Legal
Privacy Policy
Effective 30 July 2026
This Privacy Policy explains what personal information InsightVest ("we", "us") collects, why we collect it, who we share it with, and the choices you have. It applies to the InsightVest website and app.
1. Who we are
InsightVest is a portfolio-intelligence service operated from Ontario, Canada and available to users worldwide. It has two parts: a free practice mode ("Paper Investing") that anyone who signs up can use, and a paid portfolio-intelligence subscription ("Plus"). For any privacy question or request, contact us at insightsvest@gmail.com.
2. Information we collect
Information you give us
- Account details: first and last name, email address, phone number, age, and country of residence.
- Sign-in credentials: a PIN you choose, which we store only as a one-way cryptographic hash, never in readable form. If you register a passkey, we store only its public key, never any secret.
- Portfolio information: holdings you enter manually, upload as a CSV, or capture from a photo of a statement, including symbols, quantities, prices, and any cash balance, plus any watchlist of symbols you choose to follow.
- Decision journal and notes: your reasons for an investment, intended holding period, exit conditions, reflections you record, and any free-text research notes you keep in the notepad.
- Paper Investing (practice) data: your simulated trades and virtual holdings, the reasons you record for buying or selling, and any practice leagues or lobbies you create or join. This is all virtual, with no real money involved.
- Friends: if you choose to connect with other users in Paper Investing, the friend code you share and the connections you make, which let friends see each other's practice portfolios.
- Billing information: if you subscribe to Plus, our payment processor (Stripe) collects and processes your payment details on our behalf. We do not receive or store your full card number. We keep only a customer reference, your subscription status, and a record of each transaction — the date, the plan, and the amount charged.
Information we collect automatically
- Usage data: which features and pages you use, to tailor what we show you.
- Technical data: IP address and basic device and log information, used for security and to keep the service running.
- A session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.
- Push subscription: if you turn on notifications, the browser push subscription for your device, used only to send the alerts you asked for.
3. How we use your information
- To provide the service: aggregate your holdings, calculate your portfolio, and generate analysis and briefings.
- To authenticate you and keep your account secure.
- To take payment for and manage your Plus subscription.
- To send you the emails and notifications that are part of the service, such as sign-in codes and reports.
- To understand how the product is used so we can improve it.
We do not sell your personal information, and we do not use it for third-party advertising.
Your portfolio data in Plus. To provide the Plus app we store the holdings you add — symbols, quantities and cost — encrypted, and use them only to build your own portfolio view, analysis, and alerts. We never sell them. The behavioural insights we keep about how you invest — such as your investing consistency relative to your age, the sectors you favour, how you engage with your briefings, and your progress toward your long-term goals — are derived to help you; we do not repurpose the specific amounts or securities in your portfolio for anything beyond serving you.
4. Who we share it with
We use a small number of trusted service providers to run InsightVest. Each receives only the data needed for its function.
| Provider | Purpose | Data involved |
|---|---|---|
| Anthropic (Claude) | AI analysis, briefings, and reading uploaded photos | Your portfolio context and reasoning; uploaded images |
| Finnhub, Alpha Vantage | Live market prices | The stock symbols you hold |
| Stripe | Subscription billing and payment processing | Your email and payment details; we never receive your full card number |
| Resend | Sending email | Your email address and message content |
| Cloudflare R2 | Encrypted database backups | Encrypted data only, unreadable to the provider |
| Railway | Hosting and database | All service data, on secured infrastructure |
When we send portfolio context to Anthropic to generate your analysis, it is processed to produce a response and, under Anthropic's API terms, is not used to train their models. We may also disclose information if required by law.
5. How we protect it
- The database is encrypted at rest, and backups are separately encrypted before they leave our servers.
- Your PIN is hashed, and any sensitive access tokens are encrypted before storage.
- All traffic is served over HTTPS, with security headers, rate limiting on sign-in, and strict per-user access controls so no user can access another's data.
No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.
6. How long we keep it
We keep your information for as long as your account is active. Encrypted backups are retained so we can recover from a failure. When you ask us to delete your account, we remove or anonymize your personal information, subject to any limited retention the law requires.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to withdraw consent. In Canada these rights arise under the federal Personal Information Protection and Electronic Documents Act (PIPEDA); you may also have rights under your provincial privacy law, the EU's GDPR, or other laws that apply to you. To exercise any of these, email insightsvest@gmail.com and we will respond within a reasonable time. If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.
8. Where your data is processed
InsightVest is operated from Ontario, Canada, and our service providers may process data in other countries, including the United States and the European Union. By using the service you understand your information may be transferred to and processed in countries other than your own, where it may be accessible to courts, law-enforcement, and authorities under the laws of those countries. Where required, we rely on appropriate safeguards for these transfers.
9. Age and children
InsightVest is not intended for anyone under 16, and we do not knowingly collect information from anyone under 16. If you are 16 or 17, you should use InsightVest only with the involvement of a parent or guardian. If you believe a child under 16 has given us personal information, contact us and we will delete it.
10. Changes
We may update this policy as the service evolves. We will change the effective date above and, for material changes, notify you.
Questions about your privacy? Email insightsvest@gmail.com.