Introduction
DeFiLight is an informational application that helps people compare stablecoin yield opportunities, estimate returns and costs, and create a portfolio plan. This Privacy Policy applies when you use the DeFiLight website and its optional account and cloud synchronization features.
You can use the core application without an account. DeFiLight does not connect to your crypto wallet, take custody of assets, request a seed phrase or private key, or initiate blockchain transactions. Any deposit or withdrawal takes place on an external protocol website chosen by you.
DeFiLight, available at defilight.app, is a personal, non-commercial project operated by a private individual residing in Poland. It is not operated by a registered company.
Data controller: Maksim Ahalau. Country: Poland. The controller determines the purposes and means of processing described here. Contact: [email protected].
Information we collect
Information you provide
- Account information: your email address when you sign in by email, or the basic account details described in the Google Sign-In section.
- Portfolio information: the pool or protocol selected, network and stablecoin derived from that selection, position amount, cash reserve, date added, and portfolio rules such as concentration and minimum-score limits.
- Authentication input: the one-time verification code you enter when using email sign-in. DeFiLight does not use account passwords.
- Correspondence: if you email us, your email address, message, and information needed to respond to your request. Please do not send wallet secrets or unnecessary financial information.
Technical information
When you visit any website, the hosting, authentication, market-data, and public blockchain infrastructure used to deliver requested content may receive ordinary network information such as your IP address, request time, browser or device type, requested URL, and security logs. The DeFiLight application code does not add advertising pixels or analytics trackers.
Information we do not request
DeFiLight does not request wallet addresses, seed phrases, private keys, exchange credentials, or transaction signatures. It does not read your wallet balance or transaction history. Portfolio amounts are values you enter for planning and tracking; they do not give DeFiLight control over any assets.
Google Sign-In and authentication
Google Sign-In is optional. If you choose “Continue with Google,” authentication is handled through Google and Supabase Auth. Supabase Auth may receive the Google account identifier, email address, name or profile name, and a profile image URL if Google includes it in the authentication profile. DeFiLight uses the resulting account identifier to associate your cloud portfolio with your account and uses your email address and available name in the account interface. The current interface does not use the Google profile image. DeFiLight does not receive your Google password.
The application uses Google only for authentication and does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or unrelated Google APIs. Google account information is used only to authenticate you, display your account identity, maintain your session, and synchronize the DeFiLight portfolio associated with your authenticated account.
DeFiLight’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, credit decisions, data brokerage, or unrelated profiling.
Your use of Google is also governed by the Google Privacy Policy.
Portfolio and application data
Portfolio data can include position identifiers, selected pool identifiers, entered amounts, the date a position was added, unallocated reserve, and the risk or concentration rules you configure. DeFiLight combines this with public protocol data to calculate estimated yield, costs, allocation, and concentration warnings.
This is planning and tracking information entered inside DeFiLight. It is not a record imported from your wallet or bank, and DeFiLight does not verify that the entered positions are actually owned by you.
Local browser storage
No account required
Your portfolio, reserve, rules, and language choice are stored in browser storage on your device. Portfolio data is not sent to the DeFiLight cloud database while you remain signed out.
Optional account
The same portfolio remains in browser storage and is also synchronized to the DeFiLight backend through Supabase so it can be available after sign-in on another device.
Your browser stores the portfolio under defilight-local-portfolio-v1 and language preference under defilight_locale. Supabase stores session information, including access and refresh tokens, in browser storage to maintain and refresh your sign-in. The local portfolio is shared within the same browser profile; signing out does not remove it or separate it by account.
DeFiLight does not implement advertising cookies, analytics trackers, or tracking pixels. Its own authentication integration uses browser storage rather than application-managed cookies. Google and other providers may use cookies on their own services. Local storage is used for the portfolio, language, and sign-in features, not advertising.
Clearing site data or private browsing may remove local data and sign you out. It does not delete cloud data. Downloaded JSON backups remain in your files until you delete them. Restoring a backup reads it in your browser; its portfolio contents may then synchronize if you are signed in.
Purposes and legal bases for processing
- provide email or Google authentication and maintain your session;
- save, restore, and synchronize your portfolio when cloud sync is enabled;
- calculate portfolio estimates, allocation, costs, and concentration warnings in the application;
- show your email or profile name in the account interface;
- protect the service, troubleshoot failures, and meet legal obligations.
DeFiLight does not use account or portfolio information to serve targeted advertising and does not include an advertising service in the current application.
Under the GDPR, account authentication and cloud portfolio storage are processed to provide the service you request (Article 6(1)(b)). Technical requests needed to deliver public market data, service security, troubleshooting, and ordinary support correspondence rely on legitimate interests in operating a reliable and secure service and answering requests (Article 6(1)(f)). Handling statutory data-protection requests and legally required disclosures relies on legal obligations (Article 6(1)(c)). If a separate activity requires consent, it must be requested for that activity and can be withdrawn without affecting earlier lawful processing.
Providing account details and a cloud portfolio is voluntary, but these details are needed for authentication and synchronization. You can use the core tools locally without an account. Portfolio estimates and scores do not produce automated decisions with legal or similarly significant effects on you.
Data storage and infrastructure
Local-mode portfolio information stays in your browser storage. In authenticated mode, Supabase provides authentication, account and session management, and cloud storage. A portfolio record contains your account identifier, portfolio contents, and last-update time. The application is designed to restrict access to your own record through database row-level security rules.
When sign-in and cloud storage are available, synchronization starts automatically: a local portfolio is uploaded if no valid cloud version exists, and a cloud portfolio is restored when the local portfolio has no positions or reserve. If both versions contain different data, the app asks which to keep. Subsequent changes are saved automatically. There is no separate cloud-sync opt-in switch. A Supabase availability request is also made when the application loads, including for signed-out visitors.
