Privacy policy

The controller of your personal data is Jakub Gruszczyk, the maker of AlphaInvestor, who runs it as a private individual ("I", "me").

For anything about your personal data, write to help@unicorn-code.com.

This policy covers the AlphaInvestor iOS app, the AlphaInvestor web dashboard (the desktop version, same account) and the www.alphainvestor.app website including the blog.

Account: email address, name (if you provide it or Apple or Google share it at sign-in), account identifier and app language. Your password is held only by the sign-in provider — I have no access to it.

Portfolio data you enter: wallets (name, currency, cash balance), positions and transactions (instrument, quantity, purchase price and date, costs, notes on cash operations), bonds and metals, watchlist, instrument lists and settings. When you import a CSV file it is parsed on your device — only the recognised operations and column mapping reach the server, never the file itself.

Investor profile (optional): experience, goals, risk comfort and investing style — if you fill them in. Used only to tailor the analyses in the app.

Content prepared for you: morning briefs, weekly reports and AI analyses of your portfolio, and your ratings of that content.

Notifications: push token, device model, app version and notification settings.

Subscription: AlphaInvestor Pro status, product, period and expiry dates, and subscription events forwarded by RevenueCat (these may include the store country and price). Payment is handled by Apple or Google, depending on where you subscribed — I have no access to your card details.

Support requests: the message, email, account identifier, Pro status, device model, OS and app version, and language.

App analytics: an anonymous device identifier and app usage events (e.g. screen opened, position added, instrument searched), without your email and not linked to your account. Error diagnostics: crash reports (app state, device, version); server-side reports include the account identifier.

New post notifications (if you subscribe): email address, chosen language, and the dates you subscribed, confirmed and unsubscribed.

App launch waitlist (if you join): email address, chosen language, where you came to the site from (e.g. Instagram), the dates you joined and unsubscribed and, if you choose to answer, two answers to the questions shown after joining (where you keep your investments and what you want at hand).

Website and dashboard: on the website, anonymous visit statistics (Vercel Analytics, no cookies) that only run after you consent; in the dashboard, sign-in session cookies, a cookie with your chosen language and a currency setting in browser storage. Servers keep technical logs, including IP addresses, for security.

Running your account, the app and dashboard, portfolio sync, AI analyses, briefs and notifications tailored to your portfolio — performance of a contract (Art. 6(1)(b) GDPR).

Handling your Pro subscription — performance of a contract and accounting and tax obligations (Art. 6(1)(b) and (c) GDPR). Technical support — performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR).

App usage analytics, error diagnostics, security and abuse prevention, and establishing, exercising or defending legal claims — legitimate interest in developing a stable and secure service (Art. 6(1)(f) GDPR).

Website visit statistics — your consent (Art. 6(1)(a) GDPR), which you can withdraw under "Cookie settings" in the footer.

Email notifications about new blog posts — your consent (Art. 6(1)(a) GDPR); protecting the signup form from bots — legitimate interest (Art. 6(1)(f) GDPR). Details in section 6.

The app launch email for people on the waitlist — your consent (Art. 6(1)(a) GDPR). Details in section 6.

I don't use your data for advertising, I don't sell it, and I don't profile you for marketing.

Some features (portfolio analysis, morning brief, weekly report, instrument analyses) use OpenAI models. Only the data needed for a given analysis is sent: the instruments you hold, quantities, purchase prices and current values, portfolio weights and — if you filled it in — your investor profile. I never send your email or name to OpenAI. Under OpenAI's API terms this data is not used to train models.

AI content is informational and educational — it is not an investment recommendation or advice. I make no decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

On the blog you can subscribe to emails that notify you about new posts. I then process your email address, chosen language (Polish or English) and the dates you subscribed, confirmed and, if applicable, unsubscribed — only to send you those notifications.

The legal basis is your consent (Art. 6(1)(a) GDPR). You confirm the subscription with a link sent to the address you entered (double opt-in) — without confirmation the address is never added to the list, and the link expires after 48 hours.

