Effective date: 2 November 2026 · Pocket Investor
Jurisdiction coverage — jump to your section:
Pocket Investor is operated by Curonian Group Pty Ltd (ACN 697 342 966, ABN 73 697 342 966), an Australian company whose registered address is 2/39 Dover Road, Rose Bay NSW 2029, Australia. When this policy refers to “Pocket Investor”, “we”, “us”, or “our”, it means Curonian Group Pty Ltd. Curonian Group Pty Ltd is the entity responsible for the personal information described in this policy and is an APP entity for the purposes of the Privacy Act 1988 (Cth).
This policy is governed primarily by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. Additional jurisdiction-specific rights apply depending on where you are located — see Section 11 (GDPR, EU/EEA users), Section 13 (CCPA, California/US users), and Section 14 (PDPO, Hong Kong users).
We operate the Pocket Investor app for iPhone and iPad, the Pocket Investor web app at app.pocketinvestor.app, and the website pocketinvestor.app (together, the “Service”). An Android version is not yet available.
We collect only the information needed to operate the Service. Here is a complete list of everything we collect and why.
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Email address and password (the password is stored only as a salted hash) | To create and manage your account, allow you to sign in, and to contact you about your account if needed | Supabase (database and authentication service, Sydney, Australia) |
| Country of residence, experience level, and the markets and sectors you choose at sign-up | To set up your news feed and market defaults | Supabase |
| Your choices at sign-up: acceptance of our terms and this policy, whether you want marketing emails, whether notifications are on, and your plan | To record what you agreed to and to apply your choices | Supabase |
| Username (created automatically; you can change it) | Shown next to your posts in Community discussions | Supabase |
| Optional: full name and phone number, if you add them in Edit details | So you can keep your profile up to date. We do not use your phone number to contact you. If your account has no username, your full name is shown with your Community posts. | Supabase |
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Watchlists: names, icons and the tickers in them | To show you news, prices and market data for the stocks you follow | Supabase |
| Holdings you enter: ticker, number of units, purchase price or average cost, currency, and any note you add | To calculate the value, weighting and gain or loss of your holdings for you | Supabase. If you import a CSV file, a copy is also kept on your device. |
| Price alerts: the stock, the condition (for example “above $50”) and your quiet hours | To send you the alerts you set | Supabase. A small record of when each alert last fired is kept by Cloudflare for 30 days. |
| Saved articles: title, link, source, summary and related ticker | So you can return to articles you saved | Supabase |
| Saved chats: the title and text messages of AI chats you choose to save | So you can return to chats you saved | Supabase |
| Recent AI chats (not saved) | So you can continue a recent chat | On your device only. Removed when you sign out. |
| Posts in Community discussions: your message, the stock, your display name (your username, or your full name if you have no username), likes, and any reports you make | To run the Community discussions | Supabase. Other users can see your posts and display name. |
Holdings are stored so the app can calculate figures such as value, weighting and gain or loss for you. Your holdings are not shared with other users.
Until 31 October 2026, the portfolio observations feature (Portfolio Insights) sent your holdings (ticker, units, average cost, value and gain or loss) to OpenAI when you opened it. Since 31 October 2026, our server no longer sends those requests to OpenAI. It returns a fixed note that the feature is switched off. The current app may still send your holdings to our server when you open that screen, but our server does not pass them on to OpenAI or to anyone else.
AI chat does not send your stored holdings or watchlists to OpenAI. If the app includes portfolio or watchlist settings with a chat request, our server ignores them. Anything you type or attach in AI chat, including financial information, is sent to OpenAI (see Section 4).
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Referral or campaign source (UTM parameters and referring site), if you arrived through a campaign link | To understand which marketing channels bring users to Pocket Investor | Supabase (your profile) |
| Server request records: the address of each request your app makes to our servers (which can include tickers and search terms), the time, and technical details such as your IP address and app version. When our safety checks block an AI chat reply, the log also records the start of that reply. | To run the Service, fix faults, and prevent abuse | Cloudflare logs, kept for up to 7 days and then deleted automatically |
We do not use an analytics or crash-reporting service in the app, and we do not track which screens you visit.
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Subscription status and entitlement (e.g. active Pro subscriber, plan tier, expiry date) | To determine which features you are entitled to access within the app | RevenueCat (San Francisco, CA) — synced to our Supabase database |
| Purchase history (e.g. transaction dates, plan purchased, renewal events) | To validate and restore your purchases and to resolve billing disputes | RevenueCat — linked to your device identifier or Supabase user ID |
| Your Pocket Investor user ID, and a RevenueCat ID for purchases made before you signed in | Links your purchases to your account | RevenueCat |
We do not receive or store your payment card details. Payment processing is handled entirely by Apple (App Store). RevenueCat receives only the purchase receipt and the identifiers necessary to validate your entitlement.