The statically exported website is hosted on Cloudflare Pages and delivered through Cloudflare’s network. Account and cloud portfolio data are stored in the Supabase project’s primary region, West EU (Ireland), eu-west-1. Cloudflare may process ordinary request, device, network, diagnostic, and security information needed to deliver and protect the website. Service providers may process data in countries outside your own; their locations and transfer safeguards are governed by their policies and agreements.
Third-party services and data transfers
- Supabase: authentication, session management, and cloud portfolio synchronization. See the Supabase Privacy Policy.
- Google: optional Google Sign-In. Google receives and processes the authentication request under its own policies.
- DefiLlama: public pool yields and yield-history data. Requests to its public API reveal ordinary network request information to that service; DeFiLight does not intentionally include your account or portfolio data in those requests.
- Public blockchain RPC providers: PublicNode, 1RPC, and the public Arbitrum and Base endpoints receive browser requests for protocol liquidity and utilization. They can receive your IP address, request metadata, and the public contracts being queried. These read-only requests concern public smart-contract addresses, not your wallet or portfolio.
- Cloudflare: Pages hosting, DNS, content delivery, and related operational security. Cloudflare receives network and request information when you visit the website. See the Cloudflare Privacy Policy.
- External DeFi protocol websites: Aave, Compound, Morpho, Spark, or another protocol site is opened only when you choose an external link. Your use of that site is governed by its own terms and privacy practices.
Data retention
- Local data remains until cleared by you or your browser. “Delete data” resets portfolio contents; language and session storage must be cleared separately using browser site-data controls.
- Cloud portfolio and account data are kept to provide your account until deleted following a request to [email protected], unless a specific legal obligation or justified security need requires limited retention. The application has no automatic inactivity-deletion schedule.
- Correspondence is kept for as long as needed to resolve your request and meet related legal obligations or establish, exercise, or defend legal claims.
- Provider logs and backups: this project uses Supabase Free, which does not include customer-accessible scheduled project backups. This does not mean that all provider operational copies or security logs are absent. Providers retain such information under their applicable service and privacy terms for operational, security, and legal purposes; deleting an account does not necessarily erase those records immediately. Contact us for information about retention applicable to your request.
Signing out does not delete local portfolio data, the cloud portfolio record, or the authentication account.
Data security
DeFiLight uses HTTPS service endpoints and managed authentication. Its database schema includes row-level access rules intended to separate each user’s cloud portfolio. Public Supabase credentials used by the browser are not database administrator credentials. Browser storage and downloaded backups are accessible to anyone with sufficient access to your browser profile or device; they are not a private vault.
No online service can guarantee absolute security. Protect access to your email and Google account, sign out on shared devices, and do not enter a seed phrase or private key into DeFiLight. If anyone asks for one while claiming to represent DeFiLight, do not provide it.
Your rights
Under the GDPR, you may request access, correction, erasure, restriction, and, where applicable, portability of your personal data. You may object to processing based on legitimate interests and withdraw consent for processing based on consent. These rights are subject to legal conditions and exceptions.
Email [email protected] to exercise your rights. We may need proportionate identity verification. Requests must normally be answered within one month; a permitted extension requires notice and reasons. You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent EU supervisory authority.
International data transfers
Google, Supabase, Cloudflare, and public market-data and blockchain infrastructure may process data outside Poland and the European Economic Area, including in the United States. Hosting a database in the EEA does not by itself rule out international transfers for support or other provider operations.
Supabase’s primary project region is Ireland (eu-west-1). Supabase explains that support and operational processing can involve Singapore and the United States and describes standard contractual clauses in its Data Processing Addendum. Cloudflare operates a global network; its Data Processing Addendum describes safeguards, including standard contractual clauses for covered restricted transfers. These documents set out the scope and conditions of the providers’ commitments; an EU database location does not make every service EU-only.
For information about the safeguards relevant to your data, or to request a copy, contact [email protected]. Google and other independently operated services describe their international processing in their own privacy notices.
Account and data deletion
Local portfolio: open “My portfolio,” choose “Data transfer,” and select “Delete data.” You can also clear DeFiLight site data in your browser. If you are signed in, clearing the portfolio may synchronize an empty portfolio to the cloud, but it does not delete your account.
Cloud portfolio, personal information, and DeFiLight account: the current application does not provide a self-service account deletion control. To request deletion of your cloud portfolio or account, email [email protected], preferably from the address associated with your account. DeFiLight may ask for reasonable information needed to verify the request. Clearing a portfolio while signed in can save an empty cloud record; it does not delete the account or the database record itself. If synchronization is unavailable or a version conflict is unresolved, do not assume that clearing local data has cleared the cloud copy.
You can download a JSON copy through “My portfolio” → “Data transfer” → “Download backup” when your portfolio contains positions or reserve. This exports portfolio contents, not your complete authentication record. After requesting cloud deletion, sign out and clear local site data to avoid retaining a local copy or uploading it again. Revoking Google access does not by itself erase your DeFiLight account or portfolio.
Deleting DeFiLight-held information or a DeFiLight authentication account does not delete your Google account or information that Google, Supabase, Cloudflare, or another provider controls independently under its own policies.
Children’s privacy
DeFiLight is not directed to children under 16 and does not knowingly collect personal information from children. If you believe a child has provided personal information, use the contact channel below to request review and deletion.
Changes to this Privacy Policy
This policy may be updated when the product, providers, or legal requirements change. Material changes will be identified on this page by a revised “Last updated” date and, where appropriate, a more prominent notice in the application.
Contact information
Questions, privacy requests, and account or cloud-data deletion requests should be sent to:
Data controller: Maksim Ahalau, a private individual residing in Poland. DeFiLight is the project name, not a company name.