Privacy Policy

1. What we collect

Account info: your email address and display name via Google Sign-In (Supabase Auth). We never see or store your Google password.

Content you create: posts, comments, watchlist tickers, saved valuations, investment theses, investing-log entries, and paper-trading activity.

Profile media: a profile photo, if you choose to upload one.

Push notification tokens, if you opt in to alerts (e.g. thesis health changes).

Your LINE user ID, if you link LINE to receive alerts. It is learned only when you send your link code to the TreasureX Official Account, and is removed when you unlink or block that account.

2. How we use it

To operate core features: your account, feed posts, thesis tracking, paper portfolio, and leaderboard rankings.

To personalize your experience: your watchlist, saved valuations, and language preference.

To send you notifications you've opted into (e.g. a push alert when a tracked stock's health score drops, or the same alert in LINE).

To compare a saved valuation's assumptions with a company's later filings, and tell you how they compare (Pro report cards).

To show anonymous statistics of the assumptions readers chose for a company — the middle range and median of growth, margin and discount rate. These are computed from the latest saved valuation of each reader, only when at least five readers have valued that company, and never include who made them, any single valuation, or a fair value.

We do not sell your personal data to third parties.

3. What's public vs. private

Public within the app: your display name, profile photo, feed posts, and paper-trading leaderboard ranking/returns (if you appear on the leaderboard).

Private: your investing-log entries (P&L journal) are private by default and only shared in aggregate/anonymized form if you explicitly opt in per entry.

4. Third-party services

Supabase (database, authentication, file storage), Vercel (hosting), Finnhub, Yahoo Finance, Alpaca and SEC EDGAR (market and filing data), DeepSeek and Perplexity AI (AI-generated summaries and translation — they receive company data, never your personal data), and LINE (alert delivery, if you link it). These providers process data on our behalf under their own security and privacy terms.

5. Data retention & deletion

We retain your data for as long as your account is active. To request deletion of your account and associated data, contact us — see the contact details below.

6. Cookies & local storage

Necessary: browser local storage keeps your watchlist, valuations and preferences available offline, and cookies keep you signed in. These are required for the app to function and cannot be switched off.

Optional — personalised advertising: where ad units are enabled, Google AdSense sets its own cookies to select ads. This runs only if you have agreed to it. Decline and no ad script is loaded at all; the rest of the app is unaffected.

Optional — usage measurement: aggregate counts of which features are used. Never your valuations, holdings or journal entries.

You are asked before either optional purpose starts, nothing is enabled by default, and you can change your answer at any time from Settings → Privacy.

7. Your rights

Under Thailand's Personal Data Protection Act you may ask to access, correct, export or delete your personal data, withdraw consent you have given, or object to a particular use.

Consent for the optional purposes above can be withdrawn yourself, at any time, from Settings → Privacy — it takes effect immediately.

For access, correction, export or deletion of your account data, contact us using the details below. We will respond within the period the PDPA requires.

8. Contact

Questions about this policy or your data? Reach out via the app's feedback channel or the contact email listed on our landing page.