Smart InvestPrivacy Policy
A clear account of the information this service uses and the choices you have.
Effective date: October 19, 2026
1. Who operates this service
Smart Invest is operated by Smart Invest. This policy applies to this deployment of Smart Invest and its account, research and portfolio features. For privacy questions, contact [email protected].
2. Information we collect
We store your account email, display name, password hash when password sign-in is used, role, language and timezone preferences. We also store session records, security and audit events, the portfolio transactions and DCA plans you enter, job records, alerts and research requests. We do not connect to a brokerage or collect brokerage passwords.
3. Google sign-in data
If you choose Google sign-in, we request the openid, email and profile scopes. Google provides an account identifier, verified email status and basic profile information such as your display name. We use the verified identity only to sign you in, create an account if registration is enabled, or link a matching verified Gmail address to your existing account. We retain the Google account identifier for future sign-ins. We do not request Gmail messages, contacts, calendars or Drive data. OAuth authorization codes and identity tokens are used transiently for verification; access and refresh tokens are not retained.
4. How we use information
We use information to provide your workspace, maintain your manually entered investment records, authenticate and secure your account, run requested research tasks, deliver configured notifications, and investigate abuse or operational failures. We do not sell personal information or use Google account data for advertising, data brokerage or generalized AI model training.
5. Cookies and local storage
Necessary HttpOnly cookies maintain your login session and temporarily protect Google sign-in against request forgery. Browser local storage remembers your workspace language and appearance. Public pages do not load advertising trackers, analytics scripts or optional third-party cookies. Choosing Google sign-in takes you to Google, whose own policies apply there.
6. Sharing and service providers
The deployment uses MongoDB for storage, Google for Google sign-in, a configured market data provider for market research, and the operator’s configured SMTP service for email. Market data providers receive instrument requests and the operator’s API credentials, not your portfolio ledger. Email providers receive recipient addresses and message content necessary for delivery. Information may also be disclosed when legally required or necessary to protect the service and its users.
7. Security and retention
Passwords are hashed with Argon2id. Business credentials are encrypted with an external application key. Session and temporary authentication records expire automatically; other account, portfolio, audit and job records remain until account self-deletion or removal by an authorized operator. Backup retention and storage location depend on the operator’s deployment. No retention period is implied where it has not been configured. Security controls reduce risk but cannot eliminate it.
8. Your choices, access and deletion
You can update supported preferences, export your portfolio transaction ledger and revoke sessions from your account settings. You can permanently delete your account from Account settings after confirming the irreversible deletion warning. This removes your account, Google association and private records from the active application database and revokes all sessions. Export any needed records first; this action cannot be undone. The last super administrator must appoint another active super administrator before self-deletion. For further access or correction requests, contact [email protected]. Separately managed backups follow the operator’s retention schedule. Removing this app from your Google account does not by itself delete the Smart Invest records; use Account settings to delete your account separately. Your applicable privacy rights depend on your location.
9. Children and changes
The service is intended for adults and is not directed to children. We may update this policy when data practices change. The current policy will remain publicly accessible at this URL; material changes will be identified with an updated effective date.