Legal

Privacy Policy

Last updated: August 25, 2026

1. What we collect

You can use every part of Solomo — screener, company research, portfolios, and the AI chat — without an account. Nothing is hidden behind a sign-in.

• On your device only — theme, experience mode, exchange and notification preferences, plus your watchlist and any portfolio you have not synced, live in your browser's local storage. Clearing your browser removes them.
• If you create an account — your email address, and (if you sign in with Google) the name and profile picture Google returns. Passwords are never visible to us: they are hashed by our authentication provider and we cannot read them.
• If you sync a portfolio — the ticker symbol, quantity, average cost, sector and optional purchase date of each holding. Nothing that identifies you to a broker: no account number, no PAN, no bank or demat details. We never ask for them and cannot accept them.
• Server logs — our host records standard access logs (IP address, user agent, pages requested) for security and performance, and we keep a short application log described in section 4.

2. Accounts and where your data lives

Accounts and portfolio sync are provided through Supabase, which hosts our authentication and database. We chose the Mumbai (ap-south-1) region, so account data for Indian users is stored in India rather than being sent abroad.

• Only you can read your rows. The database enforces row-level security: every query is restricted to the signed-in account's own records, at the database itself rather than by application code. One user cannot read another's portfolio even if our front-end had a bug.
• The key that ships in your browser is a public one by design, and is useless without a valid session for the account it belongs to.
• Supabase processes this data on our instructions as our processor. Their handling is governed by the Supabase privacy policy.

3. What we don't do

• We do not sell or rent personal information, ever.
• We do not run advertising, ad networks, or cross-site tracking pixels.
• We do not connect to your broker, hold your money, or place trades. We cannot see your real holdings unless you type or import them yourself.
• We do not require an account, and we do not put research content behind one.

4. AI features

The "Ask Solomo" chat and the portfolio page's "Ask about your portfolio" chat generate answers with a third-party large-language-model provider, the Google Gemini API, used on Google's free (unpaid) tier.

• What is sent: the question you type, the recent turns of that same conversation, and — on the portfolio page only — a summary of the holdings you have entered (ticker symbols, quantities, values and derived ratios). Your name, email and account identifier are never sent.
• How Google may use it: under the Gemini API terms for unpaid services, Google may use inputs and outputs to provide, improve and develop its products, and human reviewers may read them. Please do not type personal details into the chat.
• What we log: we do not store the text of your questions or the answers. Our application log records only which company an answer was grounded in, which model replied, and token counts — enough to monitor capacity, not enough to reconstruct a conversation.
• Daily limits: to keep a shared free quota available to everyone, we count AI answers against a rolling daily allowance. Those counters are stored under a hashed form of your IP address; the stored record itself contains only a number and a timestamp.

5. Cookies, local storage and analytics

We set no advertising cookies. Local storage holds your preferences and any unsynced portfolio data, and clearing it removes everything Solomo has saved on your device.

Our landing page includes Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you across sites. It is the only third-party analytics on Solomo.

6. Data security

The site is served over HTTPS with HSTS, a restrictive Content Security Policy and frame protections. Credentials and keys are held outside the public web root, passwords are hashed by our authentication provider, and database access is restricted per account as described in section 2. No system is perfectly secure, and we will not claim otherwise.

7. How long we keep things

• Account and synced portfolio data — kept while your account exists. Delete your account and it is removed.
• Server access logs — retained by our host on their standard schedule, typically a few weeks.
• AI usage counters — reset on a rolling 24-hour window.
• Local browser data — until you clear it.

8. Your rights

Under India's Digital Personal Data Protection Act, 2023, and comparable laws elsewhere, you may:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct data that is inaccurate, or complete data that is incomplete.
• Erase your data — deleting your account removes your email and every synced holding.
• Withdraw consent at any time, by deleting your account or simply by not using the AI features.
• Raise a grievance about how we have handled your data, using the contact below.

If you never create an account, we hold no personal data about you beyond ordinary server logs, so there is nothing for us to return or delete.

9. Contact

Questions, requests, or grievances about this policy or your data: privacy@solomo.ai. We aim to respond within 30 days.