Cryptofolio uses APIs provided by CoinGecko and Ethplorer to function, and as such, requests are made to said APIs. To read the privacy policies of these services, please visit the following links:

https://www.coingecko.com/en/privacy

https://ethplorer.io/privacy

As far as Cryptofolio itself is concerned, no user data is sent or stored anywhere the user isn't aware of. When using the No-API mode, all data is stored locally on the device. If the user opts to use the standard mode with the self-hosted API, then data is stored on whatever device the user hosts the API on. 

In short, there are no centralized Cryptofolio servers. Users host their own API, and user data is always stored on the device hosting the API, or the device using the app.