Privacy Policy

Orwin is a portfolio tracker that lives on your iPhone. Your transactions, holdings, watchlist, and settings stay on your device and in your own iCloud. Our servers never store them.

The app talks to two services we run: one for market data, one for connecting your brokerage through SnapTrade. Both know your phone only by an anonymous identifier. There are no accounts, no names, no emails. The app also sends us anonymous usage counts and crash reports, which you can turn off.

This Privacy Policy (the "Policy") describes how Finn Financial LLC ("Finn Financial", "we", "us"), a Washington limited liability company based in Spokane, Washington, collects, uses, discloses, and retains information in connection with the Orwin iOS application (the "App"), the website at finnfinancial.co (the "Site"), and the backend services that support the App (the "Backend", and together the "Services"). It does not apply to third-party services you reach through the Services, such as your brokerage, SnapTrade's portal, or Apple, each of which has its own privacy terms.

Portfolio data you enter or import (transactions, holdings, portfolios, watchlists, tool inputs, and settings) is stored on your device and, where you are signed in to iCloud, in your private iCloud storage. We do not store portfolio data on the Backend. The Backend identifies devices only by the pseudonymous identifier described in Section 3 and collects no names, email addresses, Apple IDs, or payment details.

Everything you put into Orwin stays on your iPhone: your transactions, holdings, and portfolios (including cash and crypto), your watchlist, your settings, what you type into the tools (the FIRE projection asks for a birthdate, a retirement age, and yearly spending; Tax-Smart Sell asks for tax settings), and cached market data so the app opens fast. iOS encrypts it all.

If you are signed in to iCloud, the same data syncs to your own private iCloud so your other devices match. That runs through Apple. We cannot see it. Turn it off for Orwin in iOS Settings under your name and iCloud.

Two small items live in your iPhone's Keychain: the anonymous identifier our servers gave you, and the ID of the key your phone uses to prove it is really Orwin calling. No brokerage passwords, ever.

The App stores locally, protected by iOS Data Protection: transactions, holdings, and portfolios, including cash and cryptocurrency positions; watchlist and recently compared symbols; inputs to analytical tools, including date of birth, target retirement age, and annual spending for the FIRE projection and tax parameters for Tax-Smart Sell; balances and pending imports from a linked brokerage; settings; and cached market data, news, company information, and logos.

Where the device is signed in to iCloud, the App synchronizes transactions, portfolios, watchlist, and settings, including tool inputs, together with the usage-and-crash-report preference and the pseudonymous identifier, to your private iCloud storage, which Apple operates under its own terms and which we cannot access. You may disable synchronization for the App in iOS Settings.

The App stores in the iOS Keychain the pseudonymous identifier and the identifier of the device's App Attest key. It does not store brokerage credentials. Deleting the App removes local data, though Keychain items may persist, and does not remove iCloud copies or the Backend records described in Sections 3 to 6.

Orwin has no accounts. Instead, your iPhone creates a key inside its Secure Enclave using Apple's App Attest, Apple vouches that it belongs to a genuine copy of the app, and our servers hand your phone a random identifier. Every request your phone makes carries that key's signature so we know it is really Orwin and not a script.

The identifier names no one. Apple does not tell us your Apple ID, and we never ask who you are. It can be tied to your device, though, so we treat it as personal data and delete it when you delete your data.

On first launch the App generates a key in the device's Secure Enclave using Apple App Attest, and the Backend issues a randomly generated user identifier (the "User ID"). The User ID is stored in the Keychain and in your iCloud so that your other devices can share it. Each request to the Backend carries the key identifier and a signed assertion, which the Backend verifies.

For each User ID the Backend stores a user record and, for each device, the key identifier, its public key, creation and last-used times, and, if you enable Daily Recap, the notification data in Section 6. If you subscribe to Orwin Pro, the Backend also stores a randomly generated account token for your User ID. The App passes it to Apple with your purchase so that Apple's notifications about the subscription can be matched to your record. These identifiers are not linked to a name, email address, Apple ID, or payment instrument. Because they can be associated with a device, we treat them as pseudonymous personal data where applicable law so requires.

Market data. When the app needs a price, chart, fundamentals, news, or search results, it sends the ticker symbols involved, a date range, and the text you typed into search. Never a quantity, cost, or dollar value. We know the tickers you look at are usually the tickers you own, so we do not keep a list of them per device.