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Push notification token (issued by Apple and passed through Expo) | To send you the price alerts and news notifications you turn on. You can disable push notifications at any time in your device Settings. | Supabase, linked to your account. When you sign out, the token is marked inactive. It is deleted when Apple reports that the app is no longer installed on that device, or when you delete your account. |
To be clear about the limits of what we store:
When you contact us from inside the app — Settings → Send Feedback or Settings → Contact Support — we collect the following so that we can answer you and investigate what you have told us:
| Data | Why we collect it | Where it is stored |
|---|---|---|
| The message you write, and the subject line if you provide one | To answer your question, investigate a bug you report, or act on your feedback | Cloudflare Workers KV (encrypted at rest) for 90 days, and in our support mailbox |
| Your email address — pre-filled when you are signed in, editable, and optional | So that we can reply to you. Without an email address we have no way to respond. | Cloudflare Workers KV for 90 days, and in our support mailbox |
| Your account id, when you are signed in | To link the message to your account so that we can investigate an account-specific problem without having to ask you for more details | Cloudflare Workers KV for 90 days, and in our support mailbox |
| App version and build number, platform (iOS, Android, or web), operating system version, device model, and language/region setting | To reproduce and diagnose the problem you are reporting on the device you are actually using | Cloudflare Workers KV for 90 days, and in our support mailbox |
| The IP address the message was sent from (kept with your ticket only in truncated form), and the country it resolves to | To prevent abuse of the support form — rate limiting, spam detection, and protecting our email sending reputation | Cloudflare Workers KV for 90 days, stored alongside the support ticket and then deleted automatically. Only a truncated form of the address is kept with the ticket (for example 203.0.113.0/24, with the final part removed); the full address is used solely to apply rate limits and is held in a separate abuse-control store for up to about 48 hours. The IP address itself is not included in the email sent to our support mailbox; the country is. |
| In app versions 1.1.2 and earlier: a preview of the first 120 characters of your message | Recorded in our server log when the message is received | Cloudflare logs, kept for up to 7 days and then deleted automatically |
Support and feedback data is used only to handle your enquiry and to keep the support form from being abused. It is not used for marketing, advertising, or profiling, and it is not combined with your app activity to build a profile of you. Your watchlists, holdings, saved chats and saved articles are never attached to a support message — only the information listed in the table above is sent.
Please do not include sensitive information in a support message. Do not send us passwords, bank or brokerage account details, payment card numbers, tax file numbers, or copies of identity documents. We will never ask you for any of these, and we do not need them to help you.
We use the information we collect for the following purposes:
Our software makes some decisions automatically using personal information. These include:
AI news summaries and other AI content about companies and markets are generated for a company or article, not for you, and use no personal information about you. AI chat replies are generated from the messages and photos you provide. If you think an automatic decision has affected you unfairly, contact privacy@curoniangroup.com and a person will review it.
Pocket Investor uses artificial intelligence to produce AI-generated content, such as news summaries, the daily market recap, and answers in AI chat. Specifically:
News content is sourced from publicly available third-party RSS feeds and Google News. Market data (prices, fundamentals) is sourced from EODHD, and gold and silver prices from gold-api.com. Neither news sources nor market data providers receive your personal information.
We do not sell your personal information to anyone. We do not share your data with advertisers. The only third parties who receive any of your data are the infrastructure providers necessary to run the Service:
| Provider | Country | What they receive | Why |
|---|---|---|---|
| Supabase (supabase.io) | Australia (Sydney, ap-southeast-2) | Your account and profile details, watchlists, holdings, price-alert rules, push tokens, saved chats, saved articles, Community posts, and referral source | Database hosting and user authentication. Supabase acts as our service provider and handles this data on our instructions. Data is stored in Australia. |
| RevenueCat, Inc. (revenuecat.com) | United States (San Francisco, CA) | Your Pocket Investor user ID (and a RevenueCat ID for purchases made while signed out) and App Store purchase receipt data | Subscription management and in-app purchase validation. RevenueCat validates your purchase receipt and determines your entitlement to Pocket Investor Pro features. RevenueCat does not receive your payment card details — those remain with Apple. Privacy policy: revenuecat.com/privacy |
| Cloudflare (cloudflare.com) | United States (global edge network) | IP address, the content of requests passing through our servers (including AI chat messages and photos on their way to OpenAI), alert timing records, server logs, and — where you send a support or feedback message — the contents of that message and the details listed in Section 2.7 | Content delivery, DDoS protection, and API routing. Network traffic passes through Cloudflare's infrastructure. IP addresses appear in server logs kept for up to 7 days. Alert timing records are kept for 30 days. Cloudflare also stores our support and feedback messages on our behalf in Cloudflare Workers KV, encrypted at rest, for 90 days. Privacy policy: cloudflare.com/privacypolicy |
| Resend (resend.com) | United States | The support or feedback message and its subject line, your reply-to email address if you provided one, your account id if you were signed in, and the app and device details listed in Section 2.7 | Transactional email delivery. Resend is engaged as our processor to deliver support and feedback messages to our support mailbox, and handles that information only for the purpose of delivering our mail. Resend does not receive your watchlists, holdings, or any other app content. Privacy policy: resend.com/legal/privacy-policy |
| OpenAI (openai.com) | United States | News text, tickers and market data for summaries; for AI chat, your messages, earlier messages in the same chat, and any photo you attach. We do not attach your name, email or account ID. Any personal details you include in a message or photo are sent with it. | To generate AI summaries and chat replies. Retention: see Section 4. |
| Expo (650 Industries, Inc.) | United States | Your push token and the text of each notification | Relays push notifications to Apple for delivery to your device. |
| Apple | United States | Your push token and notification text; purchase and subscription records | Delivers notifications (Apple Push Notification service) and processes App Store payments. |
| EODHD (eodhd.com) | European Union / United States | Stock ticker symbols (no personal data) | Market data (prices, fundamentals). No personal information is transmitted. |
Other users of Pocket Investor can see the posts and display name you share in Community discussions.
