Privacy Policy

When you sign in with Google, we receive and store your email address, your name, your profile picture URL, and the unique account identifier Google assigns you. We never see or receive your Google password.

Your investment preferences — the amount you enter, your country and currency, your time horizon, your goal, and your stated risk tolerance. This is what the recommendation engine needs in order to produce a shortlist for you.

Session and security data — a hashed session token, the approximate time you last signed in, your IP address, and a short description of your browser or device. This exists so we can keep you signed in and detect suspicious session reuse.

If you add your own Gemini API key (an optional feature), it is encrypted with AES-256-GCM before being stored, and it is never sent to your browser or to anyone other than Google's API when answering your own questions.

Feedback you choose to send — if you use the feedback form, we store your message, the category you picked, the page you sent it from, and an email address only if you enter one. If you are signed in, we record which account sent it so we can reply. You can ask us to delete any message you have sent.

Stored in your browser only — your light/dark theme choice, the currency you ask to see amounts in, your answer to the cookie notice, any portfolio entries you add, the profile the app works from, and a local record of security-relevant actions on your own account. These live in your browser's own storage and are not uploaded to us. Clearing your browser storage for this site removes all of them.

Anonymous page counts — we count how many times each page is viewed per day, and which other websites link to us. These are plain numbers: no cookie, no identifier and no IP address is stored, nothing is written to your device, and the counts cannot be traced back to you or to any single visit. We deliberately do not measure "unique visitors", because doing so would require identifying you. If your browser sends Do Not Track or Global Privacy Control, we do not count the visit at all.

What we still do not do — we do not build a profile of the pages you visit, follow you across other websites, or sell or share any of this. Advertising cookies, where advertising is enabled, are a separate matter and are described below.

We do not sell your personal information, and we do not share it with brokers, banks, or product providers. We are not paid to rank one financial product above another.

A small number of third parties necessarily process some data so the service can work:

• Google (Sign-In) — verifies who you are when you log in.
• Google (Gemini API) — only if you choose to add your own Gemini API key. We contact Google once to check the key works, sending a fixed test phrase and nothing else. Your questions, figures and profile are not sent to Google: the rankings and explanations on this site are produced by our own scoring model, not by an AI.
• An IP geolocation service — your IP address is sent to a geolocation provider once (and cached) purely to work out which country's financial products to show you. We don't store a location history.
• Google AdSense — if advertising is enabled on this site, Google and its partners may use cookies and similar technologies to serve and measure ads. See the section on advertising below.

We use a single strictly-necessary cookie to keep you signed in. It is HTTP-only (your browser's scripts can't read it), it is limited to the sign-in paths, and it expires.

If advertising is enabled, Google AdSense may set cookies or use device identifiers to show ads and measure their performance, including personalised ads where permitted. You can review and change your ad settings at Google My Ad Center or opt out of personalised advertising at aboutads.info. Advertising is kept clearly separated from our recommendations: advertisers cannot influence which financial products the engine ranks, or how highly it ranks them.

Traffic is encrypted in transit with HTTPS. Sign-in is handled entirely by Google — we never store passwords. Session tokens are stored hashed, rotate on every use, and reuse of an old token invalidates the whole session family. Any Gemini API key you supply is encrypted at rest.

No system is perfectly secure, and we won't pretend otherwise. If you believe you've found a vulnerability, please tell us at privacy@investwise4u.com and we'll look into it promptly.

Your account and preferences are kept while your account exists, so the app remembers your settings between visits. Sign-in sessions expire automatically and expired ones are deleted. If you ask us to delete your account, we remove your profile, your sessions, and any stored API key.

You can change your investment preferences at any time inside the app, remove a stored API key from the settings, sign out to end a session, or clear your browser storage to remove locally-saved data such as your theme and portfolio entries.

Depending on where you live, you may also have the right to request a copy of your data, ask for corrections, ask for deletion, or object to certain processing. Email privacy@investwise4u.com and we'll action it.

InvestWise4U is intended for adults making decisions about their own money. It is not directed at children, and we don't knowingly collect data from anyone under 18. If you believe a child has given us information, contact us and we'll delete it.

If we change this policy in a way that materially affects you, we'll update the date at the top and, where appropriate, tell you in the app. Questions about privacy go to privacy@investwise4u.com.