Privacy Policy

Introduction

Panoramica ("we", "our", or "us") is a portfolio tracking application operated by Cayman Pty Ltd. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application, website, and related services (collectively, the "Service").

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the Australian Privacy Act 1988, and other applicable data protection laws. Where we use the term "personal data", we mean any information that relates to an identified or identifiable individual.

Data Controller

The data controller responsible for your personal data is:

Cayman Pty Ltd
Email: privacy@panoramica.app

Information We Collect

Account Information

When you create an account, we collect your email address and a securely hashed password. If you choose to sign in with Apple, we receive only the information you authorise Apple to share (which may include your email address or a private relay address).

Portfolio Data

You may enter portfolio and asset information such as asset names, quantities, purchase prices, and asset types. This data is stored locally on your device and synced to our secure cloud infrastructure to enable cross-device access and backup.

Usage Data

With your consent, we collect anonymised analytics data via PostHog to understand how the app is used and to improve the Service. This does not include your portfolio data or personally identifiable information. You can opt out of analytics at any time in the app's Settings > Privacy section.

Cookies & Similar Technologies

Our website uses cookies and local storage. Essential cookies are required for the website to function. Non-essential cookies (analytics) are only set after you provide consent via the cookie banner. Our mobile app does not use browser cookies.

Legal Basis for Processing

Under the GDPR, we process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)) — Processing your account and portfolio data is necessary to provide the Service you signed up for.
• Consent (Article 6(1)(a)) — Analytics data collection is based on your explicit consent, which you may withdraw at any time.
• Legitimate interests (Article 6(1)(f)) — We may process data for security, fraud prevention, and to improve the Service, where our interests do not override your rights.
• Legal obligation (Article 6(1)(c)) — We may process data to comply with applicable laws and regulations.

How We Use Your Information

• To provide and maintain the Service, including syncing your portfolio data across your devices
• To authenticate your identity and secure your account
• To process subscription payments through Apple's App Store (we do not directly handle payment card information)
• To improve and develop new features for the Service (with your consent for analytics)
• To send you important service-related notifications (e.g., security alerts, price alerts)
• To monitor and maintain the security and integrity of the Service

Data Storage, Security & International Transfers

Your portfolio data is stored locally on your device in the app's private storage area. The local database is encrypted at rest using SQLCipher with 256-bit AES; the encryption key is held in your device's secure keystore (the iOS Keychain) and never leaves the device. Your device's operating-system file encryption protects the data as a further layer when the device is locked. The data is synced to our cloud infrastructure hosted by Supabase (which uses AWS data centres in the United States), and all data in transit is encrypted via TLS. We apply industry-standard security measures to protect your information, including row-level security policies that ensure you can only access your own data.

For users in the European Economic Area (EEA), transfers of personal data to the United States are protected by appropriate safeguards, including the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) where applicable.

Sub-Processors & Third-Party Services

We use the following third-party sub-processors to deliver the Service:

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Data Retention

We retain your account and portfolio data for as long as your account is active. If you delete your account, we will delete your data from our servers within 30 days. Backups that may contain your data are purged within 90 days. Local data on your device is removed when you uninstall the app.

Analytics data is retained in aggregated, non-identifiable form and is not linked to your account after collection.

Your Rights

Under the GDPR and other applicable data protection laws, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Correct inaccurate or incomplete personal data
• Right to erasure — Request deletion of your account and all associated data
• Right to data portability — Export your data in a machine-readable format (available via Settings > Data > Export My Data)
• Right to restrict processing — Request that we limit how we use your data
• Right to object — Object to processing based on legitimate interests
• Right to withdraw consent — Withdraw analytics consent at any time via Settings > Privacy in the app

To exercise any of these rights, use the in-app settings or contact us at privacy@panoramica.app. We will respond to your request within 30 days.

If you are in the EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

Children's Privacy

The Service is not directed to children under 16 (or under 13 in jurisdictions where that is the applicable age threshold). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can promptly remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate, notifying you via email or in-app notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Cayman Pty Ltd
Email: privacy@panoramica.app