Emails are sent through Resend (USA), which keeps the subscriber list on my behalf. The form is protected from bots by Cloudflare Turnstile (Cloudflare, USA): it only loads once you start filling in the form and processes technical browser data and your IP address solely to tell people from bots (legitimate interest, Art. 6(1)(f) GDPR). Transfers to the USA are described in section 8.

Every notification email has an unsubscribe link. You can withdraw consent at any time — with that link or by writing to help@unicorn-code.com — without affecting the lawfulness of earlier emails. I keep the data until you unsubscribe or withdraw consent; after that the address may stay on the list only marked as "unsubscribed", so that no further emails reach it.

On the home page you can also join the waitlist for the app launch. Joining doesn't need a confirmation link: the address is added straight away (via Resend, protected by Cloudflare Turnstile) and I send a short note to it saying you're on the list. If someone else entered the address, just reply to that note and I'll remove it. After joining you can answer two optional questions; the answers are stored with your address and used only to tailor the launch email and the app's offer. I use the address only to let you know when the app launches. You can leave the list with the link in that email or by writing to help@unicorn-code.com.

I use service providers who process data on my behalf: Clerk (sign-in and accounts, including Sign in with Apple and Google; USA), Supabase (app database and server functions; EU — Ireland), Vercel (hosting for the website, dashboard and API; USA and global), Neon (API database; EU — Germany), Upstash (cache and security counters; EU — Germany), OpenAI (AI analyses; USA), Sentry (error reports; EU — Germany), PostHog (app usage analytics; EU), RevenueCat (subscription handling; USA), Expo (delivery of push notifications and app updates; USA), Resend (sending new post notifications; USA), Cloudflare (bot protection for the signup form — Turnstile; USA), Slack (receiving support requests and security alerts; USA) and GitHub (automated database backups; USA).

Apple (subscription sales, push notifications, Sign in with Apple) and Google (Google sign-in, if you choose it) also process data under their own privacy policies.

Market data comes from an external provider. None of your data is sent there.

Some providers (including Clerk, Vercel, OpenAI, RevenueCat, Expo, Resend, Cloudflare, Slack and GitHub) process data in the USA. Transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) for certified companies, or on the European Commission's standard contractual clauses.

Your account, portfolio data and content prepared for you (briefs, reports, analyses) — until you delete your account. They are erased as soon as you delete it; they may remain in backups for up to 90 days before being overwritten.

Subscription data — for as long as tax and accounting law requires (up to 5 years from the end of the year) and for possible claims. Support requests — up to 2 years after the matter is closed.

New post notifications — until you unsubscribe or withdraw consent. An unconfirmed address is never added to the list; it only remains in Resend's sending logs for their retention period.

App launch waitlist (with your answers) — until you unsubscribe or withdraw consent, at the latest until the list is closed after the app launch.

Analytics and error reports — according to the providers' retention settings, usually up to 12 months. Technical logs and security counters — from a few minutes to a few weeks.

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and to object to processing based on legitimate interest (such as app usage analytics). You can withdraw consent at any time without affecting earlier processing.

Data export: in the app, Settings → Export data (JSON file). Account deletion: in the app, Settings → Delete account. For anything else, write to help@unicorn-code.com — I'll reply within a month.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country.

Website: I use no analytics or advertising cookies. Visit statistics (Vercel Analytics) set no cookies and only run after you consent; your choice is stored in browser storage and you can change it under "Cookie settings" in the footer.

Dashboard: essential sign-in session cookies (Clerk), a cookie with your chosen language (up to a year) and a currency setting in browser storage. App: cached data (e.g. recently loaded quotes) and settings stored on your device.

AlphaInvestor is intended for adults (18+). I don't knowingly collect data from minors — if I learn of such an account, I will delete it.

Data is sent over encrypted connections and database access is restricted to your account by row-level security rules. You can also lock the app with Face ID. No system is fully immune to attacks — in the event of a personal data breach I will notify the supervisory authority and, where required, you.

I will announce significant changes in the app or on the website before they take effect. The current version is always available at www.alphainvestor.app/privacy.