Privacy Policy
Updated 29 August 2026
What stays on your device
Your accounts, holdings, transactions, cash flow, goals, snapshots and settings are stored locally on your device, encrypted at rest. No account is required for the core app, and this local data is never uploaded on its own.
When you run online analysis
The health/research report is computed on our server. When you run it, a compact snapshot of your holdings (units, amounts, dates and fund codes) is sent to our analysis engine, used to compute the report, and discarded — it is processed transiently and not stored. Your bank descriptions, raw statement files and credentials are never sent.
Cloud sync (optional)
If you turn on Cloud, your portfolio is stored with our cloud provider (encrypted on their servers, not end-to-end) so it can sync across your devices. This needs an account (email). You can delete your cloud data at any time (see “Account deletion”); local-only use never creates an account.
Optional AI interpretation
AI interpretation is off unless you enable it. When enabled, only a compact set of portfolio metrics and health flags (and, for the second opinion, the primary proposal) are sent to the AI route you chose. Your transaction ledger, daily NAV history, bank descriptions, raw holdings files and credentials are never sent.
Payments
If you buy Built-in Premium, the purchase is handled by Google Play. We receive confirmation of your subscription status, not your card details.
Analytics
Website: aggregate measurement, always on, no identifier. Every visit is measured in a way that cannot identify you: which page you landed on, which pages you moved through, roughly how long you stayed, the country, the broad device and browser class, where you arrived from, and how quickly pages loaded. This layer sets no cookie and stores no identifier, so the same browser on Monday and on Friday is two unrelated visits and no profile is ever built. It runs everywhere and needs no permission, because it processes nothing personal. It is never sold and never shared with an advertising network.
Website: linked analytics and session replay. Separately, we can link a visit to a rotating, randomly generated identifier so we can tell a returning visitor from a new one, and we can record an anonymised replay of how a page was used (Microsoft Clarity) to find layout and usability problems. This is the layer that can follow you between visits, so it is treated differently depending on where you are:
- In India, the EEA, the UK, Switzerland, Brazil, South Africa, Thailand, South Korea and Japan, it does not start until you press Allow on the small card that appears after you have been reading for a moment. Closing the card, pressing Escape or ignoring it is not consent and turns nothing on. If you choose Not now we do not ask again for 30 days.
- Elsewhere, it is on by default and you can switch it off at any time from this page.
Replay runs in Microsoft Clarity's Strict masking mode, and every form field and every product surface is explicitly masked before the first frame is captured — so what is recorded is the shape of the page and where a pointer went, never what you typed. Replay is switched off entirely on /delete-account, /research/, /compare/, /go/play and /turnstile, and never runs on the owner preview host.
What website analytics never receives, on either layer. Your holdings, balances, transactions, instrument or fund identifiers, units, file names or contents, AI prompts or results, your email or account identifier, your precise location, any advertising or hardware identifier, and the text you type into search. The search box on Research and Compare runs entirely in your browser: the query is never sent to us, never written into the address bar and never recorded. Our server independently rejects any event or property outside a fixed, non-financial list, so even a tampered page cannot send us something else.
How long we keep it. Individual event rows are deleted automatically after 90 days. Beyond that we keep only daily and weekly totals — counts of visits, sources, pages and completions with no identifier in them — for up to 25 months, so we can see whether the product is improving over a couple of years.
Turning it off, and deleting what we hold. You can withdraw at any time using the button below. That stops the sender immediately, deletes the analytics and session identifiers from your browser, and stops any replay. While an identifier still exists you can also ask us to erase every event recorded against it, and we delete those rows on request rather than waiting for the retention window.
App — optional, off by default. The app collects no analytics unless you turn on Help improve OmniAsset in Settings → Privacy. If you opt in, we collect anonymous product-usage and performance events (for example that a portfolio section was opened, that a search happened — never what you searched, that a health check completed with only a coarse speed band, or that an action failed with a stable error code). Opting out stops the sender, purges anything still queued on the device and deletes the rotating identifier immediately.
We never collect your holdings, amounts, balances, security or fund names, transaction history, email, account identifier, files, AI prompts or any portfolio content as analytics — the app’s event design makes that impossible, and our server rejects anything outside a fixed, non-financial event list. There are no third-party advertising or cross-site tracking SDKs.
Account deletion
You can delete your account and cloud data at any time — from the app, or on the web at /delete-account without reinstalling. Deleting the account removes active cloud data and sessions; encrypted backups age out under the retention policy. It does not cancel a Google Play subscription (manage that in Google Play).
Who processes data for us
We use as few processors as possible, and each one only for the purpose named here.
| Processor | Purpose | What it receives |
|---|---|---|
| Cloudflare | Website hosting, aggregate Web Analytics, and the edge that decides whether a consent card is required | Page requests, cookieless aggregate traffic and speed measurements, and the visitor’s country (used to decide the consent question and stored only as a country, never an IP address). |
| Supabase | Optional cloud sync, authentication, and analytics storage | Encrypted portfolio data if you choose Sync & recover; your sign-in email; and, only with consent, the non-financial analytics events described above. |
| Microsoft Clarity | Anonymised session replay and heatmaps on marketing pages | How a page was used — pointer movement, clicks and scrolling — with every form field and product surface masked. Never your holdings, balances or anything you type. Only with consent where consent is required. |
| Google Play | App distribution, subscriptions and install attribution | Your purchase and subscription status, and the campaign tags that brought you to the store listing. We never receive your card details. |
| Render | The deterministic analysis engine behind the health check | The portfolio summary needed to compute a report. It is analysed and returned, not retained. |
| Brevo | Sending account emails such as sign-in codes | Your email address and the message itself. Not used for marketing. |
| Your chosen AI provider | Only if you turn AI on | Only the exact compact summary the app shows you before each send. With your own key or your own computer, the route is yours and we are not in it. |
Contact
Questions about privacy: [email protected].