⭕

The Investing Circle

Privacy Policy

Last updated: May 2026

⚠️

Not Financial Advice

Nothing in this app — including Iris responses, stock data, sentiment scores, analyst summaries, price targets, or any other content — constitutes financial, investment, legal, or tax advice. All content is provided for informational and entertainment purposes only.

Past performance is not indicative of future results. Always do your own research and consult a qualified financial adviser before making any investment decisions. The Investing Circle accepts no liability for investment outcomes based on content displayed in the app.

1. Overview

The Investing Circle ("we", "our", or "the app") is a social stock-market analysis and fantasy investing platform. This Privacy Policy explains in detail what personal information we collect when you use our mobile app and website, how we use that information, who we share it with, how long we keep it, and what rights you have over it.

We believe in being straightforward: we collect only what we genuinely need to operate the service, we do not sell your personal data under any circumstances, and we give you meaningful control over what you share with us. If you have any questions after reading this policy, please reach out to us directly at privacy@theinvestingcircle.com.

2. Information We Collect

We collect information you provide directly during sign-up and use of the app, as well as certain technical data generated automatically by your device. Here is a complete breakdown:

Identity & Profile

Display name and username — provided during sign-up to identify your public profile. Your username is visible to all users of the platform.
Google or Apple account information — if you sign in with Google or Apple, we receive your name, email address, and profile picture from those providers. We use this data solely to identify and authenticate your account. We do not request access to any other Google or Apple services.
Investing experience level and goals — collected during onboarding to personalise your Iris AI responses and content recommendations. You can update this at any time from your profile settings.

Date of Birth

We ask for your date of birth during account creation for one specific purpose: to verify that you are at least 13 years old before allowing you to complete registration. Our sign-up flow checks your entered date against the current date in real time; anyone born less than 13 years ago is blocked from creating an account. We store your date of birth to be able to re-verify your eligibility if needed. We do not use it for personalisation, marketing segmentation, or any other purpose. Your date of birth is never displayed to other users.

Country of Residence

We ask for your country of residence during onboarding. This data is used to: (1) power country-based leaderboards that rank users within the same country and across regions; (2) deliver region-relevant financial content and news where available; and (3) in the future, serve country-targeted advertising relevant to your region in order to support the free tier of the app (see the Advertising section for full details). Your country is displayed on your public profile and is visible to other users. It is never sold or shared with third parties for their own marketing purposes.

Social & Community Content

Posts, comments, and likes — content you create within the app. This content is public to other users by default.

Fantasy Game Data

Fantasy team picks, scores, and performance history — see the Fantasy Data section below for full details.

Device & Technical Data

Device identifier — a unique ID generated for your device and stored on it. Used to maintain your session, link your activity across app launches, and allow guest-mode use without a full account. This identifier is not linked to your name or email unless you sign in.
Device push notification token — collected only if you explicitly grant notification permissions. Used exclusively to deliver alerts and updates you have opted into. See the Push Notifications section for full details.
Usage and analytics events — screen views, feature interactions, button taps, and error events. Collected in aggregate to help us understand how features are used and to fix bugs. We do not build individual behavioural profiles from this data.
Crash reports — automatically generated if the app crashes. May include device model, operating system version, and a technical stack trace. Does not include personally identifiable information.

3. How We Use Your Information

We use the data we collect only for the purposes described in this policy. In summary:

To create and maintain your account and public profile.
To display your posts, comments, and fantasy team to other users of the platform.
To personalise Iris AI responses based on your risk profile, experience level, and investing goals.
To run fantasy scoring calculations based on real-time and end-of-day market performance data.
To operate country-based leaderboards that rank users within and across regions.
To deliver region-relevant financial news and content.
In the future, to serve country-targeted advertising to support the free tier of the app (see Advertising section).
To send push notifications you have opted into, such as price alerts, game summaries, and community activity.
To monitor app stability and diagnose and fix technical errors.
To understand how features are used in aggregate, helping us prioritise improvements.
To enforce our Terms of Service, including age verification and content moderation.
To comply with applicable legal obligations.

