot do before the licence question in section 3 is settled — a registered entity will have to exist, and this section will then name it, its registration number and its registered address.

3. It is free, and that is load-bearing

Nothing is charged. There is no plan, no checkout, no paywall, no subscription, no advertising and nothing sold — not as a launch offer, but as a condition the rest of the product depends on.

The price data comes from sources whose free terms cover research and education and not commercial use or redistribution. This site charges nothing and redistributes no price series, but it does read those sources by automated means, which their terms do not provide for. That is a risk the project takes knowingly and says so here; it is not a claim of compliance, and the question is written down for a lawyer before this grows. It follows that on the day money is taken for access, a commercial display licence has to already be in place — not be arranged afterwards. That order is written into the project's own repository as a gate, so taking the money first would mean breaking something recorded rather than overlooking something.

What being free does not create

No entitlement to availability, to any particular feature, or to notice before either changes. This may be modified or shut down at any time. It runs on one small server: when several analyses arrive at once, one may be refused as busy for a few seconds, and the whole service can be down without notice.

4. Where the numbers come from

End-of-day closing prices from public sources, together with dividends, fund metadata and academic factor data. The detail, figure by figure, is on /method.

• Prices can be wrong, late, or missing. Corporate actions are handled by the source; this project does not audit them.
• What leaves the server is derived — volatilities, drawdowns, contributions, scores. Raw quotes appear in three places only — the last price in the app, the price line of one asset, and the same last price for an AI assistant that asks — and only for a ticker you asked about.
• There is no bulk export and no download of price series. That is a deliberate limit, not a missing feature.

5. What you may do with what you read here

This project publishes measurements in order for them to be used and argued with. So the permission is stated plainly and broadly, rather than reserved by default and negotiated on request.

The pages, text, design and code of this site belong to its author. Open-source components keep their own licences, and their notices ship inside the application bundle.

6. No warranty

Figures may be wrong. Sources may be wrong. The code may have bugs — this project's own audits have found and published a number of them, and there is no reason to believe that has stopped. The site is provided as is, with no warranty of accuracy, completeness, availability or fitness for any purpose.

Every figure is shown with the method that produced it, the window it covers and the limit of what it supports. That is the honest maximum a tool like this can offer: it can tell you what was measured. It cannot tell you what will happen.

7. Liability

To the fullest extent Romanian law permits, the author is not liable for any loss arising from use of this site or from reliance on anything shown on it, including investment losses.

Romanian law does not permit excluding liability for harm caused intentionally or through gross negligence (Civil Code, art. 1355), and nothing here attempts to. If you are a consumer, the mandatory protections of your country of residence apply whatever this page says.

8. Privacy

The controller is the person described in section 2, reachable at [email protected].

What is not done here

No accounts. No cookies. No third-party analytics, no advertising network, no tracking pixel, no fingerprinting, and no profile of you held anywhere.

Your browser contacts no third party. Every file these pages load comes from this domain, including the typeface — it used to be fetched from Google Fonts, which meant your browser asked Google for it and Google saw your address in the request. That was disclosed here while it was true; the files now sit on this server, so there is nothing left to disclose. The site's security policy no longer permits any outside host either, so this cannot quietly come back.

The server does contact others, on your behalf. That first sentence used to read “no third party is contacted at all”, which was true about your browser and false about the server. The difference matters, so here it is plainly: prices have to come from somewhere. When you search for a fund, the words you typed go to Yahoo Finance. When you paste an ISIN, it goes to OpenFIGI (Bloomberg) to find out which listings it names. When a price is not already stored here, the ticker goes to Yahoo Finance. The US and euro-area consumer price indexes arrive on a schedule from the Federal Reserve Bank of St. Louis and the European Central Bank; nothing is sent to them. When a US fund is looked through, its ticker goes to the US Securities and Exchange Commission for the fund's own public filing of its holdings, and the identifiers of the companies in that filing go to OpenFIGI to be turned into tickers. A European fund that tracks the same index as such a US fund (an S&P 500 or MSCI World UCITS ETF, for example) is looked through that US fund's filing, and the page says which fund it was read through; the European issuers' own holdings files are not used. What does not go with any of it: your address, your name, your portfolio, or anything saying that two requests came from the same person. Two more files arrive on a schedule rather than because anyone asked — the European Central Bank's daily exchange rates, and the published factor series Kenneth French keeps at Dartmouth — and neither carries anything of yours.

