Overview
DashFolio Automator is a Chrome extension that sets up Flex reporting on the Interactive Brokers Client Portal. It creates the Flex Queries DashFolio needs, ticks the report sections DashFolio uses (the full list is below) and saves the resulting Flex token and query IDs to your DashFolio account.
Done by hand, that configuration means dozens of checkboxes spread over several Interactive Brokers pages, and the extension clicks through them for you. This page explains which data the extension handles and where that data goes.
In short, apart from recording your consent and checking your API key, the only data that leaves your browser is the Flex token and the query IDs you came here to sync. They go to your own DashFolio account and nowhere else. The extension has no analytics or trackers, and nothing runs in the background to collect data.
What the extension creates in your Interactive Brokers account
When you start the setup from the panel, and only after you have given your consent, the extension does the following inside your own Interactive Brokers session:
- It turns on the Flex Web Service if it is off, then reads the Flex token that Interactive Brokers displays on that page. If there is no token yet, or if the one on the page has expired, it asks Interactive Brokers for a new one and saves it there. It never replaces a token that is still valid.
- It creates an Activity Flex Query named "DashFolio Last 365 Days", in XML format, covering the last 365 calendar days.
- It creates a Trade Confirmation Flex Query named "DashFolio Trades Today", in XML format, covering the current day, so that trades show up in DashFolio the same day.
Both queries cover every account your Interactive Brokers login gives access to, because the extension selects all of them in the query settings. If a query with one of these names already exists, the extension does not create a second one and does not change the one you have. It reuses it, so the setup carries on and that query's ID is sent to DashFolio with the token.
The "DashFolio Last 365 Days" query includes these report sections:
- Account Information: account ID, alias, account holder name, account type and master account name.
- Cash Report, broken out by currency: starting and ending cash, deposits, withdrawals, transfers, dividends, interest, commissions, fees and taxes.
- Cash Transactions, in detail: dividends, payments in lieu of dividends, withholding tax, deposits and withdrawals, bill payments, and broker interest paid and received.
- Change in Dividend Accruals, in detail.
- Corporate Actions (splits, mergers, spin-offs and similar events), in detail.
- Open Positions, at summary level.
- Trades, at execution level.
- Transfers of positions in and out of the account.
- Change in NAV (net asset value), with realized and unrealized results.
- Equity Summary and Interest Accruals.
The "DashFolio Trades Today" query includes the Trade Confirmations section, at execution level.
DashFolio uses these sections to rebuild your positions, performance, dividends and cash from your Interactive Brokers records. The extension never runs the queries and never reads their results. DashFolio fetches them later with the token, as described below.
The extension does not place orders, and it does not change your trading permissions, your password or any other account setting. It does not delete Flex Queries you already have. You can remove what it created at any time from the Interactive Brokers portal: delete the two queries under Reporting, Flex Queries (older versions of the portal show this menu as Performance & Reports), and turn off the Flex Web Service if you no longer use it. DashFolio then stops receiving new data.
What the extension stores on your device
The extension keeps the following in Chrome's local extension storage (chrome.storage.local, which is not synced to your Google account):
- The DashFolio profile names you choose and their API keys (format
dfk_...), which you generate yourself in DashFolio. - The Flex Query IDs captured while the extension automates the Interactive Brokers portal for you, and the validity dates of the Flex token.
- A short activity log of the steps the extension performed and the errors it met, capped at 300 entries. Tokens and account numbers are masked before an entry is written.
The Interactive Brokers Flex Web Service token itself is not stored on your device. The extension holds it in memory only, from the moment it reads it on the Interactive Brokers portal until DashFolio confirms that it arrived, then deletes it. If the sync does not complete, the token is deleted when you close the browser. After that the panel shows only its last four characters. If the token expires later, you run the setup again to send a new one.
None of this data leaves your device on its own. Uninstalling the extension deletes all of it, since Chrome removes an extension's local storage on uninstall.