We do not use your data to make decisions with significant legal or similarly significant effects without human review (see the Automated Decision-Making section).

3a. User-Generated Content & Zero-Tolerance Policy

The Investing Circle is a community platform where users can post text, images, and other content ("User-Generated Content" or "UGC"). By posting content, you accept full responsibility for it and agree to the following rules, which are enforced with zero tolerance.

What Counts as Objectionable Content

The following types of content are strictly prohibited on The Investing Circle:

Hate speech — content that attacks, dehumanises, or promotes hatred of any individual or group based on race, ethnicity, national origin, religion, gender, sexual orientation, disability, or any other protected characteristic.
Harassment and abusive behaviour — targeted, repeated, or coordinated behaviour intended to intimidate, harm, or distress another user.
Sexually explicit material — explicit sexual content of any kind, including any content depicting or soliciting minors in a sexual context.
Content targeting minors — grooming, solicitation, or any attempt to exploit children or teenagers.
Illegal content — content that promotes, facilitates, or glorifies illegal activity, including fraud, market manipulation, insider trading, or any other securities violations.
Spam and coordinated manipulation — unsolicited promotional content, bot activity, fake accounts, pump-and-dump discussions, or any attempt to artificially influence market perception.
Content promoting violence or self-harm — content that encourages, glorifies, or instructs on violence against any person or group, or that encourages self-harm or suicide.

Zero-Tolerance Policy

Zero tolerance — no warnings for severe violations. Accounts found posting objectionable content will be immediately suspended or permanently banned, and the offending content will be removed — without notice and without appeal, except where required by law.

Consequences

Immediate content removal — objectionable content will be removed as soon as it is identified, regardless of how long it has been posted.
Account suspension or permanent ban — depending on severity, accounts may be temporarily suspended or permanently banned. Banned users may not create new accounts.
No prior warning required — we reserve the right to act immediately without prior warning for serious violations.
Reporting to authorities — where content involves illegal material (including child exploitation material), we will report it to relevant law enforcement and regulatory authorities.

How to Report Content or Abusive Users

If you encounter content or behaviour that violates these rules, flag it using the report option on any post or comment. For urgent reports involving illegal content, child safety concerns, or threats of violence, contact us directly at privacy@theinvestingcircle.com with the subject "Content Report". We will acknowledge reports involving urgent safety concerns within 24 hours.

Platform Moderation Rights

The Investing Circle reserves the right — and accepts the duty — to moderate all user-generated content at its sole discretion. We may remove, restrict, or take action against any content or account that we determine, in good faith, to be harmful, abusive, or in violation of these rules or applicable law. Moderation decisions are made by humans or with human oversight — automated tools do not alone result in account actions without review.

4. Cookies & Tracking

The Investing Circle is primarily a mobile app and does not use traditional browser cookies. However, we do use equivalent local storage mechanisms on your device:

AsyncStorage / SecureStore — used to persist your session token and preferences locally on your device so you remain logged in between app launches.
Device identifier — a locally generated and stored identifier used for session management and guest-mode functionality (described in more detail in the Information We Collect section above).

Our website (theinvestingcircle.com) may use session cookies for authentication and standard web analytics. We do not use third-party advertising cookies or cross-site tracking cookies at this time. If this changes, we will update this policy and, where required, seek your consent before doing so.

We do not use fingerprinting technologies, pixel trackers, or any form of covert device identification.

5. How Iris (AI) Data Is Handled

Iris is our AI assistant, powered by OpenAI's language models. When you send a message to Iris, the following happens:

Your message, along with a portion of your recent conversation history and your onboarding profile (experience level, goals, risk appetite), is transmitted securely to OpenAI's API over TLS to generate a response.
We store your Iris conversation history on our own servers so that Iris can maintain context within a session and across sessions. This history is linked to your account (or device identifier for guest users).
We may use aggregated, anonymised patterns from Iris conversations (e.g., common question topics) to improve prompt engineering and response quality. We do not share individual conversation transcripts with third parties for training or any other purpose.
OpenAI's data usage policy governs how OpenAI handles data transmitted to their API. As of this writing, OpenAI does not use API inputs to train their production models by default. We encourage you to review OpenAI's Privacy Policy directly.
If you delete your account, all Iris conversation history stored on our servers is permanently deleted within 30 days.
Iris responses are informational only and do not constitute financial advice. See the disclaimer at the top of this page.