Through an AI assistant. When your assistant measures a portfolio through our connector, it sends the holdings here on your behalf, exactly as the app does: they are measured and never stored. The request carries the assistant's address, not yours. What goes back to the assistant is the measurement, never price series. What the assistant then does with it, and what it keeps, is governed by its own terms, not these. A measurement made this way joins the same pooled counts described below, on the same rules. We also count, per day, how many tool calls each connector made and which tool — by the platform's name (ChatGPT, Claude, Cursor), never by anything about you. Calls that arrive less than five minutes apart are kept together as one run: the time it started and ended, how many calls it made and which tools, in order. A run keeps neither an address nor what was measured nor any text, so it cannot tell who made it.

There is no consent banner because nothing is placed on your device for our benefit — only the entries listed below, each strictly necessary for the thing you asked for.

Counting visitors

A few numbers a day are kept: pages served and which of our own pages they were, how many of those pages actually ran in a browser (the page says so once, after it has drawn, with an empty request — it is how a reader is told apart from something that only downloads the file), quick checks run on the front page, app opens, analyses run, decision receipts copied, distinct daily readers, and how many readers reached each of four first steps (a first fund added, a second one, "Save and analyse" pressed, arriving in the app from the front page's quick check), how many readers opened “Share what I found”, sent it, and arrived through a shared link (the count only: what was shared is a link and a picture made in your browser and never reaches us), how many readers sent a “Compare yours with mine” link, opened one, and had both portfolios measured (the count only: both portfolios travel in the link and the browser, and neither is kept), how many readers saved a private link or a file of their portfolio and how many opened one (the count only: the link and the file are made in your browser, and what they hold never reaches us), how many readers made a page’s example their own portfolio (the count only), how many readers typed something in the measure page’s box, pressed Measure, or met a symbol we could not find (the count only, never what was typed), which question readers came to the measure page with, taken from its address (the count only), how many pressed Measure with every symbol found, saw an answer on their own portfolio, or measured a second question on it (the count only, never the portfolio or the question’s figures), how many readers of the front page, of a comparison, of a “before you add” page, of a famous portfolio, of a “work at” page or of a “retire” page stayed three or ten seconds on it, scrolled to its button or pressed it (the count only, never which page), how many pages met an error in a reader’s browser (only the kind — the screen could not draw, a request failed, something went wrong — and which of our screens it was; never the message or anything you typed), how many readers came from each country, how many of them opened the app, how many opened the quick check and how many measured in it, and how many ran an analysis (the country of the connection, as our network provider reports it; a count per country per day, never tied to you), how many readers came back to a portfolio this browser had measured a week or a month earlier (your browser sends only which of the two, never the date or the portfolio), and how many arrived through a link in one of our emails (the link says so, and nothing about you), and how many readers from each linking host and first page, and from each country, got as far as each of those steps (counts only: a reader’s way through the site is held in memory for that day, under the one-day identifier below, and never written down) — plus the host that linked here (reddit.com, say), never the thread, the query string or the search term. Machines are counted apart and never as readers: search engines and AI assistants by the name they announce (Googlebot, GPTBot, say), with the public pages they fetched.

If your browser sends Global Privacy Control, none of that happens. A request carrying Sec-GPC: 1 is recorded as one objection for the day and then dropped: not a visit, not a reader, not credited to a country, not added to any step. The single number is kept so the page can say how much of a day objected — an exclusion nobody can see is one nobody can argue with. This was true of the pooled tables below from the day they were written, and not of this counter until 21 September 2026; the sentence has been corrected rather than the practice defended.

How a reader is counted once

Your IP address is combined with a random salt that changes every day and is never written down anywhere, hashed, and part of that hash used as a one-day identifier — so ten page views by one person are not ten people. The identifiers exist in memory only and are discarded when the day rolls over. Only the resulting counts are saved. Your address is also used to limit how many requests one source can make in a minute — held in memory for that minute, never written — and it appears, with the page asked for and never with what you typed, in the hosting provider's ordinary request log, which the provider keeps for a limited time.

Legal basis

Legitimate interest, GDPR art. 6(1)(f): knowing whether anyone uses this at all.

Retention

What is stored is an aggregate with no personal data in it, so there is nothing about you to retain. The daily identifiers last at most a day and never leave memory. The aggregates themselves are not kept for ever: the daily counts 400 days; the registry 24 months, its day rows 14 days; the mirror 24 months, its weekly rows 12 weeks; the nightly backup copies of all three on GitHub 90 days. Dated copies are also kept inside the storage itself, a few kilobytes a day, and deleted after 90 days.

