Privacy Policy

Effective date: 13 September 2026  ·  Pocket Investor

1. Who we are

Pocket Investor is operated by Curonian Group Pty Ltd (ACN 697 342 966, ABN 73 697 342 966), an Australian company whose registered address is 2/39 Dover Road, Rose Bay NSW 2029, Australia. When this policy refers to “Pocket Investor”, “we”, “us”, or “our”, it means Curonian Group Pty Ltd. Curonian Group Pty Ltd is the entity responsible for the personal information described in this policy and is an APP entity for the purposes of the Privacy Act 1988 (Cth).

This policy is governed primarily by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. Additional jurisdiction-specific rights apply depending on where you are located — see Section 11 (GDPR, EU/EEA users), Section 13 (CCPA, California/US users), and Section 14 (PDPO, Hong Kong users).

We operate the Pocket Investor app and website (collectively, the “Service”). The Service is available on iOS, Android, and via the web at pocketinvestor.app.

2. What information we collect

We collect only the information needed to operate the Service. Here is a complete list of everything we collect and why.

2.1 Account information

2.2 App content you create

2.3 Usage and analytics data

2.4 Subscription and purchase data

We do not receive or store your payment card details. Payment processing is handled entirely by Apple (App Store) or Google (Google Play). RevenueCat receives only the purchase receipt and device identifier necessary to validate your entitlement.

2.5 Push notification tokens

2.6 What we do NOT collect

To be clear about the limits of what we store:

• We do not collect financial account details, bank account numbers, or brokerage login credentials.
• We do not collect real portfolio values, actual share quantities, or cost basis information.
• We do not collect payment card details — those remain with Apple or Google.
• We do not collect biometric data (fingerprints, face scans, etc.).
• We do not collect your location (GPS or otherwise).
• We do not collect your contacts.
• We do not serve advertising and we do not use advertising trackers.

2.7 Support and feedback messages

When you contact us from inside the app — Settings → Send Feedback or Settings → Contact Support — we collect the following so that we can answer you and investigate what you have told us:

Support and feedback data is used only to handle your enquiry and to keep the support form from being abused. It is not used for marketing, advertising, or profiling, and it is not combined with your app activity to build a profile of you. Your watchlist tickers, portfolio names, saved chats, and saved articles are never attached to a support message — only the information listed in the table above is sent.

Please do not include sensitive information in a support message. Do not send us passwords, bank or brokerage account details, payment card numbers, tax file numbers, or copies of identity documents. We will never ask you for any of these, and we do not need them to help you.

3. How we use your information

We use the information we collect for the following purposes:

• To operate and deliver the Service — your email enables your account; your watchlist tickers power your personalised news feed and AI-generated analysis.
• To improve the Service — aggregated, non-identifiable usage data helps us understand which features are valuable and where the app needs work.
• To maintain security and prevent abuse — IP addresses and server logs help us identify and block malicious activity.
• To understand how users discover the app — referral source data (UTM parameters) tells us which marketing efforts are working.
• To contact you about your account — we may send transactional emails (e.g. password reset, account deletion confirmation). We will not send marketing emails unless you have separately opted in.
• To send push notifications — if you enable notifications, we use your push token to deliver real-time alerts for market movements, news relevant to your watchlist, and account activity. You can withdraw consent by disabling notifications in your device Settings at any time.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

4. AI-generated content

Pocket Investor uses artificial intelligence to generate news summaries and market analysis. Specifically:

• News summaries and stock analysis are generated using GPT-4o mini, an AI model provided by OpenAI (United States).
• When the app generates AI content for a stock or news article, the stock ticker and relevant news text are sent to OpenAI's API. Your email address and personal account details are not sent to OpenAI.
• OpenAI processes this data on servers in the United States. Per OpenAI's API data usage policy, API requests are logged for approximately 30 days for safety and abuse monitoring purposes. OpenAI does not use API data to train its models by default.
• All AI-generated content is clearly labelled within the app as AI-generated.