We apply a usage limit to Iris to prevent abuse and manage infrastructure costs. This limit is tracked per device/account and resets periodically. No personally identifiable data is shared externally in connection with rate limiting.

7. Push Notifications

Push notifications are entirely opt-in. We will never send you a push notification without your explicit permission. Here is how notifications work:

Permission request — when you first set up price alerts or community notifications, the app will present your device's standard system permission dialog. Granting this permission allows us to obtain your device's push token from the Expo Push Notification service.
Token storage — your push token is stored on our servers and linked to your account. It is used exclusively to deliver notifications you have opted into. We do not share push tokens with third parties.
Types of notifications — we may send price alerts (when a stock you are watching crosses a threshold you set), daily game summaries, weekly fantasy results, and community activity updates (replies, likes). Each category can be individually enabled or disabled in the app settings.
Revoking permission — you can revoke notification permissions at any time through your device's system settings (iOS: Settings > Notifications; Android: Settings > Apps > Notifications). You can also disable specific notification categories within the app's notification settings screen.
Token lifecycle — if you uninstall the app, your push token becomes invalid and we will stop attempting to send notifications to it. If you reinstall and re-grant permission, a new token is issued and stored.

8. Fantasy Data

The Investing Circle includes a fantasy investing game where users pick stocks and compete against others based on real market performance. In connection with the fantasy game, we collect and use:

Stock picks and trade timing — the specific stocks you select for your fantasy portfolio, the prices at which you "buy" and "sell" within the game, and the timing of those decisions. This data is used solely to calculate your fantasy score and display your portfolio to you.
Game performance history — your historical scores, rankings, win/loss record, and streak data. This is used to populate leaderboards and your personal performance history.
Public profile visibility — your in-game portfolio and current rankings are visible to other users on leaderboards and your public profile. If you prefer more privacy, you can review your visibility settings within the app.
No real money — the fantasy game involves no real money, no brokerage integration, and no actual securities transactions. We do not collect payment information, brokerage credentials, or real portfolio data in connection with the fantasy game.

Fantasy performance data (your picks, scores, ranking history) is retained for as long as your account is active and is permanently deleted when you delete your account.

9. Advertising & Future Ad Plans

We want to be completely transparent about advertising:

Currently no ads — The Investing Circle does not currently show any advertising to users. There are no third-party ad networks integrated into the app at this time.
Future plans — to support the long-term sustainability of the free tier of the app, we may introduce country-targeted advertising in the future. If and when we do, advertising will be targeted based on your country of residence only — not on your browsing history, investment interests, age, or any other behavioural or sensitive attribute.
No personal data sales — we will never sell your personal data to advertisers or any other third party, under any circumstances. If we introduce advertising, we will serve ads directly (or through an ad network that we contractually prohibit from using your data for any purpose other than delivering the ad).
Opt-out — if and when advertising is introduced, Pro subscribers will not be shown ads. Free-tier users will have visibility into the types of ads being served and will have the ability to opt out of country-based targeting, resulting in non-personalised (run-of-network) ads instead.
Policy update — if and when we introduce advertising, we will update this policy with full details, provide notice through the app, and where legally required, seek your consent before doing so.

