Privacy policy

1. Scope and contact

AQX LLC operates Thesis, a social investing app. This policy describes how Thesis handles information when you use the app, a public Thesis receipt, or these legal pages. Questions, privacy requests, and deletion requests can be sent to [email protected].

When you write to us, we receive and keep your email address, anything you choose to tell us in the message, and a record of the request and how it was resolved. We keep those support and request records so we can verify who is asking, act on the request, and show that we acted on it.

2. Information Thesis handles

Thesis handles the following categories of information to operate the service.

Account and identity information

Phone number for one-time-code sign-in; identity tokens and, when a sign-in provider supplies them, name and email from Apple or Google; and the profile handle, display name, bio, and avatar you choose.

Portfolio and connection information

Linked brokerage connection status, holdings, balances, position values, manual asset entries, and portfolio settings. Thesis does not ask for or store brokerage usernames or passwords; a linked provider authorization is handled through SnapTrade.

Content and social activity

Theses, revisions, comments, verdicts, tags, follows, direct messages, notifications, receipts, and any profile photo or exhibit image you choose to upload. Public visibility is controlled by the feature and privacy setting that applies to that content.

Device, notification, and app activity information

An Expo push token after you grant notification permission; a persistent analytics device identifier and a rotating analytics session identifier; notification preferences; and automatic app and device context such as app version and build, device manufacturer and model, device type, operating-system name and version, and screen dimensions. App activity covers a limited, named set of interactions: publishing, revising, and closing a thesis; casting a verdict and where it was cast from; commenting; following; swiping the discover deck; sharing a receipt, portfolio card, or the app itself; opening a notification; and being shown a follow confirmation. We also keep the time the app was last opened, when a notification was delivered and read, which discover cards you passed on, records of portfolio syncs and weekly digests, and request counters used to limit abuse. The last-opened timestamp is kept server-side and is not shown on profiles.

Approximate location

Thesis does not ask for location permission and does not use your device’s location. Our analytics provider derives an approximate location — country, region, city, and a low-precision latitude and longitude — from the network address your app connects with, and associates it with your account. This is coarse, city-level information inferred from the connection; it is not GPS and it does not identify where you are in a city.

Diagnostics and subscription information

Sanitized crash and error data, including an account identifier, app, operating-system, runtime, and device-model context. Our crash reporter also records app stability sessions — when a session started, how long it ran, and whether it ended normally, with an error, or because the operating system stopped an unresponsive app. Thesis does not enable performance tracing, profiling, or session replay. If subscription features are enabled, Thesis also handles the entitlement and purchase status supplied by the app stores and RevenueCat.

Support and request correspondence

The email address you write from, the contents of your message and any attachment, and the record we keep of a support, access, correction, or deletion request and its outcome. Reports you file about content or accounts in the app, including the reason you write, are kept as part of the same safety and support record.

3. How Thesis uses information

Thesis uses information to:

• create and secure an account, authenticate sign-in, and prevent abuse;
• provide portfolio, thesis, social, receipt, and notification features;
• maintain the verified record, investigate abuse, and enforce our rules;
• measure product interactions and associated app, device, and approximate location context through a limited event taxonomy;
• diagnose crashes, hangs, and stability problems and improve reliability;
• respond to support, access, correction, and deletion requests, and verify that a request comes from the account holder; and
• meet legal, regulatory, security, tax, accounting, and audit obligations.

Thesis does not sell personal information or use it for cross-app or cross-site advertising tracking.

4. Service providers and disclosures

Thesis uses service providers that process information on our behalf or to provide a service you request. These include Supabase for authentication, database, and storage; Apple and Google for identity sign-in; Twilio for phone-code delivery; Expo for push delivery; SnapTrade for brokerage connections; Sentry for crash and stability reporting; PostHog for product analytics, which derives the approximate location described above from the network address your app connects with; RevenueCat and the app stores for subscriptions; and Massive and CoinGecko for market data; and Cloudflare, if Turnstile anti-abuse checking is enabled. We configure providers to support Thesis’s stated uses and do not authorize them to use our app data for their own advertising. AQX LLC requires any third party with access to user data to provide the same or equal protection described in this policy and required by the App Store Review Guidelines.

We may also disclose information when you make content public or share a receipt, when required by law or a valid legal process, to protect people or the service, or in connection with a corporate transaction. A public receipt is privacy-minimized, but an exported image cannot be recalled after it has been saved or reposted.

5. Your choices

• You can manage profile and portfolio privacy settings in the app.
• You can allow, deny, or later change notification permission in device settings.
• You can remove a connected brokerage account in the app.
• You can ask to access, correct, or delete personal information by writing to [email protected].
• You can start an account-deletion request at /delete-account/.

We may need to verify your identity before acting on a request. We will not ask you to send passwords, one-time codes, or brokerage credentials by email.

6. Retention and deletion

We retain information for as long as needed to provide Thesis, resolve disputes, maintain security, and meet legal obligations. Support and request correspondence, safety reports, and the records of how they were resolved are kept as part of that history. When you request account deletion, we will explain the information that will be deleted, anonymized, suppressed from public projections, retained for a legal reason, or unable to be recalled from an exported image. A subscription is managed by the relevant app store and is not cancelled merely by deleting a Thesis account.

7. Security and international processing

Thesis uses administrative, technical, and organizational safeguards designed for the information it handles. No method of transmission or storage is completely secure. Information may be processed in countries other than where you live by AQX LLC and its service providers, subject to applicable law.

8. Changes to this policy

We may update this policy when our practices or legal requirements change. We will post the updated policy and effective date here. Material changes will be handled as required by applicable law.