Privacy Policy

1. About this policy

This policy covers the InvestTrax website and app, including account access, manual investment tracking, collectibles, market information, AI features and paid access.

Needs confirmation: The legal name, business address and jurisdiction of the person or company responsible for InvestTrax, and the effective date of this policy.

2. Information InvestTrax handles

• Account and profile: Email address, password submitted for authentication, account identifier, name, profile photo, onboarding answers and preferences you provide.
• Financial records: Holdings and asset identifiers, quantities, purchase dates, invested amounts and cost basis, currencies, valuations, sales, income, expenses and other transactions you record. Features also maintain portfolio observations, goals, business and hustle records, watchlists and calculated returns.
• Collectibles and photos: Card or collectible details, condition and grading information, purchase and sale amounts, scan history, corrections and photos you submit or save.
• AI content: Messages, conversation history and responses. Portfolio-related questions and personalized briefs may also use holdings, transactions, goals, collectible details and calculated financial summaries.
• Purchases: Plan and entitlement status, payment-provider customer/subscription identifiers and Apple transaction identifiers and signed purchase information used to validate and restore access.
• Notifications and device information: Notification preferences and, when native push is enabled, device registration tokens. Error reporting and abuse-prevention features handle technical errors, account identifiers and request information; account-deletion rate limiting uses a hashed network address.
• Support: Information you include in emails or other support requests.

Needs confirmation: The complete production inventory of visitor analytics, cookies, network logs and diagnostics, including the information each service records.

3. How information is used

The implemented features use information to authenticate accounts, save and display records, calculate portfolio values and returns, recover unfinished onboarding, retrieve market and collectible information, generate personalized AI responses and briefs, verify paid access, send enabled notifications and diagnose errors or prevent abuse. Information in support requests is used to address the request.

Needs confirmation: Any additional operational, marketing or analytics uses; the legal bases for processing where applicable; and whether any information is sold, shared for advertising or used for profiling beyond the features described here. This draft makes no “never sold” or “never shared” promise.

4. Storage and device access

InvestTrax uses Lovable Cloud for account authentication, application records and uploaded-file storage, and Lovable for website/app infrastructure. The app also keeps session information, preferences, onboarding drafts and selected cached data on your browser or device to support sign-in and faster loading.

Camera and photo selection support card scanning and uploads. Optional native biometric features use the device authentication system and a locally stored sign-in credential. Native notification controls are opt-in in Settings. Shared or downloaded exports create copies outside InvestTrax that you control.

Needs confirmation: Hosting and backup locations, international transfers, access arrangements, local-cache cleanup, security procedures, encryption practices and retention periods. No specific security certification or retention guarantee is asserted here.

5. Third-party processing

• Lovable / Lovable Cloud: Hosting and application infrastructure, authentication, records, uploaded files and diagnostic reporting.
• Lovable AI Gateway and configured Google Gemini models: Process chat content and relevant financial context for AI responses and briefs; scan identification sends submitted card images for AI analysis. Personalized briefs can be generated without sending a chat message.
• Stripe: Processes supported website purchases and subscription management. Checkout passes billing-related account and plan identifiers; InvestTrax uses returned payment/subscription information to determine access. Card-entry information is handled by Stripe’s checkout.
• Apple: Handles supported iOS purchases, restores and subscription management through the App Store. Signed transactions are submitted to InvestTrax for entitlement checks. Apple Push Notification service handles registered device tokens and notification payloads for enabled native push.
• Yahoo Finance: Supplies configured stock and cryptocurrency market information through server requests using asset symbols.
• SportsCardsPro / PriceCharting: Supplies collectible catalog, price and photo information using card identity and catalog queries.
• Google Fonts: The website requests fonts from Google, creating a browser request to that service.

Needs confirmation: The complete active production provider/subprocessor list, including email delivery, currency-rate services, analytics and any market-data fallbacks; provider retention and deletion terms; and whether AI inputs or photos are used for model training. This draft does not promise that AI providers retain nothing or do not train on submitted data.

6. Subscriptions and billing information

InvestTrax offers Free access and paid plans. Website billing supports monthly Standard and Premium subscriptions and a one-time Lifetime option. The iOS implementation also distinguishes Premium Annual from true Lifetime access: an annual subscription is recurring, not a one-time Lifetime purchase. Price, currency, billing interval and purchase terms shown by the purchasing platform should be reviewed before payment.

Supported iOS purchases are processed by Apple; supported website purchases are processed by Stripe. InvestTrax receives identifiers and status needed to verify access, including Apple-signed transactions during purchase, restore or entitlement checks. Recurring subscriptions require cancellation through the platform where they were purchased. Apple subscriptions can be managed in the device’s Settings → Apple Account → Subscriptions; website subscriptions use the available billing-management controls.

Deleting an InvestTrax account is not a subscription-cancellation mechanism. Cancel recurring billing separately before deleting your account. InvestTrax’s account-deletion process does not itself erase records held by Apple or Stripe.

Needs confirmation: Current live product prices and billing intervals, cancellation and refund procedures, and retention of billing records. This draft does not certify that the current live checkout matches every displayed plan price.

7. Your choices and deletion requests

You can edit supported records and preferences, use available export controls and manage optional notifications in Settings. To initiate account deletion, sign in, open Security from your profile/settings, select “Delete account” and complete the confirmation, including typing DELETE.

The implemented process attempts to remove listed account-owned application records and uploaded files, then the profile and authentication account. Its full coverage and successful removal of every record have not been verified. Account deletion is not a promise of immediate erasure from backups, logs or third-party systems.

To request deletion of specific data, ask about your information, or request account deletion if you cannot sign in, use the contact below. Do not include passwords, payment-card numbers or unnecessary financial details in your message.

Needs confirmation: Request verification and handling procedures, response times, available privacy rights by location, all retention exceptions and backup expiry periods, and complete deletion coverage. No unconfirmed statutory response deadline is promised.

8. Contact and remaining publication checks

The current InvestTrax support contact is support@investtrax.app. Privacy or deletion requests can be addressed there with the subject “Privacy request.” Help & Support is also available inside InvestTrax.

Needs confirmation: That this mailbox is monitored and authorized to receive privacy/deletion requests, the responsible operator’s identity, any dedicated privacy contact, the age eligibility/children’s-data policy, and how material policy changes will be communicated. The owner must approve these details before adopting an effective policy.