Privacy Policy
Our promise. Your portfolio — every holding, transaction, goal and plan input — is encrypted inside your own browser with AES-256-GCM and never reaches our servers. We could not read it if we were asked to, or compelled to, or hacked. There is no database of your money anywhere in our systems.
But we do run accounts and subscriptions, so we hold something. This page says plainly what that is.
1. What we collect
Only what is needed to run your account, your subscription, and a check against one login being shared by many people.
- Your email address — it is your login, and where sign-in codes are sent.
- Your name, if you choose to give one. It is optional.
- Your password, scrambled so that it can never be read back — not by us, and not by anyone who steals our database.
- Your subscription status, its expiry date, and the payment reference Razorpay gives us. We never see your card, UPI or bank details — those go straight to Razorpay.
- How often you sign in, so we know whether the tools are actually being used.
- Sign-in cookies, which keep you logged in. They are not advertising cookies and they do not follow you around the web.
- A device id, your browser type, and part of your IP address — the first three numbers only, never the whole address. This is used for exactly one thing: noticing when a single account is being used by several people at once. It is not used to identify you, locate you, or build a profile of you, and it is never sold or shared.
- Anonymous visit counts. We count page views using Vercel Analytics, which sets no cookies and builds no profile. It never sees anything you type into a tool.
2. What we never collect
We cannot see any of the following — not because we promise not to look, but because it is never sent to us:
- Your mutual fund holdings, folios or transaction history
- Your stocks, ETFs, bonds or trading activity
- Your EPF, PPF, NPS, fixed deposits, property or gold
- Your CAS, broker or bond statements — these are parsed inside your browser tab and never uploaded
- Your goals, target amounts, retirement plans or any Advanced Mode input
- Your net worth, income, expenses or liabilities
- Your passphrase, if you set one — it never leaves your device in any form
We do not sell, rent or share your personal information with anyone, and we never will. There is no advertising on InvestApps and no data broker in the chain.
3. Where your data lives
| What | Where it lives |
|---|---|
| Portfolio, holdings, transactions, goals, plans | Your browser's local database (IndexedDB), AES-256-GCM encrypted once you sign in. Your device only. |
| Preferences (theme, last tab) | Your browser's localStorage. Your device only. |
| Backups and vault files | Wherever you save them — a folder you pick, on your own machine or your own cloud drive. We never receive them. |
| Account and subscription record | A Postgres database hosted by Neon, in the cloud. |
| Card / UPI / bank details | Razorpay only. Never our servers. |
4. Market prices
Mutual fund NAVs come from AMFI. Share, ETF and currency prices come from Yahoo Finance. To look a price up, the fund or stock's code is sent to our server, which fetches it and passes it back. We do not store these lookups or attach them to your account — and your holdings, units and amounts are never part of the request.
5. How your portfolio is protected
When you sign in, everything you have entered is encrypted with AES-256-GCM — the same standard banks use — before it is written to your browser's storage. The key is assembled inside your browser and we never hold it.
You can also set a passphrase, which becomes part of that key. We never receive it, so if you forget it, we genuinely cannot recover your data. That is the cost of the guarantee, and it is an honest trade rather than a hidden one.
Because your encrypted data never leaves your device, a breach of our servers could not expose your finances. There would be nothing there to take.
6. Who we share data with
Only the processors that make the service run. Each is bound by its own terms.
| Processor | What it gets |
|---|---|
| Vercel | Hosts the websites, and counts page views without cookies |
| Neon | Stores the account details listed in §1 |
| Resend | Your email address, to deliver sign-in codes and account mail |
| Razorpay | Your payment details, directly. We receive only a reference. |
| AMFI, Yahoo Finance | Public market prices (§4). They receive no information about you. |
We do not transfer your personal data to anyone else, and we do not sell it.
7. How long we keep it
- Account record — for as long as your account exists.
- Sign-in codes — minutes. They expire and are deleted.
- Session and device records — cleared when you sign out; stale entries age out.
- Payment records — retained as long as the law requires us to keep them.
- Your portfolio — for as long as you keep it. It is on your device, so you control its lifetime. “Delete everything” in Settings wipes it immediately.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask us to show you the personal data we hold about you, correct it, or erase it, and you may withdraw consent at any time.
- Erase your portfolio — instantly, yourself, from Settings → “Delete everything”. It never involved us.
- Delete your account — email support@investapps.in from your registered address. We delete the account record, and this cannot be undone.
- Access or correct your data — write to the same address.
We act on these requests within 30 days.
9. Children
InvestApps is not intended for anyone under 18, and we do not knowingly collect their data.
10. Changes to this policy
Changes are posted here with an updated “Last updated” date. If we ever change what we collect in a way that matters, we will tell you by email — not quietly edit this page.
11. Contact and grievances
Questions about this policy, or about your data: support@investapps.in. We acknowledge within 48 hours and aim to resolve within 30 days.
Grievance Officer
Jijesh Janardhanan, InvestApps.in
support@investapps.in
Website: https://www.investapps.in