Privacy Policy

Welcome to PSX Portfolio Manager ("we", "our", "us", or "the Application"). We value your digital privacy and trust above everything else. This Privacy Policy outlines how our mobile application handles, stores, and protects your data when you track your Pakistan Stock Exchange (PSX) investments, analyze financial reports, calculate taxes, and consult our artificial intelligence utilities.

1. Information We Handle and How It Is Stored

Our application architecture prioritizes local device execution and strictly limits external data transmission:

A. Local Portfolio & Financial Data Stored Offline

• What is collected: Stock holdings, transaction histories, purchase prices, dividend records, zakat deductions, cash flows, notes, and custom tagging.
• How it is stored: All financial and portfolio records are persisted entirely offline within an encrypted local database on your Android device using SQLite / Room. This data is not automatically transferred to any third-party marketing servers.

B. AI Credentials & API Tokens Hardware Encrypted

• What is collected: API tokens for whichever AI provider you choose — Google Gemini, OpenAI, or Anthropic (Claude) — supplied by you for personalized AI financial summaries. A key is stored separately for each provider, and only the provider you have selected is ever contacted.
• How it is stored: API keys are isolated from unencrypted storage and saved using Android Keystore and AES-256 GCM/SIV EncryptedSharedPreferences. Keys remain strictly on your local device hardware and are only transmitted over secure HTTPS directly to the endpoint of the provider you selected, during live inference requests.

C. Cloud Backup (Optional User-Controlled Feature)

• Google Sign-In & Google Drive: If you choose to enable automated or manual cloud backups, the app asks for authorization to link with your personal Google account.
• Data Ownership: Backup archives (containing your SQLite portfolio JSON/db schema) are placed strictly into your personal Google Drive account. We do not maintain administrative access to view or decrypt your personal drive backups.

2. Third-Party Integrations and Network Traffic

In order to offer real-time market insights and AI capabilities, the Application interacts with the following vetted third-party services via strict HTTPS encryption (TLS 1.2+ and certificate pinning):

• Pakistan Stock Exchange (PSX) Market Data: Periodic HTTP requests are initiated to fetch public market closing tickers, historical price feeds, and sector benchmarks. No personal portfolio data is attached to these market data pull requests.
• AI provider APIs (Google Gemini, OpenAI, or Anthropic): When you execute AI commands (e.g., portfolio risk summaries or Learn Centre queries), your prompt — which may include holdings, valuations and profit or loss figures — is transmitted directly to the provider you selected in Settings. No AI request is made unless you have supplied a key and chosen a provider. Please review that provider’s own privacy notice regarding data retention for large language models.
• World Bank Open Data: The depreciation calculator refreshes Pakistan’s consumer price index from the World Bank’s public API. This is an anonymous read of published statistics; no portfolio or personal data is sent.
• Google Firebase Diagnostics (Analytics & Crashlytics): To maintain system resilience and eliminate bugs, anonymized diagnostic reports (stack traces, operating system versions, device models, and general crash occurrences) may be collected. No sensitive portfolio records, passwords, or personal keys are ever included in diagnostic crash logs.

3. Google Play Data Safety & Compliance

In accordance with Google Play developer policies and OWASP Mobile Security best practices, we assure you that:

• Encryption in Transit: All incoming and outgoing network communications are strictly enforced via custom network security protocols preventing unencrypted cleartext interception.
• Data Minimization: We only request permissions and process data strictly essential to financial portfolio tracking and calculations.
• No Advertising Trackers: The app contains no third-party ad networks or cross-app behavioral tracking SDKs.

4. Your Control, Deletion, and Data Rights

You maintain complete operational control over your data at all times:

• Local Data Wipe: You can completely eliminate all stored portfolio records and API keys instantly by tapping "Clear Data" within your Android Settings or by uninstalling the application.
• Cloud Backup Deletion: You may navigate to your Google Drive management interface at any time to delete stored backup files or revoke application OAuth credentials.
• Biometric & App Lock Control: PIN and Fingerprint biometric authentication gating can be activated, modified, or disabled directly within the internal application Settings screen.

5. Children's Privacy

Our application is intended for adult individual investors and hobbyists interested in financial education and wealth management. We do not knowingly solicit or collect personal identifiable information from children under the age of 13. If a parent or guardian becomes aware that a minor has submitted personal data without authorization, simply uninstall the application to erase all local data traces.

6. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect architectural upgrades, additional AI functional features, or evolving regulatory compliance standards in Pakistan and international app marketplaces. Updates will be manifested through revised effective dates and published alongside formal releases on our official distribution channels.

7. Contact & Support

If you have questions, concerns, or requests regarding this Privacy Policy, security certifications, or data handling practices, please contact our support desk:

Email Support: binarynotesweb@gmail.com