Privacy Policy

SoFo Software ehf. (kennitala 6401220720), Brúnalandi 13, Reykjavík, Iceland, operates SoFo and is the controller of your personal data under the General Data Protection Regulation (GDPR) and the Icelandic Act on Data Protection and the Processing of Personal Data (No. 90/2018).

For anything about your data, email support@getsofo.com.

When you sign in with Google or Apple

Your email address and your first and last name. If you use Apple and choose to hide your email, we receive a private relay address from Apple instead of your real one. We never receive your Google or Apple password.

Your profile

• Username, bio and profile photo.
• Your age, as you gave it, and when you confirmed it. Used only to confirm you are 18 or older. It is never shown to anyone. We don't ask for your date of birth.
• The date and time you accepted our terms, and which version you accepted.
• Your notification and email settings.

Your investor profile (optional)

If you choose to answer them, your answers about your investing experience, style, typical holding period, goals, how often you think your calls are right, and whether you have a finance background. These answers are private. They are never shown to other users.

What you do on SoFo

Posts, positions and theses, updates, market views, comments, likes, who you follow, stocks you watch, reports you make and people you block.

LinkedIn verification (optional)

If you choose to verify with LinkedIn: your LinkedIn ID, profile URL and headline.

Technical data

• Your IP address, used for rate limiting and to protect against abuse. We don't keep it long-term.
• Sign-in session cookies, described under Cookies below.
• Anonymous counts of how people use the front page and sign-up: which parts of the page were seen, which buttons were pressed, how far through sign-up people got and whether a first position was opened. They aren't linked to your account, name or email, and nothing is stored in your browser for them.

We don't collect your bank or brokerage details, your holdings, or your location.

The GDPR requires a legal basis for each use of your data. Ours are:

Your investor-profile answers are used only to shape your own experience of SoFo, for example which terms are explained to you and how your own results are framed. We don't use them for automated decisions that have legal or similarly significant effects on you.

Your name, username, bio, profile photo and track record are shown on your public profile. Posts and positions you make visible to everyone can be seen by anyone, including people who aren't signed in, and can be shared by link. Content you limit to a smaller audience is shown only to that audience.

Who you follow and who follows you are listed on your public profile, where anyone can see them, including people who aren't signed in.

Your email address, age, investor-profile answers, notification settings, reports and blocks are never shown to other users.

We don't sell your personal data, and we don't show ads. We use the following providers to run SoFo. They process data only on our instructions and under data processing agreements.

We may also disclose data where the law requires it, to protect people's safety or our rights, or to a buyer or successor if SoFo is reorganised, merged or sold, in which case this policy continues to apply to your data.

Some of our providers are based in, or process data in, the United States. Where personal data leaves the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for more detail at support@getsofo.com.

We only use cookies that are strictly necessary for SoFo to work:

• Sign-in session cookies, which keep you signed in and protect sign-in against forgery.
• A short-lived cookie from Cloudflare Turnstile during sign-up, used for the bot check.

We don't use advertising or tracking cookies. The anonymous visit counts (Vercel, PostHog) work without cookies or anything else stored in your browser. Because strictly necessary cookies don't require consent, we don't show a cookie banner.

We send notification emails about activity on your account and positions, and a weekly digest. Every one of them has a one-click unsubscribe link, and you can turn them on or off in your notification settings. We still send emails that are necessary to run your account, such as important changes to our terms.

We keep your data for as long as your account exists. When you delete your account:

• Your personal data, including email, name, bio, profile photo, age, investor-profile answers and LinkedIn data, is erased immediately.
• Your posts, positions and comments are removed from the Service.
• Remaining copies in our backups are deleted as the backups roll over, within 30 days.
• Reports you made or that were made about you may be kept longer where needed for safety or legal reasons, for example to deal with repeated abuse or a request from authorities. They are kept only as long as needed.

IP addresses used for rate limiting are kept only briefly and are not stored with your account.

Under the GDPR you have the right to:

• Access and portability. Get a copy of your data. Use “Download your data” in Settings, or email us.
• Rectification. Correct your data. Most of it you can change yourself by editing your profile.
• Erasure. Delete your data. Use “Delete account” in Settings.
• Restriction. Ask us to limit how we use your data while a concern is looked into.
• Objection. Object to uses based on our legitimate interests.
• Withdraw consent. For the investor profile and LinkedIn verification, at any time.

For anything you can't do in the app, email support@getsofo.com. We'll reply within one month. We may need to confirm it's you before acting on a request.

You can also complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is), or to the data protection authority where you live or work. We'd appreciate the chance to sort it out with you first.

Data is encrypted in transit, access to production systems is limited to people who need it, and sign-in is handled by Google or Apple, so we never hold a password for you. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

SoFo is only for people aged 18 or older. We don't knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we delete it. If you believe that has happened, email support@getsofo.com.

We'll update this policy when what we do with data changes. If a change is material, we'll tell you in the app or by email before it takes effect. The effective date at the top always shows the current version.