If you answer "Was this useful?"

Your stars and the boxes you tick each add one to a count for the screen you were on — the same kind of daily number as the rest of this list. There is nowhere to type, so there is no text of yours to keep, and no record of your answer on its own: only the running totals. The one-day identifier above is used, in memory only, to take at most three answers from one reader a day.

If you copy a decision receipt

The receipt is written by your browser from the result on your screen, and its text is never sent here. What reaches the server is only that a receipt was copied, which adds one to a daily count; the one-day identifier above counts how many different readers did it and takes at most five copies from one reader a day.

The registry of measured combinations

When a portfolio is measured — in the app's overview, or in the quick check on the front page — one is added to a pooled count of the combination, coarsened: the funds in it by symbol, each weight rounded down to a band of ten percentage points, with every individual stock pooled into a single slice called "stocks" (and cash likewise); the month, and the day, which is kept for fourteen days and then dropped, so that "what was measured most this week" can be answered; the country the request came from, as two letters; and the currency it was measured in. Country and currency are tallied separately, never against each other. A reader counts at most once a day, using the one-day identifier above in memory only; the owner's own visits are not counted, and a browser sending Global Privacy Control is not counted at all.

While a combination is rare, the count is all that is kept. Until it has been measured five times in a month it carries no country, no currency and no day — because a combination few people hold, next to a country and a date, can point at one person even though none of those three is a name. Until 21 September 2026 that floor was applied when a page was drawn rather than when the file was written, so the detail sat in the file unshown. Nothing about any combination is published below fifty measurements either way. Past the floor the detail is written five measurements at a time, so the first country, currency and day ever written for a combination never stand for one person; detail written under the older rules is removed from the file when it is next read.

What the funds hold, pooled

Where this site has already worked out what sits inside your funds — the quick check on the front page, and the Look-through view — the sectors the money lands in (technology, healthcare, energy…) are added to one pooled table: a running total of each sector's share, and how many portfolios went into it, per month. Averages are made from those two numbers. The table is not attached to a combination, a country or a person, so there is no way back from it to anyone; the same once-a-day rule and the same exceptions apply, and nothing is shown below 50 portfolios.

What the registry shows

Nothing, until at least 50 measurements over three months share a combination. Below that it exists only as a number in a file. At 50, the combination can get a public page on this site, measured at the middle of each band, with any country under 50 grouped into its region. Legal basis: legitimate interest, GDPR art. 6(1)(f) — knowing which combinations are worth a page. The counts contain nothing about a person, so there is nothing about you in them to access or erase.

The mirror

A measurement in the app's overview also adds to pooled tallies of six structural figures — number of holdings, separate bets, the share of the movement in one direction, the share of the risk in the heaviest holding, volatility, and the share of the money in single stocks — each put into a bin (five percentage points, one point of volatility, half a bet), per month, for everyone, per country and per region; three of them (the share in one direction, separate bets and volatility) also per week. Within bands of the share moving in one direction, it also counts which funds are held and, from the Decision Lab, which funds were added or removed in a tested change and which way the change moved that share. Funds by symbol only; single stocks are never named. Counted once a day per reader, with the same exceptions as above.

What the mirror shows

A group — a place over three months, or a band — only from 50 portfolios, and inside it a map cell, a fund or a tested change only from 10. The figures are published as percentiles in steps of five, never as the bins. Where your own portfolio stands is worked out in your browser from figures already on your screen, and is not sent back. The page at /mirror reads the readings the app keeps in rcp-history-v1 for this, and writes nothing.

Never recorded

Amounts, exact weights, exact figures, individual stocks by name, portfolio names, your address, and any free text. The portfolio you send is measured and not written down; only the pooled counts above are.