10. Third-Party Services

The Investing Circle uses the following third-party services to operate. We share data with each of them only to the minimum extent necessary:

OpenAI — powers the Iris assistant. Your chat messages and a limited context window of your conversation history are transmitted to OpenAI to generate responses. OpenAI's data usage policy applies to data sent via their API. We do not share your name, email, or other account identifiers with OpenAI.
Yahoo Finance, Finnhub, Twelve Data, Financial Modeling Prep — provide real-time and historical market data, earnings calendars, analyst estimates, and financial statements. No personal data is transmitted to these services; all requests are made server-side with anonymous API credentials.
Reddit API — used to fetch and analyse public post sentiment from finance-related subreddits (e.g., r/investing, r/stocks, r/wallstreetbets). No personal data is transmitted. We access only publicly visible posts.
StockTwits API — used to analyse public market sentiment signals from the StockTwits platform. No personal data is transmitted. We access only publicly visible content.
Sentry — used for crash and error reporting. Error reports are automatically generated when the app encounters an unexpected error and may include device model, operating system version, app version, and a technical stack trace. Sentry reports are carefully scoped to exclude personally identifiable information such as usernames, email addresses, or message content.
Google OAuth — used as an optional sign-in method. If you choose to sign in with Google, we receive your name, email address, and profile picture from Google. We request only these basic identity scopes and do not request access to Gmail, Google Drive, or any other Google service.
Apple Sign-In — used as an optional sign-in method on iOS. If you choose to sign in with Apple, we receive a stable user identifier and, optionally, your name and email (Apple may relay a private email address). We do not receive your Apple ID password or any other Apple account data.
Expo / React Native — the cross-platform framework used to build The Investing Circle. Expo's push notification service is used to deliver opt-in alerts to your device. Expo does not have access to your account data; it only processes the push token required to route a notification to your device.
Cloud hosting provider — our backend servers and database are hosted on a cloud infrastructure provider in the United States. The provider has access to server infrastructure but operates under strict data processing agreements and does not access application data.

11. Permissions We Request

The mobile app may request the following device permissions. Each permission is requested only when you first attempt to use the relevant feature:

Photo Library — to let you attach images from your camera roll to your posts. We access only the specific photos you explicitly select through the system picker. We do not scan or access your photo library in the background.
Camera — to let you take a photo directly within the app for use in a post. We do not activate the camera in the background or record video. Camera access is granted only while you are actively using the image capture feature.
Push Notifications — to send you price alerts, game summaries, and community updates. This permission is entirely optional and can be revoked at any time in your device settings. See the Push Notifications section above for full details.

Denying any of these permissions does not prevent you from using the core features of the app. You can grant or revoke permissions at any time through your device's Settings app.

13. Data Portability

You have the right to receive a copy of the personal data we hold about you in a structured, commonly used, machine-readable format. If you would like to request a data export, contact us at privacy@theinvestingcircle.com with the subject line "Data Portability Request". We will respond within 30 days.

A data export will typically include:

Your account profile information (name, username, country, experience level).
Your posts and comments.
Your fantasy game history (picks, scores, rankings).
Your price alerts and prediction history.
Your Iris conversation history (if stored).

Data exports do not include derived or inferred data (such as internal analytics metrics) that do not relate to information you directly provided.

14. Security Measures

We take the security of your personal data seriously and apply the following technical and organisational measures:

Encryption in transit — all communication between your device and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints and reject unencrypted connections.
Encryption at rest — all data stored in our database is encrypted at rest using AES-256 encryption managed by our cloud infrastructure provider.
Authentication tokens — user sessions are managed using cryptographically signed tokens. Sensitive credentials (such as session tokens) are stored in your device's secure keychain where available, not in plain local storage.
Access controls — access to production data is restricted to a small number of authorised team members on a need-to-know basis. All production access is logged.
Dependency management — we monitor our software dependencies for known vulnerabilities and apply security patches promptly.
Error handling — our API is designed to return minimal error information to clients to reduce information leakage. Detailed error data is logged server-side only.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that materially affects your personal data, we will notify affected users and relevant regulatory authorities as required by applicable law.