News content is sourced from publicly available third-party RSS feeds and Google News. Market data (prices, fundamentals) is sourced from EODHD. Neither news sources nor market data providers receive your personal information.

5. Who we share your information with

We do not sell your personal information to anyone. We do not share your data with advertisers. The only third parties who receive any of your data are the infrastructure providers necessary to run the Service:

We may also disclose your information if required to do so by law, or to protect the rights, property, or safety of Pocket Investor, its users, or others.

Overseas disclosure notice (Australian Privacy Act, APP 8)

Your account data and watchlist information is stored in Australia (Supabase, Sydney region). Some of your information is disclosed to overseas recipients, all of which are service providers acting on our instructions: Cloudflare, Inc. (United States — content delivery, API routing, and storage of support messages in Workers KV), Resend (United States — delivery of support and feedback email), OpenAI (United States — AI-generated summaries and analysis), and RevenueCat, Inc. (United States — subscription and in-app purchase validation). No personal information — no email address and no account details — is sent to OpenAI; only stock tickers and news article text are sent. RevenueCat receives your device identifier and purchase receipt data only; it does not receive your email address or your payment card details. EODHD receives ticker symbols only, with no personal information of any kind. We take reasonable steps, as required by APP 8.1, to ensure that each overseas recipient handles your personal information in a manner consistent with the Australian Privacy Principles.

If you send us a support or feedback message, that message and the information listed in Section 2.7 is disclosed to two overseas recipients: Cloudflare, which stores it in Workers KV (encrypted at rest) for 90 days on our behalf, and Resend, which transmits it to our support mailbox. Both are located in the United States. Both are engaged as our processors and handle the information only to provide those services to us — they do not use it for their own purposes. You can avoid this disclosure entirely by emailing us directly instead of using the in-app form.

6. How long we keep your information

7. Your rights

Under the Australian Privacy Act 1988, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct personal information that is inaccurate, incomplete, or out of date.
• Deletion — request that we delete your personal information. We will comply unless we are required by law to retain it. Deletion of your account will remove your email address, watchlist data, portfolio names, and referral source from our systems within 30 days.
• Complaints — if you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us first (see Section 15). If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Support and feedback messages

When you send a support or feedback message from inside the app, we give you a ticket number in the format PI-260912-7QK3. That ticket number is the handle for your message. Quote it if you want a copy of what we hold about that message, want something in it corrected, or want it deleted, and we can find and act on the exact record without needing anything else from you.

Deleting your Pocket Investor account does not automatically delete your support tickets. Tickets are stored separately from your account and may not be linked to an account at all, because you can send a message without being signed in. If you want your tickets deleted as well, tell us and include the ticket numbers or the email address you used. If you do nothing, each ticket is deleted automatically 90 days after you sent it.

To exercise any of these rights, contact us at privacy@curoniangroup.com. We will respond within 30 days.

8. Account deletion

You can request deletion of your account and all associated personal data at any time by contacting us at privacy@curoniangroup.com with the subject line “Account Deletion Request”.

When we receive a deletion request, we will:

1. Confirm receipt within 5 business days.
2. Delete or permanently de-identify your email address, watchlist data, portfolio names, and referral source from Supabase within 30 days.
3. Send you a confirmation email once deletion is complete.
4. Delete any support or feedback tickets you ask us to delete — include the ticket numbers, or the email address you used, in your request. Support tickets sit outside your account record and are not removed by account deletion on its own; if you leave them, they are deleted automatically 90 days after the message was sent.

Some information may be retained after deletion where required by law or where it has already been anonymised and can no longer be linked back to you (for example, aggregated usage counts with no user identifier).

9. Cookies and tracking

The web version of Pocket Investor may use browser cookies or similar technologies for the following limited purposes:

• Session management — to keep you signed in.
• Analytics — to understand how users interact with the web app (device type, screen views).

We do not use advertising cookies or share cookie data with advertisers. We do not use cross-site tracking cookies.

UTM parameters (e.g. utm_source, utm_medium, utm_campaign) captured at the time you first access the app are stored in your user profile to help us understand how you discovered Pocket Investor. This data is linked to your account but is not used for advertising.