Brokerage. If you link a brokerage, our brokerage service fetches your holdings, balances, and transactions from SnapTrade and passes them to your phone without storing them. What it keeps is your anonymous identifier and an encrypted credential that lets us ask SnapTrade for your data.

Subscriptions. If you subscribe to Orwin Pro, our brokerage service keeps a short record of it from Apple: its transaction number, which plan it is, and when it renews or ends. Apple tells us when it changes, so brokerage linking switches on and off at the right time. We never see your Apple ID, your name, or what you paid.

Logs. Like any web service, ours keep request logs for about 30 days for debugging and security. They can include the address a request came from, the web address it asked for (which can contain ticker symbols or search text), and your anonymous identifier. They never include holdings, quantities, or amounts.

Market data service

Requests contain ticker symbols, date ranges or intervals, free-text search queries, and the authentication data in Section 3. They do not contain quantities, cost basis, valuations, or portfolio composition beyond the symbols requested. The service stores market data by symbol, which is not associated with any user, and does not store per-device symbol lists or search queries. Our hosting provider may cache responses for up to one day.

Brokerage linking service

Where you have linked a brokerage, the service retrieves account, holding, balance, and transaction data from SnapTrade on request and returns it to your device without persisting it. Account numbers are masked before they reach the device. The service stores the User ID, a SnapTrade user identifier, an encrypted SnapTrade credential, and a status indicator for each connection that SnapTrade updates by notification.

Subscription records

Where you subscribe to Orwin Pro, the Backend stores, for each subscription, Apple's original transaction identifier, the product, whether it was bought in Apple's production or test environment, its state, its expiry, grace period and end dates, and the User ID that most recently presented it. The App sends a transaction signed by Apple, Apple sends signed notifications when the subscription changes, and the Backend asks Apple's App Store Server API for the subscription's current status. The Backend does not receive or store your Apple ID, name, payment method, price paid, or storefront, and does not log Apple's notifications.

Logs and IP addresses

The Backend and our hosting provider keep request logs for approximately 30 days for debugging, security, and abuse prevention. Logs may include the client IP address, the request path and parameters (which may contain ticker symbols or search text), timing and status information, the identifiers in Section 3, and the SnapTrade user identifier. Logs do not contain holdings, quantities, or monetary amounts. IP addresses are also kept for about two days to limit how often a device may register.

Brokerage linking is part of Orwin Pro and is powered by SnapTrade. You sign in with your broker on SnapTrade's page, in Apple's secure sign-in sheet. Orwin never sees your broker username or password.

SnapTrade keeps the connection to your broker and gives us the accounts, holdings, and transactions you chose to share. The app refreshes them when you ask and once a day in the background. SnapTrade has its own privacy policy.

Disconnect a brokerage in the app and the link is revoked at SnapTrade. If your Pro subscription ends, our servers delete your SnapTrade user and our stored credential 7 days later, after checking with Apple, whether or not you still have the app. If a payment fails, Pro carries on through Apple's 16-day grace period first, and subscribing again before the 7 days are up keeps everything as it is. Either way, transactions already in your portfolio stay on your phone.

Brokerage connectivity is available to Orwin Pro subscribers and is provided by SnapTrade. To link a brokerage, the App opens SnapTrade's connection portal in an Apple authentication session, and you authenticate with your brokerage there. Brokerage credentials are not transmitted to, received by, or stored by the App or the Backend. SnapTrade's processing of your information is governed by SnapTrade's privacy policy.

A SnapTrade user is created for your User ID, under a randomly generated SnapTrade identifier, on the first link. The App requests refreshes when you act and once per day through iOS Background App Refresh. Disconnecting a connection revokes the corresponding authorization at SnapTrade, and where no connections remain the SnapTrade user and stored credential are deleted within about a day, as they are when no connection is completed within 24 hours of opening SnapTrade's portal. If your Orwin Pro subscription ends, including at the end of any billing grace period, the Backend deletes the SnapTrade user and stored credential 7 days later, once Apple's App Store Server API confirms the subscription has not been renewed. This happens whether or not the App is installed. Previously imported transactions remain on your device.

