Privacy Policy

Roy Wealth · Last updated: October 20, 2026

1. Data controller

Roy Wealth is published by HAIMOURA FUND (Siren : 988 442 612, see the legal notice). For any question about your data: hello@getroy.fr.

2. Data we process

Account: your name, email address and password (stored hashed, never in clear text); if you enable two-factor authentication, its secret and your recovery codes, encrypted.
Sign-in: on the website, the IP address and browser (user agent) of your sessions; in the app, the hash of your authentication token and when it was last used.
Portfolio: your brokerage accounts (broker, account number, label), the positions, transactions, cash and valuations you track through the service (financial data), and the statements you import: the uploaded file is deleted once processed, only its name and the data extracted from it are kept.
Content you enter: your free-text notes (trading journal), watchlists, price targets and display preferences.
Zakat and purification payments: the ones you record (type, fiscal year, amount, date and an optional note, encrypted). They may reveal a religious practice: they serve only your own tracking and are never shared.
Reports: the PDF factsheets of your portfolio (monthly and annual), which include your amounts.
Change history: for your transactions, notes and zakat or purification payments, the date, author and previous value of each change.
Application logs: server errors and operational events, which may include your user ID.
On your device (mobile app): the authentication token, stored in the iOS Keychain, your display preferences (language, theme) and a temporary copy of your portfolio data for offline viewing, cleared when you sign out.
We do not collect your location, contacts, photos, or any advertising identifier.

3. Purposes and legal bases (GDPR, art. 6)

Providing and securing the service — performance of the contract.
Authentication and abuse prevention — legitimate interest.

4. Market data

Quotes and fundamental data come from the provider EODHD. None of your personal data is shared with it.

5. Data sharing and processors

We do not sell or rent your data. No data is shared for advertising purposes. Your data is accessible only to authorized personnel and to the following providers, each for its own task only:

OVH: hosting of the servers and the database, in the European Union.
Resend (United States): sending the service's emails (address confirmation, password reset, alerts, digests and factsheets, sent as a PDF attachment with your amounts). Your email address and the content of these messages are therefore transferred outside the European Union; this transfer is governed by the European Commission's standard contractual clauses, included in Resend's data processing agreement.
EODHD: market data provider (see section 4); it receives none of your personal data.
Google (Drive): storage of the off-site backup copy. It is encrypted on our servers before upload: Google has no access to its content.

6. Tracking

Roy Wealth performs no advertising or cross-app tracking. No third-party analytics SDK is integrated.

7. Retention

Active account: your data is kept as long as your account exists.
Account deletion: your data is erased immediately from the database (account, portfolio, notes, zakat and purification payments, lists, factsheets, tokens and sessions).
Backups: kept 7 days for the database and 14 days for files (factsheets) on our servers, and up to 6 months for the encrypted off-site copy; your data disappears from them as they rotate. One exception on our servers: a copy of the database from September 29, 2026, taken before a correction of the portfolio accounting, is kept until the close of the current financial year, at the latest in January 2027, and then deleted.
Application logs: 30 days, with daily rotation.
Unaccepted invitation: the email address of the invited person, and the name entered with it, are kept until the invitation is deleted manually by the administrator, with no automatic purge.

8. Security

Encryption in transit (HTTPS/TLS), hashed passwords, token stored in the Keychain, restricted access to data.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. Self-service comes first: the Profil (profile) page of the website lets you correct your name and email address, change your password and delete your account; the mobile app also lets you delete it, and your positions can be exported as CSV from the Portefeuille (portfolio) page. For any other request, or if self-service is not enough, email hello@getroy.fr: we reply within 30 days. You may also lodge a complaint with your local data protection authority.

10. Account and data deletion

You can delete your account yourself at any time, from the Profil (profile) page of the website or from the mobile app, after confirming your password. Deletion is immediate and permanent; section 7 gives the retention of backups. If you can no longer sign in, email hello@getroy.fr: your request is handled within 30 days.

11. Children

Roy Wealth is not intended for people under 16, and we do not knowingly collect their data.

12. Changes

This policy may change; the date at the top indicates the version in force. We will notify you of any significant change.