DAVI ("we", "our", the "App") is operated by Nathapol Buddhamongkol ("Operator"), Bangkok, Thailand. This Privacy Policy explains what data we collect, why, and how we protect it. By using DAVI you agree to this Policy.

1. What we collect

• Account info — email address, display name, and avatar URL provided by Google or Apple when you sign in.
• Investment data you enter — stock holdings (ticker, quantity, cost basis) and watchlist items you create. Stored under your account.
• Stock analysis queries — the tickers you analyse and any prompts you submit. Sent to our AI provider (Anthropic) to generate guru-style valuation outputs.
• Crash reports — standard diagnostics provided by the app distribution platform you installed DAVI from.
• First-party product analytics — with your explicit consent, we record basic in-app events (e.g. which screens and features you use) in our own Supabase database to improve DAVI. This is first-party only: we do not use third-party analytics SDKs or trackers, and no event is recorded until you opt in. You can change your choice anytime in Settings.

We do not collect: payment card details, location data, contacts, photos, or device identifiers for advertising. We do not sell your data to anyone, ever.

2. Why we collect it

• To authenticate you and keep your portfolio private.
• To compute and display valuations across the gurus.
• To improve reliability via aggregated, non-identifying logs.

3. Where it lives

Account and portfolio data is stored in Supabase (Postgres) on servers located in Singapore. Application hosting is on Vercel (global edge, primary US). AI processing is performed by Anthropic (US). These are our only data sub-processors. Each provider has SOC 2 / ISO 27001 attestation.

4. How long we keep it

• Account data: until you delete your account.
• Portfolio + watchlist: until you delete them or your account.
• Query logs: 90 days, then automatically purged.
• Crash reports: per Apple / Google retention defaults.

5. Your rights

Under PDPA (Thailand) and GDPR (EEA / UK) you may:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your account and all associated data.
• Export your portfolio as CSV/JSON.
• Withdraw consent at any time.

To exercise any right, email team@bnashsandbox.com. We respond within 30 days.

6. Children

DAVI is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, email us and we will delete it promptly.

7. Security

All traffic uses TLS 1.3. Database access is restricted via row-level security tied to your authenticated session. Authentication tokens are short-lived and revocable. We do not store passwords — authentication is delegated to Google and Apple.

8. Investment disclaimer

DAVI provides analytical tools, not investment advice. Valuation outputs are computed estimates using public formulas attributed to named investors; they are not recommendations to buy, sell, or hold any security. You are solely responsible for your investment decisions. Past performance does not guarantee future results.

9. Changes to this policy

We may update this Policy as the App evolves (for example, when we introduce paid subscriptions). Material changes will be announced in-app and via email at least 14 days before they take effect.

10. Contact

Questions, requests, or complaints: team@bnashsandbox.com