This article explains how Scaryfolio handles your Ghostfolio connection, local data, purchases, widgets, and privacy features.
Direct Connection to Ghostfolio
Scaryfolio connects directly from your device to your configured Ghostfolio server. It does not send your portfolio data through a Scaryfolio server.
If you use Ghostfolio Cloud, your data is handled by Ghostfolio Cloud. If you self-host Ghostfolio, your data remains on your own server except for the direct API responses sent to Scaryfolio.
Local Storage
Scaryfolio stores connection settings and preferences locally on your device, including:
- Hosting type
- Self-hosted server URL
- Custom headers for self-hosted connections
- Ghostfolio Security Token
- Ghostfolio bearer token
- Base currency and display preferences
- Personalization, privacy, portfolio summary, and FIRE settings
Widgets use a shared app group container to read cached display data from Scaryfolio. This allows widgets to show portfolio information without opening the app.
Most Scaryfolio preferences are local display settings. Ghostfolio User Settings, such as Base Currency and Zen Mode, are saved back to Ghostfolio when you change them in Scaryfolio.
Authentication
Scaryfolio sends your Security Token to Ghostfolio to obtain a bearer token. Authenticated API requests use the bearer token. If a bearer token expires and the Security Token is available, Scaryfolio attempts to refresh it automatically.
When you update Ghostfolio User Settings from Scaryfolio, the authenticated API request is sent directly to your configured Ghostfolio server.
For self-hosted Ghostfolio servers:
- Use a valid HTTPS certificate.
- Keep Ghostfolio updated.
- Use a firewall, VPN, or trusted reverse proxy as needed.
- Rotate Security Tokens if you believe one was exposed.
- Protect custom header values like any other secret.
Third-Party Services
RevenueCat
Scaryfolio uses RevenueCat to manage Scaryfolio Pro purchase entitlement status. RevenueCat receives purchase entitlement information needed to determine whether Pro features should be unlocked. RevenueCat does not receive your Ghostfolio portfolio data through Scaryfolio.
Apple App Store
Purchases are processed by Apple. Scaryfolio does not see your payment card details.
Ghostfolio
Your investment data is provided by Ghostfolio. Review Ghostfolio's privacy policy for Ghostfolio Cloud, or your own policies and configuration for self-hosted deployments.
Analytics
Scaryfolio does not send your portfolio values, holdings, accounts, activities, or Security Token to an analytics service.
Privacy Features
Hide Amounts
Scaryfolio includes a privacy blur feature that hides financial amounts in the Portfolio and Accounts tabs.
iPhone
- Open Settings > Privacy.
- Enable Shake to Hide Amounts.
- Shake your iPhone to blur amounts.
- Shake again to reveal amounts.
Mac
Use the Privacy command menu to show or hide amounts. The keyboard shortcut is Command-Shift-H.
iPad and Other Platforms
Financial amounts can still be blurred where the privacy blur is active. Shake-to-hide is an iPhone-focused control; available privacy controls can vary by platform.
The privacy blur is a visual privacy feature. It does not encrypt or remove data from the app.
Widgets, Spotlight, Shortcuts, and Sensitive Data
Widgets can display portfolio values on visible surfaces such as the Home Screen, Lock Screen, Mac Desktop, Notification Center, and Apple Watch. If you share your device or are concerned about shoulder surfing, avoid placing portfolio widgets on highly visible screens.
Spotlight account results can show account names, currencies, account values, and cash balances in system search. Shortcuts, Siri responses, automations, and notifications can also display or speak portfolio values, gains, returns, currency codes, or currency symbols outside the main Scaryfolio interface.
Disconnecting and Data Removal
When you disconnect from Ghostfolio in Settings, Scaryfolio clears the server URL, custom headers, Security Token, bearer token, base currency, and loaded app data for that connection. It also clears Apple Watch credentials through the watch connectivity manager.
Deleting Scaryfolio from your device removes the app and its local app data according to the operating system's normal app deletion behavior.
Your Control
- You choose whether to connect to Ghostfolio Cloud or a self-hosted server.
- You can disconnect at any time.
- You can remove widgets if you do not want portfolio values visible outside the app.
- You can avoid adding portfolio values or currency details to Shortcuts notifications if you do not want them visible outside Scaryfolio.
- Your source investment data remains in Ghostfolio, not Scaryfolio.