15. Automated Decision-Making

The Investing Circle does not use fully automated decision-making processes that produce legal or similarly significant effects on users. Specifically:

Iris responses — Iris uses AI to generate responses to your questions. These responses are informational only and have no legal or contractual effect on your account or rights.
Fantasy scoring — your fantasy game score is calculated automatically based on real market performance. This is a game mechanic and does not affect your legal rights or access to other features.
Content moderation — we may use automated tools to flag potentially abusive or harmful content for human review. No automated system alone will result in account suspension or content removal without human oversight.
Rate limiting — usage limits on certain features (such as Iris chat) are applied automatically based on your usage data and subscription level. These decisions are based on transparent, defined criteria described in our Terms of Service.

If you believe an automated decision has unfairly affected your account, contact us at privacy@theinvestingcircle.com to request human review.

16. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction governed by the General Data Protection Regulation (GDPR) or equivalent legislation, we process your personal data on the following legal bases:

Performance of a contract — we process your account information, content, and fantasy data to provide you with the service you have requested. This is the primary legal basis for most processing activities.
Legitimate interests — we process usage analytics, crash reports, and device identifiers to improve app performance, fix bugs, and ensure security. These interests are balanced against your privacy rights, and the data processed for these purposes is minimised and anonymised where possible.
Legal obligation — we may process or retain data where required to comply with applicable laws or court orders.
Consent — we rely on your consent for sending push notifications and, if introduced in the future, personalised advertising. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

For questions about the specific legal basis applied to any particular processing activity, contact us at privacy@theinvestingcircle.com.

17. Data Retention

We retain different types of data for different periods, based on what is necessary to provide the service and comply with legal obligations:

Account data — retained for as long as your account is active. If you delete your account through Settings > Delete Account, your profile, posts, comments, fantasy data, and Iris conversation history will be permanently deleted from our servers within 30 days.
Date of birth — retained alongside your account for age verification purposes and deleted when your account is deleted.
Push notification tokens — retained while your account is active and valid. Tokens that have been invalid for more than 90 days (e.g., because you uninstalled the app) are automatically purged.
Crash reports and logs — retained for 90 days, after which they are automatically deleted from our logging systems.
Analytics events — aggregated analytics data (from which no individual can be identified) may be retained indefinitely for product analysis purposes. Raw per-event data linked to a device identifier is retained for no more than 12 months.
Legal hold — if we are required to preserve data for legal proceedings, the applicable retention period will be extended for the duration of any legal hold. We will notify you as permitted by applicable law.

18. Age Requirements & Children's Privacy

Minimum Age

The Investing Circle is intended for users aged 13 and over. We do not knowingly permit children under 13 to create an account or use the service.

How the Age Gate Works

During the sign-up flow, all new users are required to enter their date of birth before they can proceed. Our server validates the entered date against the current date in real time. If the entered date of birth indicates the user is under 13 years of age, the registration flow is immediately blocked, an error message is displayed, and no account is created. No data entered by the blocked user is stored beyond the immediate session.

If a Child Bypasses the Age Gate

Despite our enforcement measures, a child could theoretically bypass our age gate by entering a false date of birth. If this occurs, the account may contain personal data belonging to a child under 13. If we discover or are notified that an account belongs to a child under 13, we will immediately suspend the account, delete all associated personal data from our servers within 72 hours, and where applicable report the matter to the relevant regulatory authority. We do not knowingly retain any data attributable to a child under 13.

COPPA Compliance

The Investing Circle does not direct its service at children under 13 and does not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA). Our age-gating mechanism and our commitment to promptly deleting any inadvertently collected data from under-13 users are key components of our COPPA compliance programme.

For Parents and Guardians

If you believe your child under the age of 13 has created an account on The Investing Circle — for example, by misrepresenting their date of birth — please contact us immediately at privacy@theinvestingcircle.com with the subject line "Child Account Removal Request". Please include as much information as possible (such as the username or email address associated with the account). We will investigate and delete the account and all associated data within 72 hours of verification.