If you allow notifications, Orwin sends two kinds, both on by default and each switchable off in Settings. Daily Recap is a short, generic note after the markets close about the benchmark you picked. It is sent from our servers, so while notifications are allowed we keep your Apple push token, your Daily Recap choice, and your benchmark with your device record. Transaction Alerts are created on your phone after a brokerage sync. Decline notifications in iOS and nothing is sent to us.

The App requests notification permission at launch. Where permission is granted, two notifications are enabled by default and may each be disabled in the App. "Daily Recap" is a remote notification delivered through the Apple Push Notification service after market close with a generic message about your selected benchmark. While notification permission is granted, the App sends your Apple push token, the Daily Recap preference, and the selected benchmark symbol to the Backend, which stores them with your device record and removes the token when Apple reports it invalid or the device record is deleted. Notification content does not include holdings. "Transaction Alerts" are local notifications generated on the device.

Orwin sends us anonymous usage counts and crash reports so we can see what gets used and fix what breaks. This is on by default. Turn it off in the app under Settings, Privacy, Usage & Crash Data, and the choice syncs to your other devices.

A report says things like "a tool was opened" or "the app crashed here", with numbers rounded into ranges, plus your device model and iOS version. It never contains a ticker, quantity, price, amount, search text, broker name, or anything that identifies you, and we test that on every build. Reports go to a crash-reporting service in the United States and are deleted after 90 days.

The App sends usage events and crash and performance diagnostics to Sentry, a crash-reporting service in the United States. Collection is enabled by default and can be disabled in the App under Settings, Privacy, Usage & Crash Data; the preference synchronizes through iCloud. Reports consist of event names, bucketed counts, stack traces, application state at the time of failure, launch and hang durations, and device model and operating system version. They do not contain ticker symbols, quantities, prices, monetary amounts, search text, brokerage names, the identifiers in Section 3, or IP addresses. Sentry assigns each installation a random session identifier that is removed when the App is deleted.

The Backend reports server-side errors to Sentry with the route, error message, stack trace, and related request details, together with performance data for a sample of requests. Sentry retains reports for 90 days. We use them solely to operate and improve the Services.

We do not sell or share your information, but a few companies help us run Orwin: Apple (iCloud, notifications, device attestation, the App Store), a hosting provider and a database provider for our two services, SnapTrade for brokerage links, a market data provider, a company logo provider, and a crash-reporting provider. The legal text names each one. All of them process data in the United States, and each sees only what the sections above describe.

Two of them see something worth knowing. The market data provider receives the tickers and search text the app asks about, but nothing about your device. The logo provider serves logos straight to your phone, so, like any image on the web, it sees your IP address and the ticker.

We disclose information to the following providers, each of which processes only what is needed to provide its service:

• Apple Inc. App Attest, iCloud, the Apple Push Notification service, and App Store purchases, under Apple's own terms.
• Vercel Inc. Hosting, caching, scheduled jobs, and request logs for the Backend and the Site.
• Supabase, Inc. The database holding the Backend records in Sections 3 to 6, hosted on Amazon Web Services in the United States.
• SnapTrade. Brokerage connectivity, under its own terms.
• Tiingo. Market data, news, and symbol search. Tiingo receives ticker symbols, date ranges, and search text, and no device or user identifier.
• ELBStream. Company logo images, which your device retrieves directly, so ELBStream receives your IP address and the requested symbol.
• Sentry (Functional Software, Inc.). Usage and crash reporting, in Sentry's United States data region.
• Google LLC. Web fonts on the Site, and feedback forms linked from beta builds of the App, which receive data only if you submit a form.

The Services are operated from the United States and Backend data is stored and processed there. If you use the Services from elsewhere, your information is transferred to and processed in the United States.

• No ads, no sponsored content, no affiliate links.
• No selling or sharing your data for marketing, to anyone.
• No tracking. No advertising ID, no device fingerprinting, no following you between apps, no analytics SDKs beyond the crash reports above.
• No accounts. No email, no password, no social sign-in.
• No permissions we do not need. Only notifications (if you allow them), Face ID (if you lock the app; the check never leaves your phone), and Background App Refresh (for the daily brokerage sync). No camera, contacts, location, photos, or health data.
• No kids. Orwin is for people 18 and older, and we do not knowingly collect information from anyone under 13.

The Services do not display advertising or affiliate content; do not sell, rent, or disclose personal information for marketing or advertising; do not access the Apple advertising identifier, request App Tracking Transparency permission, or fingerprint devices; do not include analytics SDKs beyond the crash-reporting provider in Section 7; and do not offer or require user accounts.