We may also disclose your information if required to do so by law, or to protect the rights, property, or safety of Pocket Investor, its users, or others.
Your account and app data is stored in Australia (Supabase, Sydney region). Some personal information is disclosed to service providers in the United States who act on our instructions:
Cloudflare's network operates worldwide, so traffic may pass through other countries on its way. EODHD receives ticker symbols only, with no personal information. We take reasonable steps, as required by APP 8.1, to ensure that each overseas recipient handles your personal information in a manner consistent with the Australian Privacy Principles. If you do not want your chat content to go to OpenAI, do not use AI chat. The rest of the app works without it.
If you send us a support or feedback message, that message and the information listed in Section 2.7 is disclosed to two overseas recipients: Cloudflare, which stores it in Workers KV (encrypted at rest) for 90 days on our behalf, and Resend, which transmits it to our support mailbox. Both are located in the United States. Both are engaged as our processors and handle the information only to provide those services to us — they do not use it for their own purposes. You can avoid this disclosure entirely by emailing us directly instead of using the in-app form.
| Data type | How long we keep it |
|---|---|
| Account and profile details, watchlists, holdings, notification settings, saved chats, saved articles, referral source | While your account is open. You can delete individual items at any time. When you delete your account in the app, they are deleted from our live database straight away. Copies may remain for a limited time in any backups kept by our database provider, until those backups are overwritten. |
| Price-alert rules | While your account is open. You can delete a rule at any time. |
| Community posts, likes and reports | While your account is open, unless a moderator removes the post. They are deleted when you delete your account. |
| Recent AI chats on your device | Until you sign out or remove the app. |
| Push tokens | While your account is open. Marked inactive when you sign out. Deleted when Apple reports the app is no longer installed, or when you delete your account. |
| Price-alert timing records (Cloudflare) | 30 days after the alert last fired. |
| Subscription and purchase records | Apple and RevenueCat keep these under their own policies, including after you delete your account. We keep your plan status while your account is open. |
| Server logs, including IP addresses (Cloudflare) | Up to 7 days, then deleted automatically. |
| AI chat content held by OpenAI | Up to 30 days, then deleted by OpenAI, unless OpenAI must keep it longer by law or to protect its services or others from harm (see Section 4). We do not keep a copy of unsaved chats on our servers, apart from the short log records described in Section 2.3. |
| Record that an account was deleted (user ID and date only) | We keep it to show that we acted on your request. |
| Support and feedback messages (the message, subject, reply-to email address, account id, app and device details, truncated IP address and country) held in Cloudflare Workers KV | 90 days from the date you send the message, after which the record is deleted automatically by Cloudflare Workers KV — we do not have to delete it by hand. We keep it for 90 days because a support conversation can run over several weeks, a bug report often needs to be re-read when a fix ships, and abuse patterns are only visible across a window of that length. |
| Copy of a support or feedback message in our support mailbox (delivered via Resend) | No more than 12 months from the date of the message, after which the copy is deleted from the mailbox. You can ask us to delete it sooner — quote your ticket number (see Section 7). |
Under the Australian Privacy Act 1988, you have the right to:
When you send a support or feedback message from inside the app, we give you a ticket number in the format PI-260912-7QK3. That ticket number is the handle for your message. Quote it if you want a copy of what we hold about that message, want something in it corrected, or want it deleted, and we can find and act on the exact record without needing anything else from you.
Deleting your Pocket Investor account does not automatically delete your support tickets. Tickets are stored separately from your account and may not be linked to an account at all, because you can send a message without being signed in. If you want your tickets deleted as well, tell us and include the ticket numbers or the email address you used. If you do nothing, each ticket is deleted automatically 90 days after you sent it.