Teens (Ages 13–17)

Users aged 13–17 are permitted to use The Investing Circle. We encourage parents and guardians to discuss the app's content with younger teens, particularly in relation to the fantasy investing game. The app does not provide financial advice, and no real money is involved in any feature of the platform. Younger users are especially encouraged to discuss any investing ideas generated by the app with a trusted adult before acting on them in real life.

19. International Users

The Investing Circle is operated from the United States. Our servers and primary infrastructure are located in the United States. If you are accessing the app from outside the United States — including from the European Economic Area, the United Kingdom, Canada, or Australia — your personal data will be transferred to, stored in, and processed in the United States or other countries where our third-party service providers operate.

The data protection laws in the United States may differ from those in your country and may not offer the same level of protection. By using the app, you acknowledge and consent to this international transfer and processing of your data.

Where we transfer personal data from the EEA or UK to countries that have not received an adequacy decision from the European Commission, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses to ensure adequate protection. For more information about the safeguards we use for international transfers, contact us at privacy@theinvestingcircle.com.

20. Your Rights

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal data. We will respond to all rights requests within 30 days of receipt.

Right of access — you have the right to request a copy of the personal data we hold about you and information about how it is used.
Right to rectification — you have the right to request correction of any inaccurate or incomplete personal data we hold about you. Many details (such as your display name, country, and experience level) can be corrected directly within the app's settings.
Right to erasure ("right to be forgotten") — you have the right to request deletion of your account and all associated personal data. You can initiate this directly in the app through Settings > Delete Account, or by contacting us. Deletion is permanent and completed within 30 days.
Right to data portability — you have the right to receive your data in a structured, machine-readable format. See the Data Portability section above.
Right to restrict processing — in certain circumstances (for example, while a dispute about data accuracy is resolved), you may request that we restrict the processing of your data.
Right to object — you have the right to object to processing based on our legitimate interests. We will stop such processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent — where we rely on your consent as the legal basis for processing (such as for push notifications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Right to lodge a complaint — if you are in the EEA or UK and believe we have processed your data in violation of applicable law, you have the right to lodge a complaint with your local supervisory authority (such as the ICO in the UK, or your national DPA within the EEA).

To exercise any of these rights, contact us at privacy@theinvestingcircle.com. We may request proof of identity before processing a rights request to ensure we are responding to the correct individual.

21. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our services. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Display a notice within the app informing you that the policy has changed.
Where the change requires your consent (for example, a new category of data use), we will seek that consent before the change takes effect for your account.

Continued use of The Investing Circle after a policy change takes effect constitutes your acceptance of the updated policy. If you disagree with the changes, you may delete your account at any time.

22. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a concern about a child under 13, please contact us at:

privacy@theinvestingcircle.com

We aim to respond to all privacy-related inquiries within 5 business days and to all formal rights requests within 30 calendar days.

23. Glossary

The following key terms are used throughout this policy:

Personal data — any information that relates to an identified or identifiable individual (e.g., your name, email address, device identifier).
Processing — any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
Data controller — the entity that determines the purposes and means of processing personal data. For the purposes of this policy, The Investing Circle is the data controller.
Data processor — a third party that processes personal data on behalf of the data controller (e.g., our cloud hosting provider, OpenAI).
GDPR — the General Data Protection Regulation (EU) 2016/679, a comprehensive data protection law applicable to users in the European Economic Area and, via the UK GDPR, users in the United Kingdom.
COPPA — the Children's Online Privacy Protection Act, a US federal law that imposes requirements on online services directed at children under 13.
TLS — Transport Layer Security, a cryptographic protocol used to encrypt data transmitted over the internet.
Push token — a unique identifier issued by a device's operating system (iOS or Android) that allows our servers to route push notifications to your specific device.
Device identifier — a locally generated unique string stored on your device, used to identify your session without requiring a full account. Not the same as your device's hardware serial number.
Iris — The Investing Circle's AI assistant, powered by OpenAI's language models.
Aggregated data — data that has been combined and summarised across multiple users in a way that no individual can be identified from it.
Anonymised data — data from which all personally identifying information has been irreversibly removed, such that re-identification is not reasonably possible.