SINDEX is a stock research and personal‑portfolio tracking app. It is not a broker and not a financial adviser: it never executes trades, never holds or moves your money, and nothing in it is investment advice. This policy explains what we collect, why, and your choices.
In short: we collect only what the app needs to work, we never sell your data, we never track you across other companies' apps or websites for advertising, and you can permanently delete your account and data from inside the app at any time.
Information we collect
Account — your email address and, if you enter it, your name. If you sign in with Apple or Google, we receive the details that provider shares with us (see below). We do not ask for a phone number, address, date of birth or any other profile detail.
Portfolio you create — manual assets you add (e.g. gold, cash, holdings, a property and its rent), your watchlist, and any custom baskets. This is stored to your account so it syncs across your devices.
Scenario Analyzer history — the questions you ask the AI analyzer and the sessions you keep sync to your account so they follow you across devices.
Broker connections (optional) — if you connect a brokerage, the connection is read‑only and handled by our partner SnapTrade. We never receive your brokerage username or password — you sign in on SnapTrade's page, never in SINDEX. We receive only read‑only holdings data (broker name, account names, cash balance and positions) to display your portfolio, and we do not store it on our servers.
Device identifier — an anonymous, per‑install identifier the app sends with AI and broker requests. Our servers key your usage and broker link to your signed‑in account, not to this identifier, and it is not stored alongside anything that identifies you. It is reset when you sign out.
Subscription status — whether you have an active subscription (plan, product, expiry date and Apple's transaction identifier), verified through Apple. Payment details are handled by Apple; we never see your card.
AI usage counters — the number of AI requests and tokens used per account, to apply fair‑use limits and understand demand.
Apple sign‑in token — if you use Sign in with Apple, we keep the token Apple issues us for one purpose only: to revoke your Apple credential when you delete your account, as Apple requires.
Wallet card (optional) — if you add the SINDEX card to Apple Wallet, your net worth and name are sent to our server to generate the pass. They are used for that request only and are not stored.
Home Screen widget (optional) — if you add it, your net worth and watchlist tickers are kept on your device for the widget and shown on your Home Screen or Lock Screen. Nothing is sent anywhere for it.
Basic technical data — standard request information (such as IP address) used transiently to operate the service and prevent abuse.
How we use it
To provide the app: your accounts, portfolio, watchlist, and research tools.
To sync your data securely across your devices.
To operate and protect the service (rate‑limiting and abuse prevention).
To process subscriptions through Apple.
We do not use your data for advertising, we do not sell or rent it, and we do not track you across other apps or websites.
Service providers
We share the minimum necessary with trusted providers that help us run SINDEX:
Supabase — secure database and authentication (stores your account and portfolio).
Railway — hosting for our backend services.
SnapTrade — read‑only brokerage connectivity (holds your broker credentials, encrypted; we do not).
Financial Modeling Prep — market data (prices, fundamentals, news). Requests are proxied through our servers.
DeepSeek — powers optional AI research features. The text you submit for an analysis is sent to DeepSeek to generate a response; nothing that identifies you goes with it. We keep a log of the questions asked and the answers given, with the language and model used and, if you are signed in, your account id (never your email), for up to 90 days, to understand what people ask and improve the feature. The app tells you this before your first question. DeepSeek processes the text it receives under its own privacy policy.
ExchangeRate-API — exchange rates for currency conversion. Requests are made by our servers; nothing about you is sent.
Apple — Sign in with Apple and subscription payments.
Google — Sign in with Google. If you choose it, Google shares your name, email address and profile picture with us, and confirms your identity with a signed token. We use this only to create your account and sign you in. We request no other access to your Google account — not your Gmail, contacts, files or calendar.
Google user data
When you use Sign in with Google, the information we receive from Google (your name, email address and profile picture) is used solely to create, identify and sign in to your SINDEX account. We do not use it for advertising, we do not sell it, and we do not share it with anyone except the service providers listed above that store your account. It is kept for as long as your account exists and is deleted when you delete your account.
Your data is encrypted in transit (HTTPS) and at rest. Access is protected by database row‑level security so each user can reach only their own data, and authentication tokens are stored in the device Keychain. No method is perfectly secure, but we work to protect your information.
Your rights and choices
Access & edit — view and change your profile and portfolio in the app at any time.
Delete — Settings → Profile → Delete Account permanently deletes your account and its data from our systems, revokes your Sign in with Apple credential, removes SINDEX's access from your Google Account, asks SnapTrade to delete your broker connections (SnapTrade completes this within minutes), and erases the Scenario Analyzer log entries kept under your account. The app also wipes its local copy of your data, including the Home Screen widget. Signing out, without deleting, removes Google's sign-in tokens from your device.
Disconnect a broker — remove any brokerage connection from the Tracker at any time.
Data retention
We keep your account data while your account exists. When you delete your account, your personal data is removed as described above. Three things remain: aggregate daily request counts with no user key; server request logs (request path, status, IP address and internal account id — never your email), which our hosting provider keeps for a limited time; and authentication audit records, which Supabase retains for a limited period. Scenario Analyzer log entries expire after 90 days in any case. For up to 24 hours after a deletion we also keep your internal account id on its own, so that a sign-in token issued before the deletion is refused. If Apple cannot be reached to revoke your Sign in with Apple credential, we keep the revocation token only until the revocation succeeds, and retry it automatically.
Children
SINDEX is intended for adults and is not directed to children. We do not knowingly collect data from children under the age required by your local law.
International
SINDEX is offered from Kuwait and processes data on servers operated by our providers, which may be located in other countries. By using the app you consent to this processing.
Changes
We may update this policy. Material changes will be reflected here with a new effective date.
Contact
SINDEX is operated by Sadeq Alsalman, trading as SINDEX, Kuwait. Questions about privacy? Contact us at support@join-sindex.com.