Privacy Policy

1. Data Protection Officer

Our Data Protection Officer (DPO) can be reached at [email protected] for any questions, concerns, or requests regarding your personal data.

2. Personal Data We Collect

We collect the following categories of personal data:

• Account information: Email address and display name (provided via Google or email authentication through Firebase Authentication)
• Portfolio data: Stock watchlist entries, share quantities, average cost prices, dividend history, and trading journal entries. Sensitive fields (shares, average cost, notes) may be encrypted client-side at your discretion
• AI Copilot chat history: When you chat with the AI assistant, message contents are encrypted on your device with your AES-256-GCM key before being stored in our database. We never see plaintext conversations
• Subscription and billing data: If you subscribe to Pro or Premium, billing details (payment method, charges, subscription status) are processed by Stripe. We store your tier and Stripe customer ID; we do not store full payment card details
• Preferences: App settings, notification preferences, AI model preferences, widget configurations, and onboarding progress
• Usage data: Feature interactions, page visits, and behavioural events for improving the Service
• Device information: Browser type and basic device capabilities (for on-device AI compatibility checks)

3. How We Collect Personal Data

We collect personal data through:

• Account registration and authentication via Firebase Authentication
• Your direct input when adding stocks, managing your watchlist, or configuring settings
• Automated collection of usage events during your interaction with the Service
• Browser storage mechanisms (see our Cookie Policy)

4. Purposes of Data Collection

We use your personal data for the following purposes:

• Providing and maintaining the Service (watchlist, portfolio tracking, AI analysis)
• Authenticating your identity and securing your account
• Delivering personalised features such as AI market summaries and smart alerts
• Sending notifications and digests you have opted into
• Improving the Service through aggregated, anonymised usage analytics
• Providing onboarding guidance and daily tips
• Complying with applicable laws and regulations

5. Consent

By creating an account and using the Service, you consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy. You may withdraw your consent at any time by deleting your account, though this may affect your ability to use the Service. To withdraw consent, contact our DPO.

6. Disclosure of Personal Data

We may disclose your personal data to:

• Firebase / Google Cloud Platform: For authentication, data storage, and hosting (Cloud Run + Firestore in asia-southeast1)
• AI service providers: Cloud AI features (AI Pulse, Copilot Chat, Explain, Deep Dive) send your query text and a summary of relevant portfolio context to third-party model providers (e.g., Google Gemini, Z.ai GLM). Encrypted fields are decrypted in your browser only — model providers receive the prompt, not raw ciphertext
• Stripe: Subscription billing. Stripe receives payment details, billing address, and subscription metadata directly from you; we receive only customer ID and subscription status
• Push notification services: Web Push (Firebase Cloud Messaging) for delivering alerts you opt into
• Market data providers: Stock ticker symbols you track may be shared with data providers (Polygon, Yahoo Finance, SGX feeds) to retrieve pricing
• Law enforcement: When required by law, regulation, or legal process

We do not sell your personal data to third parties. When you use on-device AI features (Premium tier with WebLLM), your data remains entirely in your browser and is not transmitted to any AI server.

7. Cross-Border Transfers

Your data may be stored and processed on servers located outside of Singapore (including in the United States and other regions where Google Cloud operates). We ensure that any cross-border transfers comply with the PDPA by requiring that recipients provide a comparable standard of data protection.

8. Data Security

We implement the following security measures to protect your personal data:

• All data transmitted between your browser and our servers is encrypted via HTTPS/TLS
• Firebase Authentication with secure token-based session management
• Optional client-side AES-256-GCM encryption for sensitive portfolio data and AI Copilot chat history, with keys derived from your passphrase using PBKDF2-SHA256 (100,000 iterations)
• Encryption keys are stored only in your browser's IndexedDB and are never transmitted to our servers
• Encrypted blobs are stored opaquely in Firestore — even with full database access, ciphertext cannot be decrypted without your passphrase
• Firestore security rules restrict data access to authenticated users' own documents
• Stripe handles all payment card data; we never see or store raw card numbers

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Aggregated, anonymised data that cannot identify you may be retained indefinitely for analytics purposes.

10. Your Rights Under the PDPA

Under the PDPA, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of any inaccurate or incomplete personal data
• Withdrawal of consent: Withdraw your consent for the collection, use, or disclosure of your personal data
• Data portability: Request transfer of your data in a commonly used format

To exercise any of these rights, please contact our DPO at [email protected]. We will respond to your request within 30 days.

11. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals, we will notify the Personal Data Protection Commission (PDPC) and affected individuals as soon as practicable, in accordance with the PDPA's mandatory data breach notification requirements.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service. Your continued use after any changes constitutes acceptance of the updated policy.

14. Contact Us

For questions or concerns about this Privacy Policy or your personal data, contact our Data Protection Officer at [email protected].