Privacy Policy

aismartmoney.app is operated by Yona Yin Hong as an independent research project. There is no external investor or parent entity. Privacy-related inquiries may be directed to [email protected].

Depending on how a user interacts with the Service, the following categories of data may be collected:

• Account data (registered users only): email address, account password (stored in hashed form by our authentication provider Supabase; plaintext passwords are not accessible to the Service), display name where provided, and sign-in method (email/password or Google OAuth).
• Product data: watchlists, feed preferences, and other user-configured settings saved while signed in.
• Technical data: IP address, browser user-agent, and HTTP request logs. This data is recorded automatically by our CDN provider (Cloudflare) and application host (Fly.io) for security auditing and reliability purposes.
• Cookies: the Service uses a single first-party session cookie to maintain a user's signed-in state. The Service does not use any third-party advertising or tracking cookies.

• To provide authentication and maintain the signed-in state.
• To render and persist user watchlists, feed configurations, and preferences.
• To prevent abuse, spam, and unauthorized access.
• To improve reliability and investigate incidents, using aggregated logs rather than per-user tracking.
• To respond to user-initiated correspondence.

The Service depends on the following infrastructure providers. Only the minimum data necessary to operate the Service is shared with each:

• Supabase, Inc. (United States) — provides authentication and database storage.
• Cloudflare, Inc. (global edge) — provides CDN, WAF, and DNS services.
• Fly.io (application host; primary region: Tokyo) — runs the application.
• Google LLC (United States) — used only where a user elects to sign in via Google; only the user's email address and display name are transmitted.
• Creem (payment processor) — will process payments if paid subscriptions are launched; not currently active.

Personal data is not sold to any third party and is not used for third-party advertising purposes.

• Account data is retained for the duration of a user's account. Following a deletion request, associated data is permanently removed within 30 days.
• Technical logs are retained by the relevant infrastructure providers under their respective retention policies, generally no longer than 30 days.

Subject to applicable law in the user's jurisdiction, users may be entitled to the following rights:

• Access to the personal data the Service holds concerning the user.
• Correction or update of inaccurate information.
• Deletion of the user's account and associated data.
• A portable export of the user's personal data.
• Withdrawal of any prior consent given for data processing, including via account deletion.

To exercise any of the above rights, please contact [email protected]. A response will be provided within three business days.

Because the Service's infrastructure providers operate in the United States and across global edge locations, user data may be transferred to jurisdictions outside the user's country of residence for processing. The Service relies on each provider's standard contractual clauses as the basis for lawful cross-border transfer.

The Service is not directed to individuals under the age of 16. If personal data is provided to the Service by a minor, please contact us and it will be deleted promptly.

HTTPS is enforced site-wide, passwords are stored using industry-standard hashing, and standard web security controls are applied, including CSRF protection, rate limiting, and SQL injection defenses. While no information system can guarantee absolute security, the Service treats data security as a core operational priority.

Where this Policy is materially updated, this page will be revised and the "Last updated" date will be adjusted. Registered users will be notified by email at least 14 days before the effective date of any material change. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For any privacy-related inquiry, please contact [email protected].