Everything you own, one number. Only you can read it.

Encryption draws its boundary at the database, not at the running process: while your session is unlocked the server can open your key — it holds a copy sealed under your raw session cookie, and the database stores only that cookie's hash — because pricing your holdings and adding them up is the job. That is true of any application that has to show you your own data, and Port does not pretend otherwise. What it buys you is that a copy of the database alone — a dump, a replica, an old disk — yields nothing readable. That is the leak most likely to actually happen.

The larger items: usernames, passkey device names, row and table counts and ids, snapshot dates, created and updated timestamps, which holdings share an account and how many accounts exist, how many upstream API keys and backup destinations exist — never which vendors, never the credentials — whether automatic backups are on and when one was last taken, each account's role, and when each passkey was last used. Everything else is sealed: account names, wallet addresses, quantities, values, cached prices, and the whole net-worth history. This is a summary and says so; the itemised version is published in the project's README, and the privacy page inside the app renders it live for your own account.

Said plainly, because the alternative is overselling: when you unlock, your browser hands the unwrapped key to the server — that is how prices, totals and history work at all. The server keeps it sealed under your raw session cookie, and the database stores only that cookie's hash, so the stored copy opens nothing on its own. It never sends the key back to the browser. And it holds the key on a clock: an idle session drops it, and every session drops it eventually, leaving you signed in but locked until one passkey tap re-derives it in place.

They are deliberately separate powers. A recovery link registers a fresh passkey and deletes your others, so it returns the account — but that new passkey carries no wrapped copy of your data key, which is why it lands on the unlock screen. Only the recovery code opens the data: 25 characters, shown once when encryption was turned on, and never sent to the server. Lose every passkey and the code, and the data is gone. There is no escrow and no override — which is the property that makes every other answer here true.

Stocks and ETFs come from Yahoo Finance, crypto from CoinGecko, cards from pokemontcg.io's TCGplayer market price. A property is marked to a public home-value index for its ZIP once you say what the home was worth and when, or to a valuation service where one is configured; a custom asset takes whatever per-unit value you set, and cash takes a label and a balance. If a feed is down you get the last cached price, flagged stale, and the dashboard still renders.

Those two are the only upstreams that receive something identifying about you rather than about an asset — the privacy page inside the app itemises every one of them, what it receives, and when. Beyond those lookups there is nothing: no telemetry, no analytics, no crash reporting, no update check. Your browser talks only to this install — no fonts from a CDN, no analytics tag, no embedded widget, on this page or inside the app. Off-site backups carry ciphertext: Dropbox or Backblaze see a sealed file, padded so its size does not track your portfolio, and the times you backed up.

Port can also push the sealed container to your own Dropbox or Backblaze B2 — on demand, or automatically when you sign in — pruning old copies and touching only the files Port itself wrote. The plain export is the deliberate exception to everything else on this page: it is readable by construction, because a file only your passkey could open could not be restored onto a fresh machine, which is the one job a backup has. Downloading it asks you to acknowledge exactly that.

An administrator creates the account and hands out a single-use invite link. You open it and register your own passkey on your own device — there is no public sign-up form and no password anywhere in the flow. The link can be used once, and then it expires.