You can configure your browser to block or delete cookies. Note that blocking session cookies may prevent you from staying signed in.

10. Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. These steps include:

• All data in transit is encrypted using HTTPS/TLS.
• Data at rest in Supabase is encrypted using AES-256.
• Passwords are never stored in plain text — Supabase stores only a salted cryptographic hash.
• Authentication tokens (JWTs) are stored in secure device storage on mobile.
• Access to production infrastructure is restricted to authorised personnel.

No system is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act). We will notify affected individuals as soon as practicable and within 30 days of becoming aware of the breach.

11. Your rights under GDPR (EU and EEA users)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies to the processing of your personal data. In addition to the rights described in Section 7, you have the following rights under GDPR:

• Right of access (Article 15) — obtain confirmation of whether we process your personal data and receive a copy of it.
• Right to rectification (Article 16) — have inaccurate personal data corrected without undue delay.
• Right to erasure (Article 17) — request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no other legal basis applies.
• Right to data portability (Article 20) — receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Article 21) — object to processing of your data where we are relying on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to restriction of processing — ask us to restrict processing of your data in certain circumstances (for example, while the accuracy of data is contested).
• Right to withdraw consent — where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a supervisory authority complaint — you have the right to lodge a complaint with the data protection supervisory authority in your EU member state. A list of EU supervisory authorities is available at edpb.europa.eu.

Legal bases for processing (Article 6 GDPR)

Our legal basis for processing your personal data under GDPR depends on the specific activity:

• Performance of a contract (Article 6(1)(b)) — processing your email address and watchlist data is necessary to provide the Service you signed up for. Without this processing, we cannot create or maintain your account.
• Legitimate interests (Article 6(1)(f)) — analytics and usage data help us improve the Service. Security logging (IP addresses, server logs) is necessary to protect the Service and our users. We have assessed that these legitimate interests are not overridden by your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)) — we may process or retain data where required to comply with applicable law (for example, responding to a lawful request from a public authority).

Automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significant effects on you, as described in Article 22 GDPR.

To exercise your GDPR rights, contact us at privacy@curoniangroup.com. We will respond within one calendar month as required by GDPR Article 12. Where requests are complex or numerous, we may extend this by a further two months, and we will inform you of any such extension within the first month.

12. Children's privacy

Pocket Investor is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@curoniangroup.com and we will delete that information promptly.

The Service involves financial content and market data. We recommend the Service for users aged 18 and over. Investing in financial products carries risk, including the risk of losing money.

13. Your rights under the CCPA (California and US users)

If you are a resident of California, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information. This section describes those rights and how to exercise them.

Categories of personal information we collect

Under the CCPA's statutory categories, we collect the following:

• Identifiers — email address (collected when you create an account).
• Commercial information — watchlist ticker symbols and portfolio names you create within the app.
• Internet or other electronic network activity information — usage data (screens visited, features used), device information (device type, OS version, browser), and IP address (server logs: up to 24 hours via Cloudflare; where you send a support or feedback message, 90 days — see Section 2.7).
• Inferences drawn from personal information — none. We do not draw inferences about your preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, or aptitudes.

Your CCPA rights

• Right to Know — you have the right to request that we disclose: the categories of personal information we have collected about you; the categories of sources from which it was collected; our business or commercial purpose for collecting it; the categories of third parties with whom we share it; and the specific pieces of personal information we hold about you.
• Right to Delete — you have the right to request deletion of personal information we have collected from you, subject to certain exceptions (for example, where we need to retain it to complete a transaction, detect security incidents, comply with a legal obligation, or for other lawful purposes set out in the CCPA).
• Right to Opt-Out of Sale or Sharing — we do not sell your personal information to third parties, and we do not share your personal information for cross-context behavioural advertising. Because we do not engage in these activities, there is nothing to opt out of — but you have this right and we respect it.
• Right to Non-Discrimination — we will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or suggest that you may receive a different price or quality as a result of exercising your rights.
• Right to Correct Inaccurate Personal Information — you have the right to request correction of inaccurate personal information we hold about you.

