Your data, handled with care

2. The short version

This is a summary for convenience. The sections that follow are the actual policy.

3. What we collect

What we hold depends entirely on how you use the app.

3.1 If you use Guest mode

We collect no personal information. Guest mode requires no account, no email and no sign-in. The preview data it shows is anonymised on our server before it is sent to your device.

Our server temporarily holds the IP address your request arrives from, in memory only, so it can apply rate limits and block abuse. It is used as a counter key, is never written to our database, and disappears when the counting window closes.

3.2 If you create a Mosaic account

3.3 Subscription and payment information

Mosaic Pro is a subscription sold through the Apple App Store. Apple processes the payment. We use RevenueCat to verify with Apple whether your subscription is valid.

From that process we store: your subscription status (active, in grace period, expired, cancelled or refunded), the current billing period end date, whether it is set to renew, the store it came from, the product identifier, and when we last verified it.

3.4 Your preferences and saved model portfolio

So the app can show you the same thing next time you open it, we store the settings you choose:

• Your sector filter, stability level and portfolio size;
• Your chosen comparison benchmark and savings-rate bank;
• Whether you have completed onboarding, and your display preferences.

If you save a model portfolio, we store a snapshot of it: its holdings and model weights, the methodology version and quarter it was generated from, and the preferences that produced it. This is so the app can show you quarter-on-quarter changes against a fixed reference point.

These are product settings, not financial circumstances. Choosing "Healthcare" or "20 stocks" tells us nothing about your money.

3.5 Disclosure acknowledgements

Before you can save a model portfolio, the app asks you to acknowledge that it is educational analytics rather than personal financial advice. We record which disclosures you acknowledged, which version of each, and when. We keep this as a compliance record.

3.6 Technical and security logs

Our server records a limited audit log of API activity: the endpoint called, the response status, a timestamp, and the account ID where the request was authenticated. We use this to investigate errors, detect abuse and support you when something goes wrong. These logs do not contain the contents of your requests.

4. What we never collect

This list is a design constraint, not a promise of restraint. The app has no screen that asks for these things and our servers have nowhere to put them.

5. How we use it

We use the information in section 3 only to:

• Run your account - sign you in, verify your email address, and let you reset a forgotten password;
• Check your subscription - confirm with Apple, through RevenueCat, that Mosaic Pro is active, and unlock or lock features accordingly;
• Deliver the product - apply your preferences and show your saved model portfolio and its quarter-on-quarter changes;
• Keep the service secure and working - enforce rate limits, investigate faults and detect abuse;
• Meet our compliance obligations - keep records of disclosure acknowledgements;
• Reply to you - when you email us for support.

We do not use your information to make automated decisions with legal or similarly significant effects, and we do not use it to train machine learning models.

6. Legal bases for processing (UK and EU users)

Where the UK GDPR or EU GDPR applies to you, we rely on the following legal bases.

Where we rely on legitimate interests, we have considered the impact on you and limited what we collect to what is genuinely needed. You can object to that processing at any time using the contact details in section 16.

7. Who we share it with

We do not sell or rent your information. We share it only with the service providers that make the app work, and only with what each one needs.

We may also disclose information where we are legally required to, for example in response to a valid legal request, or where necessary to protect our rights, our users or the safety of others. If Mosaic is ever sold or transferred, your information may pass to the acquirer, and we will tell you before that happens.

8. Where your information is stored

Your account, preferences, saved model portfolio and our server logs are stored in Sydney, Australia, on Amazon Web Services infrastructure. Your authentication records are stored by Supabase, also in Sydney.

Some of our providers operate internationally. Subscription verification data is processed by RevenueCat in the United States, account emails are delivered by Resend from Tokyo, Japan, and requests to this website are served from Netlify's global edge network. Where information leaves the UK or European Economic Area, we rely on the relevant provider's Standard Contractual Clauses or an equivalent transfer mechanism.

9. How long we keep it

10. Your rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and receive a copy;
• Correct anything that is wrong or out of date;
• Delete your account and the information tied to it;
• Port your information to another service in a machine-readable format;
• Restrict or object to processing we carry out under legitimate interests;
• Withdraw consent where we relied on it, without affecting anything done beforehand.

Email mosaic.investing0@gmail.com from the address on your account and we will respond within 30 days. Exercising these rights is free and we will not treat you differently for doing so.

If you are unhappy with how we handled your request, you can complain to your data protection authority: the Office of the Australian Information Commissioner (oaic.gov.au) in Australia, the Information Commissioner's Office (ico.org.uk) in the UK, or your national supervisory authority in the EU. We would appreciate the chance to put it right first.

11. Deleting your account

To delete your Mosaic account and the information associated with it, email mosaic.investing0@gmail.com from your account's email address with the subject "Delete my account". We confirm within 7 days and complete the deletion within 30 days.

Deleting your account removes your account record, your preferences, your saved model portfolio and your authentication records. We retain only what the law requires us to keep - subscription and transaction records for tax purposes, and disclosure acknowledgement records - as described in section 9.

12. Security

We take the following measures to protect your information:

• All traffic between the app and our servers is encrypted with HTTPS/TLS;
• Your sign-in session is stored in your device's operating system keystore (iOS Keychain), not in ordinary app storage;
• Every request is authorised on the server, not in the app, so access cannot be unlocked by modifying the app;
• Passwords are managed by Supabase and never handled by our systems;
• Guest data is anonymised on the server before it is sent, so the app never receives information it needs to hide;
• Access to production systems is limited to the operator and protected by key-based authentication.

No system is perfectly secure. If a breach affects your information and creates a risk to you, we will notify you and the relevant regulator as required by law.

13. Cookies and tracking

This website sets no cookies, runs no analytics and loads nothing from third parties. Its fonts and images are served from the same domain as the page. Our host, Netlify, keeps standard web-server request logs.

The app uses no cookies and contains no tracking, analytics or advertising SDKs. It stores your sign-in session and your local settings on your own device, and nothing else. Because there is no tracking, there is nothing to opt out of - but if your device sends a Global Privacy Control or "Do Not Track" signal, we honour it by default, since we were not tracking you in the first place.

14. Children

Mosaic Investing is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, email us and we will delete it.

15. Changes to this policy

We will update this policy when the app changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights or what we collect, we will tell you in the app or by email before it takes effect. Continuing to use Mosaic after a change means you accept the updated policy.