Privacy Policy

1. What we collect

• Account info: your email address and the name you give us. If you sign in with Google or Apple, we also receive the name and profile picture that provider shares.
• Investment data you enter: holdings (ticker, quantity, cost basis), strategies and the stocks you follow. Stored under your account.
• Questions you send to the DAVI assistant: sent to our AI provider (Anthropic) to write the answer. We keep a monthly count of questions for your plan’s limit.
• Connections to ChatGPT, Codex, Claude or another MCP client you choose: we receive only the tool requests that client sends and return the requested DAVI data. We do not receive or retain your full conversation history. We use your DAVI account to authorize access and may return your email address and email-verification status through UserInfo so the service can label the connected account correctly.
• Payments: through Stripe (web) or the App Store / Google Play (apps). We receive your plan and its payment status, never your card number.
• Crash reports: standard diagnostics from the app store you installed DAVI from.
• In-app usage analytics: only while you are signed in and have consented, we record in-app events (such as which screens and features you use), tied to your account together with a random device id and session id the app creates, in our own Supabase database to improve DAVI. Without consent, or while you are signed out, none of these events is recorded. Change your choice any time in More › Settings › Usage analytics.
• Server-side events follow the same switch: views of the public stock pages (the ticker), starting the Pro trial, accepting a friend’s invite, a completed payment and a watchlist alert being sent are recorded as usage analytics only when your account has consented, and never while you are signed out. All of it stays in our own database; there are no third-party analytics SDKs or trackers.

We do not collect payment card details, location data, contacts, photos, or device identifiers for advertising. We do not sell your data to anyone, ever.

2. Why we collect it

• To sign you in and keep your portfolio private.
• To calculate and show value ranges for the stocks you look at.
• To send the emails you asked for: sign-in links, confirmations and the summaries your plan includes.
• To bill your plan through the payment channel you chose.
• To improve DAVI from usage analytics, only with your consent (section 1).
• To authenticate and operate an AI / MCP connection that you enable.
• To improve reliability through aggregated, non-identifying logs.

3. Where it lives

Account and portfolio data is stored in Supabase (database and authentication) on servers in Singapore. The App is hosted on Vercel (global edge, primary US).

These are our only data sub-processors: Supabase · Vercel · Anthropic (AI, US) · Stripe (web payments) · RevenueCat (App Store / Google Play subscription status) · Resend (email delivery). Each provider publishes its own security and privacy commitments.

When you choose to connect DAVI to an external AI service such as OpenAI (ChatGPT / Codex) or Anthropic (Claude), tool requests and results pass through that service under its own policy. DAVI does not include your portfolio, strategies or followed stocks in these read-only research tools.

4. How long we keep it

• Account data: until you delete your account.
• Portfolio, strategies and followed stocks: until you delete them or your account.
• Questions to the DAVI assistant: we keep no question text, only your account’s monthly question count, until you delete your account.
• AI / MCP OAuth connections: authorization codes expire after 10 minutes, access tokens after 1 hour and refresh tokens after 30 days. DAVI stores only token hashes and the authorization details tied to your account. Expired or revoked records are deleted when you delete your account.
• Usage analytics (only with your consent): no automatic deletion. When you delete your account, the recorded events are unlinked from it (the account id is removed), but the events themselves are kept. To have them deleted too, email us before you delete your account (section 5).
• Crash reports: per Apple / Google retention defaults.
• Payment records: as long as tax law requires.

5. Your rights

Under the PDPA (Thailand) and the GDPR (EEA / UK) you may:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your account and the data tied to it, yourself in the app: More › Settings › tap your email › Delete account and all data. What stays after deletion is listed in section 4.
• Ask for a copy of your data as a file, by email.
• Withdraw consent at any time.

To exercise any right, email team@bnashsandbox.com. We respond within 30 days.

6. Children

DAVI is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, email team@bnashsandbox.com and we will delete it promptly.

7. Security

All traffic is encrypted with TLS. Database access is restricted by row-level security tied to your signed-in account. Sign-in tokens are short-lived and revocable.

Passwords are stored only as one-way hashes by our authentication provider (Supabase Auth); we never see them. If you sign in with Google or Apple, that provider checks your password.

AI / MCP tokens are stored only as SHA-256 hashes. Connections use PKCE (S256), and tokens are bound to the DAVI MCP resource to reduce code or token reuse against another service.

8. Investment disclaimer

DAVI is an educational calculation tool, not investment advice. Its outputs are value ranges calculated from published formulas; they are not recommendations about any security. You alone make every investment decision. Past results do not indicate future results.

9. Changes to this policy

We may update this Policy as the App evolves. Material changes will be announced in the App and by email at least 14 days before they take effect.

10. Contact

Questions, requests or complaints: team@bnashsandbox.com