Privacy Policy

Last updated: 11 October 2026.

What we collect

Account: email address and a securely hashed password (Argon2id - we never store your password itself). Email verification status.

Portfolio data: holdings, asset classes, and quantities you enter, used to compute concentration and scenario analysis. Watchlist items and alert conditions you configure. When an alert goes off we record when, and email you if you asked for that.

Athena AI conversations: the questions you ask and the answers given, stored so you can revisit a conversation.

Device and session data: a hashed device fingerprint and device name (if you register a device), and hashed session/refresh tokens - never the raw tokens themselves.

Sign-in location: when you sign in we estimate an approximate location (city and country) from your network address, using an IP database held on our own servers - your IP address is not sent to anyone else and is not stored, only the place name. It's shown in "Where you're signed in" and in the security emails we send when your account is signed in to from a new device or after repeated wrong passwords. It's deleted with the session (30 days at most). IP geolocation by DB-IP (CC BY 4.0).

Weather questions: when you ask Athena AI about the weather, the app asks for your phone's location (only then, and only if you allow it), rounds it to about 1 km and sends it with that one question. Without it we use the approximate location from your network address. The rounded location is sent to Open-Meteo to get the forecast - with nothing that identifies you - and is never stored by Athena.

Organization data: if you're part of an organization account, your membership and any transactions logged against it.

Voice: when you talk to Athena AI, the phone turns your speech into text using its own speech service (Apple or Google); on the web your browser does the same with its built-in speech service, and the desktop app transcribes on your computer. Only the text reaches us - we never receive or store recordings. To read answers aloud, the text of Athena's reply is sent to Microsoft Azure Speech.

Payments: subscriptions bought on the web are handled by Stripe, and in the apps by Apple or Google. We store your plan and its status - never your card details.

Who processes data for us

Only these services, and only for the purpose given: Fly.io (the app's servers and database, in London) and Vercel (the website); Groq (writes Athena AI's answers - see below); Stripe, Apple and Google (payments); Resend (account, security and alert emails); Expo, Apple and Google (delivering phone notifications, if you turn them on); Microsoft Azure Speech (reading Athena's replies aloud - reply text only); Sentry (crash and error reports, sent without personal details); Open-Meteo (weather forecasts, rounded location only).

What we don't collect

We don't run advertising trackers or sell data to third parties. We don't collect more device/account data than the features above need to function.

How it's used

Solely to run the features you use: authentication, portfolio analysis, alerts, and the Athena AI assistant. Passwords and session tokens are hashed before storage - Athena Gold's customer-facing systems are kept isolated from private quantitative systems.

Athena AI: your questions, with the recent messages in that conversation and the name you asked Athena to call you (if any), are sent to the language-model provider that writes Athena's answers (currently Groq). You can change or clear your name in Profile at any time.

Your controls

You can log out of one device or all devices, export a copy of your data ("Export my data" in Settings), and delete individual holdings, watchlist items, alerts and conversations at any time. To delete your whole account, see Delete your account.

How long we keep data

Your portfolios, watchlists, alerts and Athena AI conversations are kept until you delete them or your account. Everything else is removed automatically:

• Sign-in sessions - when they expire (30 days at most).
• Email verification and password-reset links - 30 days after use.
• Accounts whose email is never verified - after 30 days.
• Notifications - after 90 days.
• Security audit records - after 1 year.
• Closed-testing sign-up emails - after 1 year.

Data is stored in London. Encrypted backups are kept for up to 90 days, so deleted data is fully gone from backups within 90 days of deletion.

Contact

Questions about this policy: email hello@athenagold.ai.