Privacy Policy

When you visit without an account:

• Preferences you save yourself in browser localStorage (watchlist, portfolio, alerts, light/dark theme). This never leaves your device.
• Aggregated, anonymous traffic data via Vercel Analytics: country, device, browser, pages visited. No identifiable IP, no fingerprinting.

When you create an account:

• Your email (for OTP authentication and notifications).
• Data you choose to enter: emotional journal, decisions, portfolio, watchlist, alerts, risk profile.
• Notification preferences (email alerts yes/no, digest yes/no, etc).
• Account creation and last update timestamps.

What we do NOT collect:

• Banking data, credit cards, government IDs or fiscal information.
• Passwords (we use OTP codes).
• GPS location.
• Contacts, photos or content from your device.

• Provide the Service: show your portfolio, alerts, journal, decisions, etc.
• Send the emails you requested (login OTP, alerts, digests, anniversaries).
• Generate personalized anniversary narratives with AI (we process your context with Anthropic's Claude API, without exposing your email).
• Improve the Service (aggregated metrics of which features are used most).

We never sell or share your data with third parties for commercial purposes.

We use industry-standard infrastructure providers:

• Vercel (hosting): serves the app and captures anonymous traffic metrics.
• Supabase (database): stores your account and data, encrypted at rest, isolated by Row Level Security.
• Resend (email): sends transactional emails from hola@tinchoinvest.com.
• Anthropic (Claude API): generates AI narratives. We send only the necessary context (decision + mood pattern), not your email.
• Yahoo Finance, CoinGecko, DolarAPI, alternative.me, ArgentinaDatos: market data providers. We only query them, we don't share your data.

• Strictly necessary cookies: login session. Nothing else.
• We do not use tracking, remarketing, advertising or third-party cookies like Google Analytics, Facebook Pixel, etc.
• Vercel Analytics is cookie-less (uses anonymous hashing).

You own your data. At any time you can:

• Access all data we have about you.
• Rectify incorrect data.
• Delete your account and all associated data (irreversible).
• Export your data in readable format.
• Withdraw consent for notifications from /ajustes.

To exercise these rights write to hola@tinchoinvest.com from your account email. We respond within 30 days.

If you're in the EU/UK, you have additional rights under GDPR/UK-GDPR. If you're in California, you have rights under CCPA. Contact us to exercise them.

• Account data: until you decide to delete the account.
• OTP codes: 15 minutes (they expire automatically).
• Sent emails: metadata retained by Resend per its own policy.
• Anonymous Vercel metrics: standard service retention.

• HTTPS enforced across the entire site.
• Database with encryption at rest (AES-256 via Supabase/AWS).
• OTP authentication (no passwords that can leak).
• Row Level Security on every table — a user can never access another's data.
• Secrets stored in environment variables + Supabase vault.

TinchoInvest is not directed to individuals under 18. If we detect an account belongs to a minor, we will delete it.

Your data is stored on Supabase servers (AWS us-east-1) and Vercel (global CDN). By using the Service you consent to this transfer.

If we update this policy we'll notify registered users by email. The last updated date is always at the top of this document.

Data controller: Martín Cornut, Argentina.
Contact: hola@tinchoinvest.com