To exercise any of these rights, contact us at privacy@curoniangroup.com. We will respond within 30 days.
In the app: go to Settings, then Delete account, and type DELETE to confirm. Your account is deleted immediately and you are signed out.
By email: if you can't use the app, email privacy@curoniangroup.com with the subject line “Account Deletion Request” from the email address on your account. When we receive a deletion request, we will:
What deletion removes: your account and profile, watchlists, holdings, push tokens, saved chats, saved articles, and your Community posts, likes and reports.
What it does not remove: support tickets (deleted after 90 days, or sooner on request; quote your ticket numbers); purchase records held by Apple and RevenueCat; server logs (deleted within 7 days); copies in any database backups until they are overwritten; a record that the account was deleted (Section 6); and anything already anonymised. Some information may also be retained where required by law.
On your device: deleting your account signs you out, which removes chats stored on the device. Holdings imported from a CSV file stay on the device until you remove the app.
Subscriptions: deleting your account does not cancel an App Store subscription. Cancel it in your Apple ID settings first.
The web app stores your sign-in session, your settings and recent AI chats in your browser's local storage, so you stay signed in and the app works as expected.
We do not use analytics cookies or advertising cookies, we do not share cookie data with advertisers, and we do not use cross-site tracking.
UTM parameters (e.g. utm_source, utm_medium, utm_campaign) captured at the time you first access the app are stored in your user profile to help us understand how you discovered Pocket Investor. This data is linked to your account but is not used for advertising.
You can configure your browser to block or delete cookies and site data. Clearing your browser storage signs you out of the web app.
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. These steps include:
No system is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act). We will notify affected individuals as soon as practicable and within 30 days of becoming aware of the breach.
If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies to the processing of your personal data. In addition to the rights described in Section 7, you have the following rights under GDPR:
Our legal basis for processing your personal data under GDPR depends on the specific activity:
We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significant effects on you, as described in Article 22 GDPR.
To exercise your GDPR rights, contact us at privacy@curoniangroup.com. We will respond within one calendar month as required by GDPR Article 12. Where requests are complex or numerous, we may extend this by a further two months, and we will inform you of any such extension within the first month.
Pocket Investor is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@curoniangroup.com and we will delete that information promptly.
The Service involves financial content and market data. We recommend the Service for users aged 18 and over. Investing in financial products carries risk, including the risk of losing money.
If you are a resident of California, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information. This section describes those rights and how to exercise them.
Under the CCPA's statutory categories, we collect the following:
California Civil Code Section 1798.83 (the “Shine the Light” law) permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. Accordingly, there is nothing to disclose under this law.
Nevada Senate Bill 220 grants Nevada residents the right to opt out of the sale of certain personal information. We do not sell personal information to any person. Nevada residents may still submit a verified opt-out request to privacy@curoniangroup.com and we will record and honour it.
To exercise your Right to Know, Right to Delete, or Right to Correct, send an email to privacy@curoniangroup.com with the subject line “Privacy Request — California” (or “Privacy Request — US” if you are in another US state). Please include your email address and a description of your request so we can verify your identity and process it correctly.
We will confirm receipt of your request within 10 business days and respond in full within 45 days of receipt. Where reasonably necessary, we may extend our response by a further 45 days, and we will notify you of any such extension within the initial 45-day period.
We do not charge a fee for processing a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.
If you are located in Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) governs the collection and handling of your personal data. We comply with the PDPO and its six Data Protection Principles (DPPs).
Your personal data is stored in Australia (Supabase, Sydney region) and is processed by our service providers in the United States (see Section 5). We use contracts and technical measures to protect it.
The PDPO is administered by the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong. If you are not satisfied with our handling of your personal data, you may contact the PCPD:
If you have a question about this policy, want to access or correct your information, request deletion of your account, or make a privacy complaint, please contact us:
Curonian Group Pty Ltd (Pocket Investor)
ACN 697 342 966 · ABN 73 697 342 966
Privacy enquiries, access, correction, deletion and complaints: privacy@curoniangroup.com
App support: pocketinvestor@curoniangroup.com
Post: 2/39 Dover Road, Rose Bay NSW 2029, Australia
Response time: We will acknowledge your request within 5 business days and respond in full within 30 days (or within the jurisdiction-specific timeframe set out in Sections 11, 13, and 14 where applicable).
If you are not satisfied with our response to a privacy complaint, you may contact the relevant supervisory authority for your jurisdiction:
We may update this Privacy Policy from time to time. When we make a material change, we will update the effective date at the top of this page, where appropriate notify you by email, and, where the law requires, ask for your consent.
We recommend reviewing this policy periodically. Previous versions are available on request.