Introduction
Panoramica ("we", "our", or "us") is a portfolio tracking application operated by Cayman Pty Ltd. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application, website, and related services (collectively, the "Service").
This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the Australian Privacy Act 1988, and other applicable data protection laws. Where we use the term "personal data", we mean any information that relates to an identified or identifiable individual.
Data Controller
The data controller responsible for your personal data is:
Cayman Pty Ltd
Email: [email protected]
Information We Collect
Account Information
When you create an account, we collect your email address and a securely hashed password. If you choose to sign in with Apple, we receive only the information you authorise Apple to share (which may include your email address or a private relay address).
Portfolio Data
You may enter portfolio and asset information such as asset names, quantities, purchase prices, and asset types. This data is stored locally on your device and synced to our secure cloud infrastructure to enable cross-device access and backup.
Brokerage Connections
If you are a Pro subscriber and choose to connect a brokerage account, the connection is made through SnapTrade. You sign in to your brokerage on SnapTrade's page; we never receive your brokerage login details. With your authorisation, SnapTrade gives the Service read-only access to the account's holdings, balances and transaction history, which we store with your portfolio data. To keep the connection working we store your SnapTrade user reference and an encrypted access secret. Disconnecting the brokerage in Settings removes that connection at SnapTrade and in our database.
Usage Data
With your consent, we collect anonymised analytics data via PostHog to understand how the app is used and to improve the Service. This does not include your portfolio data or personally identifiable information. You can opt out of analytics at any time in the app's Settings > Privacy section.
Cookies & Similar Technologies
Our website uses cookies and local storage. Essential cookies are required for the website to function. Non-essential cookies (analytics) are only set after you provide consent via the cookie banner. Our mobile app does not use browser cookies.
Legal Basis for Processing
Under the GDPR, we process your personal data on the following legal bases:
- Contract performance (Article 6(1)(b)) — Processing your account and portfolio data is necessary to provide the Service you signed up for.
- Consent (Article 6(1)(a)) — Analytics data collection is based on your explicit consent, which you may withdraw at any time.
- Legitimate interests (Article 6(1)(f)) — We may process data for security, fraud prevention, and to improve the Service, where our interests do not override your rights.
- Legal obligation (Article 6(1)(c)) — We may process data to comply with applicable laws and regulations.
How We Use Your Information
- To provide and maintain the Service, including syncing your portfolio data across your devices
- To authenticate your identity and secure your account
- To process subscription payments through Apple's App Store (we do not directly handle payment card information)
- To improve and develop new features for the Service (with your consent for analytics)
- To send you important service-related notifications (e.g., security alerts, price alerts)
- To monitor and maintain the security and integrity of the Service
- To send your portfolio information to an AI app you have connected, when that app asks for it
Data Storage, Security & International Transfers
Your portfolio data is stored locally on your device in the app's private storage area. The local database is encrypted at rest using SQLCipher with 256-bit AES; the encryption key is held in your device's secure keystore (the iOS Keychain) and never leaves the device. Your device's operating-system file encryption protects the data as a further layer when the device is locked. The data is synced to our cloud infrastructure hosted by Supabase (which uses AWS data centres in the United States), and all data in transit is encrypted via TLS. We apply industry-standard security measures to protect your information, including row-level security policies that ensure you can only access your own data.
For users in the European Economic Area (EEA), transfers of personal data to the United States are protected by appropriate safeguards, including the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) where applicable.
Sub-Processors & Third-Party Services
We use the following third-party sub-processors to deliver the Service:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Authentication & cloud database | US (AWS) |
| PostHog | Product analytics (with consent) | US |
| Sentry | Error monitoring & crash reporting | US |
| RevenueCat | Subscription management | US |
| Apple App Store | Payment processing & distribution | US |
| SnapTrade | Read-only brokerage connections (Pro, only if you connect an account) | US and other countries (see SnapTrade's privacy policy) |
| Financial data providers | Live pricing (no personal data shared) | Various |
We do not sell, rent, or share your personal data with third parties for marketing purposes.
AI Apps You Connect
If you have Panoramica Pro, you can connect an AI app you use, such as Claude or ChatGPT, to your Panoramica account. Panoramica sends nothing to that app, or to any AI company, until you approve the connection on our approval screen.
Once you approve, the app can read your portfolios, holdings, transactions, portfolio value history and net worth. It cannot change your records or place trades. We send this information at your request, to provide the part of the Service you asked for.
The app's provider is not our sub-processor. What the app does with the information it reads is governed by that provider's own terms and privacy policy, not by this policy.
You can disconnect an app at any time in Settings, under API and connected apps. It loses access on its next request. Connections do not work while your privacy mode is Strict or Local-first.
For each connection we keep the app's name, the address it returns you to, when you approved it and when it last read your data. We keep this record after you disconnect, until you delete your cloud copy or your account, and it is included when you export your data.
Data Retention
We retain your account and portfolio data for as long as your account is active. If you delete your account, we will delete your data from our servers within 30 days. Backups that may contain your data are purged within 90 days. Local data on your device is removed when you uninstall the app.
Analytics data is retained in aggregated, non-identifiable form and is not linked to your account after collection.
Your Rights
Under the GDPR and other applicable data protection laws, you have the following rights:
- Right of access — Request a copy of the personal data we hold about you
- Right to rectification — Correct inaccurate or incomplete personal data
- Right to erasure — Request deletion of your account and all associated data
- Right to data portability — Export your data in a machine-readable format (available via Settings > Data > Export My Data)
- Right to restrict processing — Request that we limit how we use your data
- Right to object — Object to processing based on legitimate interests
- Right to withdraw consent — Withdraw analytics consent at any time via Settings > Privacy in the app
To exercise any of these rights, use the in-app settings or contact us at [email protected]. We will respond to your request within 30 days.
If you are in the EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
Children's Privacy
The Service is not directed to children under 16 (or under 13 in jurisdictions where that is the applicable age threshold). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can promptly remove it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate, notifying you via email or in-app notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:
Cayman Pty Ltd
Email: [email protected]