Privacy Policy

1. Who We Are

BuyTune ("we," "us," or "our") operates BuyTune.io, an AI-powered portfolio analysis and financial planning platform. For privacy inquiries, contact us at privacy@buytune.io.

2. Information We Collect

Account Information

• Email address (required to create an account)
• Username and display name
• Profile preferences and avatar settings

Portfolio and Financial Data

• Portfolio holdings: ticker symbols, share quantities, cost basis
• Cash balances and transaction history
• Portfolio names, descriptions, and strategy assignments

Financial Planning Data

• Retirement planning inputs: target age, savings rates, assumptions
• Net worth information: assets and liabilities you manually enter
• Cash flow information: income, expense estimates
• Life event planning: home purchase parameters, future financial goals

Usage Data

• Login activity and session data
• Feature usage patterns (via Vercel Analytics — anonymized)
• Browser type, device type, and general location (country/region)

Communications

• Email digest preferences and delivery logs
• Support communications you send to us

3. How We Use Your Data

We use your data solely to:

• Provide and improve the BuyTune platform
• Generate AI-powered portfolio analysis and financial planning illustrations
• Send email digests and account notifications you have requested
• Maintain your account security
• Diagnose technical issues and improve platform performance
• Comply with legal obligations

We do not use your data for advertising, profiling for third parties, or sale to data brokers.

4. Third-Party Services

BuyTune relies on the following third-party services to operate:

• Supabase — Database and authentication. Your portfolio and account data is stored in Supabase-managed databases. Supabase Privacy Policy
• Vercel — Hosting and serverless functions. Processes web requests. Vercel Privacy Policy
• Resend — Email delivery for digest emails and account notifications. Resend Privacy Policy
• Finnhub — Real-time and historical market data. Ticker queries are sent to Finnhub servers. Finnhub Privacy Policy
• Google Gemini (AI) — AI analysis generation. Portfolio context is sent to Google's API to generate insights. Google Privacy Policy
• xAI Grok (AI) — AI analysis generation with live search. Portfolio context may be sent to xAI's API. xAI Privacy Policy

When your portfolio data is sent to AI services to generate analysis, it is used only for that request and is not used to train AI models (subject to each provider's terms).

5. Data Retention

• Account data is retained for as long as your account is active
• Portfolio and financial data is retained as long as your account exists
• After account deletion, data is removed from active systems within 30 days
• Backups may retain data for up to 90 days after deletion
• Email delivery logs are retained for up to 12 months

6. Security Practices

We implement industry-standard security measures including:

• Row-level security (RLS) on all database tables — users can only access their own data
• All connections encrypted with TLS in transit
• API keys stored as environment variables, never in client code
• Authentication managed through Supabase Auth with secure session handling
• No plaintext storage of passwords

Despite these measures, no system is completely secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

7. Your Rights

You have the right to:

• Access — Request a copy of the data we hold about you
• Correction — Update or correct your data through your account settings
• Deletion — Delete your account and associated data
• Export — Request an export of your portfolio data in CSV format
• Opt-out — Unsubscribe from email digests at any time via the unsubscribe link in any email

To exercise these rights, contact us at privacy@buytune.io.

8. Cookies and Local Storage

BuyTune uses cookies and browser local storage solely for authentication session management and user preferences (such as theme settings). We do not use tracking cookies or advertising cookies.

9. Children's Privacy

BuyTune is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, contact us at privacy@buytune.io and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by updating the effective date above and, where appropriate, by email notification. Continued use of the platform after changes constitutes acceptance of the revised policy.

11. Contact

Privacy questions or requests: privacy@buytune.io

General legal matters: legal@buytune.io