Inve India ▾

Privacy Policy

Last updated: October 25, 2026

This Privacy Policy applies to the website inve.money and the Inve Money Android mobile application (package money.inve) distributed via Google Play (collectively, the "App"). This policy explains how information is collected, used, disclosed, and safeguarded when you use the App.

The App is operated by InveWise Technologies LLP, a Limited Liability Partnership registered in India at Flat B 307, B Block, Adithya Frondoso Apt, Vartur, Bangalore South, Bangalore - 560087, Karnataka, India. InveWise Technologies LLP is the data fiduciary responsible for the personal data described in this policy.

1. Information We Collect

a) Personal Information

When you register or use the App, we may collect:

  • Phone number in E.164 format (e.g. +91XXXXXXXXXX). This is the primary sign-in identifier; a one-time SMS verification code is sent via Google Firebase Authentication and only the verified number is stored. The SMS content itself is never received or stored.
  • Name and email address (if provided in your profile)
  • Date of birth (if provided)
  • PAN card number (if provided for portfolio verification)

b) Financial Information

To provide portfolio analysis, we may collect:

  • Stock holdings data (ticker symbols, quantities, average buy prices) imported via CSV upload
  • Portfolio risk profile and preferences

No broker login credentials are collected or stored.

c) Usage Data

  • Pages visited, features used, and interaction patterns
  • When a signed-in account opens the Pro offer in the App or leaves the App to buy Pro, and where in the App that happened
  • Device information, browser type, and IP address
  • API usage logs for rate limiting and service improvement

d) Mobile App Data

  • App version, Android OS version, and device model
  • Crash and stability logs (no personally identifiable content)
  • Play Integrity tokens — short-lived attestations issued by Google Play Services that verify the app installation is genuine. Used only to prevent fraud and abuse; not linked to user identity.
  • The Android device ID and, once you sign in, your account ID, plan and region, together with recordings of how the app's screens are used (Microsoft Clarity, see Section 3)
  • On phones set to India's time zone only: the Android advertising ID and the fact that the app was installed, opened, or signed in to for the first time (Meta, see Section 3)

e) Connected AI Apps (MCP)

You can connect your account to an AI app that supports the Model Context Protocol (MCP), such as ChatGPT, Codex, Claude or Gemini CLI, so that the app can look up companies, list earnings-call dates, read stored earnings-call analysis and management guidance, and check your monthly usage on your behalf (see how to connect Inve to Claude). A connection exists only after you sign in on the inve.money consent page and choose Approve; signing in alone approves nothing. When you connect, the following is recorded:

  • The authorization you gave: your account, the app, the access you approved (shown on the consent page before you decide), and when it was approved, when it expires and whether it was revoked.
  • The connection request itself while you decide: the app, its return address, the request's state value and PKCE code challenge, one-way hashes of the request link and of a cookie that ties the request to your browser, and your decision.
  • The app's access and refresh tokens. These are never stored in readable form: only a one-way signature of each is kept, with when it was issued, when it expires and whether it was used or revoked.
  • One usage record for each call analysis or guidance read that uses a credit: which kind of read it was, the market, that it came through a connected app and which one, the credits spent and when.

These records are used to let the app read research for you, to enforce your plan's monthly allowances, which are shared with the website and the Android app, to show you which credits were used through a connected app, and to detect and stop reuse of stolen tokens.

The app you connect receives what its tool requests return: company research data, and your credit usage (your plan and its allowances, credits used and remaining, the reset date and the split between connected apps and the website and app). Your phone number, name, email address, PAN and portfolio holdings are not part of these results. Inve receives only the app's tool requests, such as a company name or ticker to look up, and not the rest of your conversation. The app and its provider (for example OpenAI for ChatGPT and Codex, Anthropic for Claude, or Google for Gemini CLI) handle what they receive under their own privacy policies.

A connection lasts at most 30 days from your approval, after which the app has to ask you to approve again. Within a connection, each access token is valid for 10 minutes and the app renews it with a refresh token; the connection stops working sooner if the app does not renew it for 7 days. You can deny a request on the consent page, disconnect Inve in the app's settings, or email info@inve.money to have every connection to your account revoked. Once a connection has expired or been revoked, the app can make no further requests to Inve; results it has already received stay with the app.

Neither expiry nor revocation deletes the records above. Records linked to your account are retained and deleted under Section 5, like the rest of your account data. Some unanswered connection requests have no account linked to them.

Separately, dedicated review accounts that Inve creates for app-platform reviewers sign in on the consent page with a login and password instead of a phone number. For these accounts the password is stored only as a one-way hash, and each sign-in is a short-lived record tied to one connection request.