The App requests only notification permission (Section 6), Face ID for the optional app lock, with biometric matching performed by iOS on the device, and Background App Refresh for the daily brokerage synchronization (Section 5). It does not request access to the camera, microphone, contacts, location, photo library, calendars, or health data.

The Services are intended for individuals aged 18 and over. We do not knowingly collect personal information from children under 13 and will delete any such information we learn we have collected. Parents or guardians may contact us at the address in Section 11.

You are always in control. In the app you can:

• Turn off usage and crash reports (Settings, Privacy, Usage & Crash Data).
• Turn off either notification, or decline notifications for the app in iOS Settings.
• Disconnect a brokerage.
• Delete All Data, at the bottom of Settings. It clears your iCloud copy, deletes your anonymous account, your device records, and your SnapTrade user from our servers, and clears your data from the app. Do it while signed in to iCloud so the iCloud copy goes too.

What we hold on our side lives only as long as it is needed: your anonymous account until you delete it (accounts with no active subscription or brokerage link that have been inactive for about 180 days may be removed), brokerage credentials until you disconnect or 7 days after Pro ends, subscription records until 90 days after the subscription ends, your push token while notifications are allowed, logs for about 30 days, crash reports for 90 days. Everything on your device and in your iCloud is yours until you delete it.

We cannot tell which anonymous identifier is yours, so requests to see or delete your data are handled from inside the app. Email privacy@finnfinancial.co and we will walk you through it.

Controls

In the App you may disable usage and crash reporting (Settings, Privacy, Usage & Crash Data); disable either notification in the App or decline notification permission in iOS; disconnect brokerage connections; and perform "Delete All Data", which deletes the App's data from your iCloud storage when the device is signed in to iCloud, deletes your SnapTrade user and your User ID record with its device records from the Backend, and removes your data from the device. Deleting the App removes local data only. iCloud synchronization is controlled in iOS Settings.

Retention

• Data on your device and in your iCloud: until you delete it.
• User ID and device records: until you delete all data. Records with no active Orwin Pro subscription and no linked brokerage that have been inactive for approximately 180 days may be removed automatically.
• SnapTrade user and credential: until you disconnect your last brokerage, delete all data, or 7 days after an Orwin Pro subscription ends (after any billing grace period).
• A record that a SnapTrade user was removed, with its SnapTrade identifier, the reason and the dates, but no credential: 90 days.
• Subscription records: until 90 days after the subscription ends. If you delete all data while a subscription is still active, the record is unlinked from your User ID and deleted 90 days after the subscription ends.
• Push token and notification preferences: while notification permission is granted, until Apple reports the token invalid or the device record is removed.
• Request logs: approximately 30 days.
• Usage and crash reports: 90 days.
• Market data indexed by symbol, which is not personal information: indefinitely.

Deleted data may persist briefly in provider backups until those backups expire.

Your rights

Where applicable law grants rights of access, correction, deletion, portability, or objection, you may exercise them through the controls above or by contacting us. Because the Backend holds no names or contact details, we generally cannot locate your records from a request made outside the App and will assist you in exercising your rights from within it. We do not discriminate against anyone for exercising privacy rights.

finnfinancial.co is a static site with no cookies and no analytics. It loads its fonts from Google Fonts, so Google sees your IP address when a page loads. The plain-or-legal choice on this page is remembered in your own browser and never sent to us.

If we change anything material here, we will update the date at the top and give you notice before it takes effect. Questions, complaints, or just curious? Email privacy@finnfinancial.co. A real person answers, usually within two business days.

The Site is a statically generated website hosted by Vercel. It sets no cookies and includes no analytics or tracking scripts. It loads web fonts from Google Fonts, in the course of which Google LLC receives your IP address and browser request headers under Google's privacy policy. The reading-mode preference on the legal pages is stored in your browser's local storage and is not transmitted to us. Email correspondence is retained for as long as needed to resolve your inquiry and used for no other purpose.

We may amend this Policy from time to time. Amendments take effect when posted on the Site with an updated date. For material changes affecting how we collect or use personal information, we will provide notice in the App or by other reasonable means before they take effect.

Questions or complaints regarding this Policy may be directed to Finn Financial LLC at privacy@finnfinancial.co.