Your portfolio, and what is on your device

Your portfolio is stored in your browser and nowhere else, unless you ask us to watch it (below) — eleven entries in this site's local storage, and nothing besides: rcp-workspace-v1 (the full app’s portfolios), rcp-check-v1 (your portfolio, the one the measure page shows and the full app opens on first: a change in either place is written here, and when it replaces different holdings the previous ones are kept in rcp-backup-v1; with the day you saved it and each version since, at most 24, so My portfolio can carry your account on through a change; a private link or a file you make from it holds the same, the link after its #, which your browser never sends to us), rcp-history-v1 (a few past readings, so a page can say what changed since last time; when you come back, the day of your last visit is sent with your holdings so the page can say how they moved since then, and, like every measurement, neither is kept), rcp-decisions-v1 (the changes you tested in the Decision Lab, and whether you kept them), rcp-ideas-v1 (investments, or changes you tested, that you chose to keep as ideas, with what was measured that day and your own note; an idea is never a trade), rcp-backup-v1 (the portfolio as it was before the last time it was replaced, so it can be put back), rcp-depth-v1 (how much detail you chose to see), rcp-target-v1 (the share you typed as your own target for each holding, if you did), rcp-employer-v1 (your employer’s ticker, if you set it, so the page can show how much of your money is that company; nothing else about your job is asked or kept), rcp-saved-v1 (the portfolios you saved under a name, if you did, at most twelve, so you can open one again; they stay in this browser), rcp-watch-v1 (only if you asked us to watch your portfolio: the key to the watched copy, a hint of your address such as r…@example.com, and which version of the portfolio was last sent), rcp-last-day (the day of your last visit and nothing else, so that on your next visit the page can tell us “came back after 2–7 days” or “first visit”: one word from a fixed list, never the date and never anything that ties your visits together on our side) and rcp-theme (light or dark). The app also caches its own files so it keeps working offline; there is no personal data in that cache.

Forget everything on this device, at the foot of the measure page, deletes all of them at once. If you asked us to watch your portfolio, it stops that first, so no copy is left on our side either.

A sixth entry exists for a fraction of a second and holds nothing: rcp-probe, written and immediately deleted when the app opens, purely to find out whether this browser will keep anything at all. If it will not — a private window, blocked site data, a full store — the app says so at the top of the page instead of letting you type a portfolio that vanishes when the tab closes.

One further entry exists only on the site owner's own phones and computers: rcp-owner, set when the owner presses a button on a private page, so the owner's own use is left out of the visitor counts. It is never placed on a visitor's device. The same private page keeps its access token for the length of one tab (rcp-stats-token, session storage, gone when the tab closes); that page is not reachable without the token, so this never touches a visitor either.

Storing anything on your device normally requires consent under art. 5(3) of the ePrivacy Directive and Law 506/2004. These are exempt because they are strictly necessary to provide the thing you asked for — an app that remembers the portfolio you typed into it. Nothing is stored for any other purpose, and none of it is an identifier.

Holdings are sent to the server to be measured, and are never stored there — apart from the pooled, rounded count of which funds are combined, described under the registry above, which holds no portfolio and nothing about you. You can erase everything from the foot of any screen in the app, or by clearing this site's data in your browser. Nobody has to be asked, because there is no copy anywhere else to delete.

If you write to us

Mail sent to [email protected] is kept so that it can be answered — your address, and whatever you put in it. It is forwarded by Cloudflare Email Routing into a Google mailbox. A plain address is offered rather than a contact form, deliberately: a form means storing what strangers write, and that should not be the first thing this product keeps about anybody. Do not send anything you would not want held in an ordinary mailbox.

If you leave your email

Two things on this site need an email address, and both are lists you join only by asking:

• Watching your portfolio, on My portfolio: described below. It replaced, on 17 October 2026, the market-fall email (one email when the S&P 500 fell 10%); that list gets one last email saying so, and is then closed and deleted at MailerLite.
• The vest reminder, described below.

Watching your portfolio

If you ask, with “Watch my portfolio”, your email and a tick in the box under it, we keep: your email address, the portfolio (its holdings and amounts, and its currency; not its name), the fall you chose (5% to 30%), last month’s three figures for the summary, and a note of what we sent you and when. They are kept for one purpose: one email when your portfolio closes the fall you chose below its best day, set beside what the past crises we measure did to the same holdings (once per fall, and again only after it has come back half way), and one short summary a month, in the month’s first week: how the month moved it and the three facts the result page opens on, beside the month before. A request made before 8 November 2026 keeps the lines it was given: 10%, 20% and 30%. Nothing else is sent, nothing is used for anything else, and nothing is shared or sold. The emails say what happened, on closing prices; they are not a forecast and not advice.

Where it is kept. As one record, encrypted with a key only this service holds, in our storage at Cloudflare (Cloudflare, Inc., United States). Our server (Render, Oregon, United States) reads it once a night to measure your portfolio on that day’s closes. The emails are sent through Resend (Resend, Inc., United States), which receives your address and the text of each email: your portfolio’s value that day, and your private link, which carries your holdings and amounts. Transfers to the United States rely on the Standard Contractual Clauses in each provider’s data processing terms.

