Privacy policy

1. Who we are and what this policy covers

This policy explains how Investment Finder (we, us, our) collects, uses, stores and discloses personal information when you use the Investment Finder website (the Site). We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the Act strictly applies to us.

2. What we collect

You can use most of the Site without an account. The information we may collect is limited to:

• Account details. If you create a free account we collect your email address and a password, which is stored only as a salted hash by our authentication provider. If you sign in with Google or Facebook we receive the name, email address and profile picture that provider shares, and an identifier for your account with them; we do not receive your password for that service. We also record when the account was created and last signed in.
• Server logs. When you load a page, our hosting provider records technical details of the request: your IP address, browser and device type, the page requested (including any fund codes, filters or search terms in the address), the referring page, and the date and time. We use these logs to keep the Site secure, detect abuse and diagnose faults.
• Usage analytics. We use Vercel Web Analytics to understand which pages are visited and how the Site performs. It does not use cookies and does not track you across other sites; it derives a short-lived, anonymised identifier that cannot be linked back to you, and reports aggregated statistics such as page views, countries and device types.
• Correspondence. If you email us, we keep your email address and the content of your message so we can reply.

We do not knowingly collect sensitive information, financial account details or information about your investments. Fund codes you type into the Site are used only to produce the page you asked for.

3. Cookies and similar technologies

The Site does not set advertising, tracking or profiling cookies. If you sign in, we set strictly necessary cookies that keep you signed in; they are removed when you sign out or expire. Our hosting provider may set a strictly necessary cookie or use a short-lived challenge to distinguish people from automated traffic when it detects abuse. Your browser may store technical data (for example fonts and scripts) in its cache; you can clear this at any time.

4. How we use information

We use the information above to:

• create and secure your account, sign you in, confirm your email address and let you reset your password;
• operate, secure and maintain the Site, including detecting and blocking abusive or automated traffic;
• understand, in aggregate, how the Site is used so we can improve it;
• respond to your enquiries; and
• comply with legal obligations.

We do not sell personal information, and we do not use it for direct marketing.

5. Who we share it with

We share information only with the service providers that run the Site, and only to the extent needed for them to provide their services:

• Vercel Inc. (United States) hosts the Site, serves pages from its network, provides the analytics described above and keeps server logs. Pages are served from Vercel's Sydney region, but Vercel is a US company and request logs and analytics may be processed and stored in the United States and other countries where Vercel operates.
• Supabase hosts our database and authentication service in Sydney, Australia. It holds fund data and, if you have an account, your account details described above.
• Resend (United States) delivers account emails such as confirmation and password-reset links, and therefore processes your email address when one is sent.
• Google and Meta (Facebook) are involved only if you choose to sign in with those services, under their own privacy policies.
• GitHub (United States) hosts the Site's code and runs the scheduled jobs that update fund data. No visitor information is sent to GitHub.

We may also disclose information where the law requires it, or to protect our rights or the safety of others. By using the Site you acknowledge that some technical information may be disclosed to overseas recipients as described above.

6. Security

The Site is served only over HTTPS. The database is protected by access controls that allow the public website to read published fund data only. Server logs and analytics are held by our providers under their own security programs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Retention

Account details are kept until you close your account, which you can do by emailing us; we then delete them within 30 days. Server logs are retained by our hosting provider for a limited period (typically days to a few weeks) and then deleted. Aggregated analytics contain no personal information and may be kept indefinitely. Correspondence is kept for as long as needed to deal with your enquiry and any follow-up.

8. Access, correction and complaints

You may ask us what personal information we hold about you, and ask us to correct it, by emailing hello@investmentfinder.app. If you have an account, you can see and change your email and password on your account page, and ask us to delete the account. If you believe we have mishandled your personal information, please contact us first and we will respond within a reasonable time. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Third-party sites

The Site links to third-party websites, such as fund issuers and the ASX. Those sites have their own privacy policies, which we do not control. Some links may be affiliate links, as described in our Terms of use; the third party may set its own cookies when you visit.

10. Changes to this policy

We may update this policy from time to time. The current version is always published on this page with its last-updated date.

11. Contact

Privacy questions and requests can be sent to hello@investmentfinder.app.