Legal

Privacy Policy

Last updated: May 19, 2026

Corvo ("we", "our", or "us") operates the portfolio analytics platform at corvo.capital. This Privacy Policy explains what we collect, how we use it, who we share it with, and the controls you have over your data.

1. Information We Collect

Information you provide directly:

Account information: email address and password (or OAuth provider identity) when you create an account.
Portfolio data: ticker symbols, weights, optional cost basis, optional purchase date, account type tags (taxable / Roth IRA / 401(k) / HSA / 529 / custodial), and reinvest-dividends preference. We never ask for brokerage credentials, account numbers, or routing information.
Profile information: optional display name, avatar, risk profile, investing horizon, primary goals, and life events you enter during onboarding.
Email and notification preferences: which digests you want (morning brief, weekly review, monthly summary, market close), price-alert configurations, and push-notification subscription tokens if you grant permission.
Chat history: conversations with the Corvo AI advisor, stored against your account so you can revisit them.
End-of-day snapshots: we record your portfolio's daily closing value into a snapshots table so the dashboard can ratchet day-over-day instead of resetting at every market open.

Information collected automatically:

Usage data: pages visited, features used, and aggregate interaction patterns.
Device information: browser type, operating system, viewport, and IP address (used for rate limiting and abuse prevention).
Error diagnostics: when something crashes in the app, we capture stack traces and the request context (no portfolio contents) so we can fix it.

2. How We Use Your Information

Provide, maintain, and improve the portfolio analytics service.
Generate AI insights, chat responses, health scores, daily action plans, and PDF reports for your portfolio.
Send digest emails, alerts, and push notifications you have opted into.
Detect and prevent fraud, abuse, and security incidents.
Respond to support requests.
Analyze aggregate usage to prioritize product work.

We do not sell your personal information. We do not use your portfolio holdings for advertising. We do not share your data with third-party marketers.

3. Third-Party Services

We use the following processors to operate Corvo:

Supabase: database, authentication, and file storage. Your account record and portfolio data live here, protected by row-level security so each user can only read their own rows.
Anthropic Claude: AI chat, health scores, daily signals, action plans, and report generation. We send portfolio context (tickers, weights, computed metrics) and your message to Anthropic. We do not send your email, password, or any identifying information. Anthropic's data retention and processing policies apply.
Yahoo Finance (via yfinance): public market price and fundamentals data. Only ticker symbols leave Corvo; nothing about you is sent.
Finnhub: news and supplementary market data. Ticker-level requests only.
Resend: transactional email delivery (welcome, digests, alerts).
Vercel: frontend hosting and edge network. Standard web logs (IP, user agent, path, response code) are retained by Vercel.
Railway: backend hosting. Standard application logs are retained by Railway.
Sentry: client-side and server-side error tracking. Captures stack traces, request paths, and the browser environment, never your portfolio contents.
PostHog: product analytics. Captures aggregate page-visit and feature-usage events. Configurable; opt out by setting "Do Not Track" in your browser.
Web Push (VAPID): if you grant notification permission, your browser-issued push subscription token is stored so we can deliver price alerts.

4. Data Retention

We retain your account data for as long as your account is active. Saved portfolios, chat history, snapshots, and preferences are stored until you delete them or close your account. Closing your account removes your row-level data from our Supabase database within 30 days. You can request deletion at any time from Settings or by emailing vinaybprojects@gmail.com.

5. Security

We use industry-standard safeguards: HTTPS for every connection, bcrypt-hashed passwords managed by Supabase Auth, row-level security policies enforced at the database, JWT-verified API routes for any operation that touches user-scoped data, IP-based rate limits, and signed unsubscribe tokens on email links. No internet transmission is 100% secure and we cannot guarantee absolute security, but we follow the principle of least privilege and document our practices in the open-source repository.

6. Not Financial Advice

Corvo is an analytics and educational tool. Nothing on the platform is financial, investment, tax, or legal advice. Portfolio metrics, health scores, AI chat responses, simulations, and reports are for informational purposes only. Markets are unpredictable and past performance never guarantees future results. Consult a qualified financial professional before making investment decisions.

7. Children

Corvo is not directed to anyone under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact vinaybprojects@gmail.com and we will delete the account.

8. Your Rights

Depending on your jurisdiction (including GDPR and CCPA where applicable), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or outdated data.
Request deletion of your data ("right to be forgotten").
Export your data in a machine-readable format.
Opt out of marketing emails at any time via Settings or the unsubscribe link in every email.
Lodge a complaint with your local data protection authority.

To exercise these rights, use the Settings page or contact vinaybprojects@gmail.com. We respond within 30 days.

9. Cookies and Local Storage

We use essential cookies for Supabase authentication and browser localStorage to remember your preferences (theme, currency, default time period, dismissed banners, last-active tab). We do not use cross-site tracking cookies or advertising cookies.

10. International Transfers

Corvo is operated from the United States. If you access it from outside the US, your data may be transferred to and processed in the US and other jurisdictions where our processors operate. By using Corvo you consent to those transfers.

11. Disclosure for Legal Reasons

We may disclose your information if required by law, valid legal process, or to protect Corvo's rights, property, or the safety of users.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and post the updated effective date here. Continued use of Corvo after changes constitutes acceptance of the updated policy.

13. Contact

For privacy questions or to exercise any right above, email vinaybprojects@gmail.com.