How it starts and ends. The first email asks you to confirm; not confirmed within seven days, the request and your address are deleted. While it is on, a change you make to the portfolio on this site goes to the watched copy. Every email has a link that stops it, and My portfolio has a button: either one deletes the record — your address and the portfolio — at once. It is not copied into our nightly backups.

The legal basis is your consent (GDPR, art. 6(1)(a)), which you withdraw with that link at any time. You can also write to the address at the foot of this page to ask what is kept about you, to have it corrected or deleted, or to receive it; and you can complain to your data protection authority (in Romania, ANSPDCP). We count, by name only, how many asked, confirmed, stopped, and arrived from one of these emails.

The vest reminder

For people paid partly in their employer’s stock, the simple page can offer one thing that needs an email address: “Want a reminder before your next vest?” The reminder does not exist yet. Leaving your address puts you on a list, and we write once, when it is ready, or not at all if it is never built.

Your address is handed straight to MailerLite (MailerLite UAB, Lithuania), which keeps the list for us and sends a first email asking you to confirm; until you do, nothing else is sent. This site does not write the address down, does not log it and does not count it; it counts only that somebody asked. Nothing else goes with it: not your portfolio, not your employer, not your amounts. It is offered only after you tick a box saying so, which is the legal basis (consent, Art. 6(1)(a) GDPR). Every email has a one-click unsubscribe, and writing to the address above removes you too. If no reminder has been built by 31 March 2027, the list is deleted.

Both lists work the same way: the address goes straight to MailerLite, which asks you to confirm before anything else is sent; this site keeps nothing, counts only that somebody asked, and the legal basis is your consent (Art. 6(1)(a) GDPR). You can leave either list with one click in any email.

Where it runs, and what crosses a border

Hosting

Render, on servers in the United States (Oregon). Your IP address reaches that server as part of any ordinary web request, which is where the counting above happens.

Edge, DNS, and storage

Cloudflare, Inc. (United States), its storage being Cloudflare R2. What is stored there is the aggregate counts, which contain nothing about a person, and, only if you asked us to watch your portfolio, its encrypted record (above). GitHub (Microsoft, United States) keeps a nightly copy of those same counts for ninety days, as a backup.

Mailbox

Google, for the address above.

Emails for a watched portfolio

Resend, Inc. (United States), only if you asked us to watch your portfolio: it receives your address and the text of each email (above).

Reminder list

MailerLite UAB (Lithuania), only for addresses left for the vest reminder (see above); it keeps them under its own data-processing terms.

Prices, exchange rates and fund records

Yahoo Finance (United States) for prices and for fund searches; OpenFIGI, run by Bloomberg (United States), when you paste an ISIN and for the companies named in a fund's filing; the US Securities and Exchange Commission (United States) for a US fund's public filing of its holdings; the European Central Bank for the daily exchange rates and the euro area's price index; the Federal Reserve Bank of St. Louis (United States) for the US consumer price index; Dartmouth College (United States) for the published factor series. They receive a ticker, a search phrase or an ISIN. They do not receive your address, and they never receive a portfolio.

Transfer outside the EU

Because the server is in the United States, this is a transfer under Chapter V GDPR, relying on the standard contractual clauses in those providers' data-processing terms. What actually crosses is your IP address and, when you ask for an analysis, the holdings in that request. Both are in transit only: the address becomes a one-day pseudonym for the counting described above, and the portfolio exists for as long as the answer takes and is not written down anywhere, unless you ask us to watch it, which keeps the one encrypted record described above. No account, no name.

Your rights

Access, rectification, erasure, restriction, objection and portability. In practice there is very little to exercise them against, because nothing identifying you is kept, unless you left an address for the vest reminder — but write to the address above and you will get a straight answer rather than a form. You may also complain to ANSPDCP, the Romanian supervisory authority (dataprotection.ro), or to the authority in the country where you live.

9. Age

This site is not directed at anyone under 18, and no service is knowingly offered to them.

10. Governing law, and changes

Romanian law governs these terms. If you are a consumer resident elsewhere in the European Union, that does not deprive you of the mandatory protections of your own country's law, and you may bring proceedings there. No arbitration clause and no exclusive jurisdiction clause is imposed here, because against an EU consumer such clauses would not hold — and a clause that would not hold has no business on a page whose whole point is that it says only what is true.

This page carries the date it last changed, at the top. There are no accounts, so there is nobody to notify; changes are made by editing this page, and earlier versions are kept in the project's repository.