2. How We Use Your Information

Collected information is used to:

  • Provide, maintain, and improve portfolio analysis features
  • Generate risk analysis reports, red flag detection, and earnings call summaries
  • Process subscription payments and manage your account
  • Send service-related communications (account alerts, updates)
  • Monitor and enforce usage limits based on your subscription plan
  • Ensure security and prevent fraud or abuse
  • Understand how the App is used, so it can be improved
  • Measure which of our advertisements lead to sign-ups and app installs

3. Data Sharing and Disclosure

Your personal or financial data is never sold. Apart from AI apps you choose to connect (see the end of this section), information is shared only with the following sub-processors acting under standard data-processing agreements:

  • Google Firebase Authentication: Sends the SMS one-time password and issues a verified identity token used to create your account. Receives only the phone number entered during sign-in.
  • Google Play Integrity API: Verifies that the Android app install is genuine, to prevent fraud and account takeover. Does not receive personal data.
  • Razorpay: Processes subscription payments. Card and bank details are entered into Razorpay's hosted checkout and never reach the App's servers.
  • AI service providers (Anthropic, Google Vertex AI): Anonymized or aggregated portfolio data is sent to generate analysis. Phone numbers, email addresses, and PAN are never included in these requests.
  • Hosting providers: The website is served by Vercel and the backend API runs on Railway. Both providers process data on behalf of the App only.
  • Google Analytics: Receives which pages were viewed and when. No account content and no personal identifiers are sent.
  • Microsoft Clarity: Records how pages and app screens are used (taps, clicks, scrolls and the pages or screens viewed) so the App can be improved, along with the browser and device type, the device's timezone and a pseudonymous visitor id. On the website, on a browser's first visit from outside Europe, that id is derived from technical characteristics of the device (browser type, screen, language, timezone and how it draws a test image) so the same device is recognised when it returns; once you sign in, it is derived from a one-way hash of your account number. In the Android app it receives the Android device ID and, once you sign in, your account ID, plan and region, so a session can be matched to a reported problem. Your phone number, email, holdings and analysis are never sent.
  • Reddit Ads: Receives an advertising measurement signal when an account is created, a broker account is connected, or a subscription starts — so advertising spend can be attributed. What is sent is limited to the page URL, the name of the action, the number of holdings imported, the subscription amount and id, the Reddit click identifier from the ad you arrived through, and your IP address and browser user-agent. Some of these are reported from our server rather than your browser, so that ad-blocking does not distort the count. Your holdings themselves, your phone number, your PAN, and your analysis are never sent. This applies to the website only, not the mobile app.
  • Google Ads: Receives a conversion signal when an account is created on the website, with the Google click identifier from the ad you arrived through, so advertising spend can be attributed. Website only.
  • Meta (Facebook and Instagram ads): Meta's app-events SDK in the Android app reports that the app was installed and opened, that an account signed in on that phone for the first time, that the reader chose to explore without signing in or finished choosing companies to follow, which company pages and call analyses were opened (the company ticker and quarter), that the reader opened a full guidance ledger for the first time on that phone and when they had opened three different ones (only the count is sent, not the companies), and that the reader left the app for inve.money to buy Pro, together with the Android advertising ID, the ad that led to the install, your IP address and basic device information (such as model, Android version, language and app version). This measures which of our Facebook and Instagram ads lead to installs, sign-ins, reading and purchases. It runs only on phones set to India's time zone; from any other phone nothing is sent to Meta. Your phone number, name, account ID, holdings and analysis are never sent. You can reset or delete the advertising ID in your phone's Google settings.
  • Google Firebase Remote Config: Lets the Android app fetch settings at launch. Receives a random identifier for the app installation and basic device information, never account data.
  • Legal requirements: When required by law, regulation, or valid legal process.

AI apps you connect: If you approve a connection through MCP, that app and its provider receive the results of the requests it makes on your behalf, as described in Section 1(e). They handle what they receive under their own privacy policies.

4. Data Security

Industry-standard security measures are implemented, including:

  • HTTPS encryption for all data in transit
  • Encrypted storage for sensitive tokens
  • Content Security Policy (CSP) headers and XSS protection
  • Token-based authentication with automatic session invalidation

No method of electronic transmission or storage is 100% secure, and absolute security cannot be guaranteed.

5. Data Retention and Account Deletion

Personal data is retained for as long as your account is active or as needed to provide the App's features. To request deletion of your account and all associated data (phone number, holdings, risk profile, and usage logs):

  • Email info@inve.money from the phone number or email address registered on your account, with the subject line "Account Deletion Request".
  • Receipt is acknowledged within 2 business days and deletion is completed within 7 business days.

Anonymized aggregate analytics (no personally identifiable content) may be retained for service-improvement purposes.

Full details — what is erased, what is retained, and how long it takes — are on the Delete your account page.

6. Cookies and Tracking

Essential cookies and local storage are used for authentication (auth tokens) and user preferences. The website also loads Google Analytics, Google Ads, Microsoft Clarity and a Reddit advertising pixel, which set their own identifiers to recognise a returning browser and attribute advertising. None of these website tags is loaded in the mobile app. The Android app uses Microsoft Clarity and, on phones set to India's time zone, Meta's app-events SDK. Section 3 sets out exactly what each one receives.

7. Third-Party Links

The App may contain links to third-party websites (e.g., stock exchanges, broker platforms). No responsibility is assumed for the privacy practices of these external sites.

8. Children's Privacy

The App is not intended for users under the age of 18. Personal information from minors is not knowingly collected. If you believe such information has been collected, please contact us immediately.

9. Your Rights

You have the right to:

  • Access and review the personal data held about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Opt out of non-essential communications

To exercise any of these rights, contact: info@inve.money.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance of the revised policy.

11. Contact

For questions about this Privacy Policy:

InveWise Technologies LLP
Flat B 307, B Block, Adithya Frondoso Apt
Vartur, Bangalore South, Bangalore - 560087
Karnataka, India
Email: info@inve.money
Website: inve.money