Your consent
Before the extension does anything on your behalf, it asks for your explicit consent with a checkbox. By ticking it, you allow DashFolio Automator to:
- create the two Flex Queries DashFolio needs in your Interactive Brokers account;
- send your Interactive Brokers Flex Web Service token, with the IDs of those queries, to your DashFolio account so your trades can be imported.
Until you give that consent, the setup and sync buttons stay disabled and nothing is sent. The extension also checks with DashFolio and refuses to run the setup or send anything while your account has no valid consent given in the extension.
DashFolio also asks for your consent on its own site, with the same checkbox, when you create the auto-sync connection the extension will fill. That consent is recorded too, but it does not replace the one given in the extension: the extension asks for its own before sending anything. If you create several auto-sync connections, each one records its own consents.
Your consent is recorded on your DashFolio account, for the Interactive Brokers connection it applies to, with the date you gave it and the version of this policy it refers to (current version: 1). Consent given on one computer is recognised on your other devices, and withdrawing it blocks the extension on all of them. Each consent and each withdrawal is kept as a separate entry, so the record shows what you agreed to and when. We do not record your IP address or browser details for this purpose.
These records hold your email address at the time of consent. We keep them for three (3) years after you delete your DashFolio account, so that we can prove your consent if it is ever disputed, and then delete them automatically. If you later open a new account with the same email address, you will be asked for your consent again, because an old record never counts as consent for a new account.
If what the extension does or sends changes, the version number will change and you will be asked for your consent again before anything new happens.
To withdraw your consent, open the auto-sync connection on the Add Trades page of DashFolio and click Withdraw under Consent. DashFolio then stops importing that account, including the scheduled imports, and records your withdrawal with its date. The trades already imported are kept, and your Flex token stays stored, encrypted, so you can resume later: give your consent again from the same place on DashFolio, or in the extension, which asks for it the next time you use it. You can also reach us through our contact page.
What is sent to DashFolio and when
The extension talks only to the DashFolio server (dashfolio.ai), over HTTPS, authenticated with your own API key, and only when you do something:
- When you add or test a profile, it checks that your API key works.
- During the setup you start on the Interactive Brokers portal, and when you click "Sync to DashFolio", it sends your Interactive Brokers Flex Web Service token with its validity dates, and the IDs and names of the Flex Queries it created.
Nothing else is in the payload. DashFolio needs it to fetch your Interactive Brokers reports on your behalf, which is why you installed the extension.
On arrival, DashFolio encrypts the Flex token (AES-256-GCM) before writing it to its database. The token is decrypted only in server memory, when DashFolio uses it (mainly to fetch your reports from Interactive Brokers), and it is never sent back to your browser.
After the setup, DashFolio uses the token to fetch your reports directly from Interactive Brokers' Flex Web Service, without the extension. The extension stays idle until you add another Interactive Brokers account or renew an expired token. The DashFolio privacy policy covers how DashFolio handles your data.
What the extension never sees
The extension never sees your Interactive Brokers username or password. You log into the Interactive Brokers portal yourself, and the extension fills forms and clicks inside that session only when you start a setup action from the panel. It never reads or captures what you type on the Interactive Brokers login page.
It also never reads your positions, balances or trade history. It chooses which sections Interactive Brokers will include in the reports but never opens the reports, which DashFolio fetches later on your account using the token.
Diagnostic reports
If something goes wrong, the "Support" button in the panel builds a diagnostic report with the extension version, browser version, profile names and the masked activity log. Nothing is sent automatically. The report is shown to you and copied to your clipboard, and you send it yourself through our contact page. No report is created unless you press the button.
What we don't do
We don't sell or share your data with anyone, and we don't use analytics or advertising SDKs. The extension contains no remotely loaded code. It runs only on Interactive Brokers portal pages and does nothing on other websites.
Deleting your data
To delete the data on your device, remove a profile in the panel or uninstall the extension. To delete it on DashFolio, revoke the API key or delete the integration from your account, or ask us through our contact page and we'll remove it.
Changes and contact
If this policy changes in a way that matters, the "last updated" date above will change, and the new version will be published at this address before it takes effect.
For questions, reach us through our contact page.