Privacy Policy

Much of the Service — market indicators, signals, quotes, and research — is available without an account. We collect personal information only as described below.

Information you provide:

• Email address — used to create and sign in to your Oxinion account (via a one-time email code or password). Identity is shared across Oxinion apps through a single sign-on.
• Portfolio and holdings data — the tickers, share quantities, and average prices you add to your portfolios, plus your Autopilot preferences, strategy rules, and any discussions you post.
• Watchlist & alerts — the tickers you follow and the alert conditions you set (e.g. RSI or price thresholds) so we can notify you. Informational only — we do not place trades.
• Investing activity log — the days you mark that you invested, used to show your personal habit streak.
• Push notification token — if you enable notifications, a device push token (via Expo / Firebase Cloud Messaging) used only to deliver the alerts you set up.
• Brokerage connection details (optional, web only) — if you connect a broker (e.g. Alpaca or Toss), the API credentials you provide. These are encrypted at rest.
• Payment information (optional, web only) — if you purchase a paid plan, payments are processed by Stripe; we do not store your full card details.
• Messaging identifiers (optional) — if you connect Telegram for notifications, your Telegram chat ID.

Information collected automatically:

• Website analytics — our website uses Google Analytics to understand aggregate usage (e.g. pages visited).
• Advertising (mobile app) — the mobile app displays banner ads through Google AdMob. To serve and measure ads, AdMob collects your device’s advertising identifier, approximate (IP-based) location, app-interaction events, and diagnostics. You can reset or limit your advertising ID in your device settings.
• Technical data — standard request logs (such as IP address and device/browser type) generated when your client communicates with our servers.

• To provide and operate the Service and your account.
• To store and display your portfolios, holdings, and Autopilot configuration.
• To run features you enable (broker sync, notifications, paid plans).
• To display ads in the mobile app through Google AdMob.
• To secure the Service and prevent abuse.
• To understand aggregate website usage and improve the product.

We do not sell your personal information. Our website does not serve ads; the mobile app shows banner ads through Google AdMob, as described in Sections 1 and 3.

We share data only with service providers that help us operate the Service, and only as needed:

• Supabase — authentication, database, and hosting for your account and portfolio data.
• Google Analytics — website usage analytics (website only).
• Google AdMob — our advertising partner for the mobile app; receives your advertising ID, approximate location, and app-interaction and diagnostic data to serve and measure banner ads.
• Stripe — payment processing for paid plans (web only).
• Your connected broker (e.g. Alpaca, Toss) — only when you choose to connect one, to read holdings or place the actions you authorize.
• Telegram — only if you connect it to receive notifications.

We also use market-data sources (such as Yahoo Finance) to display quotes and fundamentals; these receive the ticker symbols requested, not your identity. We may disclose information if required by law or to protect our rights and users.

We keep your personal data for as long as your account is active. You can delete your account and all associated data at any time:

• In the mobile app: Settings → General → Delete account.
• On the web: finance.oxinion.com/delete-account.

Deletion is immediate and permanent. It removes your portfolios, holdings, Autopilot data, broker settings, strategy rules, discussions, API keys, notification settings, and your Oxinion identity (which signs you out of every Oxinion app). Certain records may be retained only where required by law.

Data is encrypted in transit (HTTPS). Sensitive secrets, such as brokerage API credentials, are encrypted at rest. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard measures.

The Service is not directed to children, and we do not knowingly collect personal information from children under the age required by your jurisdiction (13, or higher where applicable). If you believe a child has provided us data, contact us and we will delete it.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise deletion directly (see Section 4) or contact us for other requests.

We operate the Service from, and store data on infrastructure located in, various regions. By using the Service you understand your information may be processed in countries other than your own.

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

Questions about this policy or your data? Contact us at info@oxinion.com.