California “Shine the Light” law

California Civil Code Section 1798.83 (the “Shine the Light” law) permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. Accordingly, there is nothing to disclose under this law.

Nevada SB 220

Nevada Senate Bill 220 grants Nevada residents the right to opt out of the sale of certain personal information. We do not sell personal information to any person. Nevada residents may still submit a verified opt-out request to privacy@curoniangroup.com and we will record and honour it.

How to submit a CCPA request

To exercise your Right to Know, Right to Delete, or Right to Correct, send an email to privacy@curoniangroup.com with the subject line “Privacy Request — California” (or “Privacy Request — US” if you are in another US state). Please include your email address and a description of your request so we can verify your identity and process it correctly.

We will confirm receipt of your request within 10 business days and respond in full within 45 days of receipt. Where reasonably necessary, we may extend our response by a further 45 days, and we will notify you of any such extension within the initial 45-day period.

We do not charge a fee for processing a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

14. Your rights under the PDPO (Hong Kong users)

If you are located in Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) governs the collection and handling of your personal data. We comply with the PDPO and its six Data Protection Principles (DPPs).

The six Data Protection Principles

• DPP 1 — Purpose and manner of collection: We collect personal data only for a lawful purpose directly related to our function of providing the Service. Collection is necessary and not excessive relative to that purpose. You are informed of the purpose at the time of collection.
• DPP 2 — Accuracy and retention: We take reasonable steps to ensure that personal data is accurate and not kept longer than is necessary for the purpose for which it is used. See Section 6 for our retention periods.
• DPP 3 — Use of data: Personal data is used only for the purpose for which it was collected, or a directly related purpose. We do not use your data for purposes incompatible with the original collection purpose without your consent.
• DPP 4 — Data security: We apply technical and organisational security measures to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. See Section 10 for details of our security measures.
• DPP 5 — Openness: We make this Privacy Policy available so that you can understand what personal data we hold, how it is used, and what your rights are. If you have questions, contact us at privacy@curoniangroup.com.
• DPP 6 — Access and correction: You have the right to request access to personal data we hold about you and to request correction of any data that is inaccurate. See your rights below.

Your rights under the PDPO

• Right of access: You may request access to the personal data we hold about you by submitting a Data Access Request (DAR) to privacy@curoniangroup.com with the subject line “Privacy Request — Hong Kong”. We will respond within 40 days of receipt of your request.
• Right to correction: If you believe that personal data we hold about you is inaccurate, you may submit a Data Correction Request (DCR) to the same address. We will correct the data, or note your claim of inaccuracy, within 40 days.

Cross-border data transfers

Your personal data is stored primarily in Australia (Supabase, Sydney region) and is processed in transit by Cloudflare (United States). Australia and the United States are both recognised as jurisdictions that maintain adequate data protection standards. We take contractual and technical steps to ensure that any cross-border transfer of your personal data is subject to appropriate safeguards consistent with the PDPO.

Regulatory oversight

The PDPO is administered by the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong. If you are not satisfied with our handling of your personal data, you may contact the PCPD:

• Website: www.pcpd.org.hk
• Address: 12/F, Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong

15. How to contact us or make a privacy complaint

If you have a question about this policy, want to access or correct your information, request deletion of your account, or make a privacy complaint, please contact us:

If you are not satisfied with our response to a privacy complaint, you may contact the relevant supervisory authority for your jurisdiction:

• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au  ·  Phone: 1300 363 992  ·  GPO Box 5218, Sydney NSW 2001
• European Union / EEA: Your local EU data protection supervisory authority — edpb.europa.eu
• Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD) — www.pcpd.org.hk

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the effective date at the top of this page and, where appropriate, notify you by email. Your continued use of the Service after a change is posted constitutes your acceptance of the updated policy.

Change history

• September 2026 — added Section 2.7 (support and feedback messages), disclosed Resend as a processor, and named Curonian Group Pty Ltd as the operator.

We recommend reviewing this policy periodically. Previous versions are available on request.