Legal

Privacy Policy

Effective Date: June 1, 2026 · Last Updated: September 30, 2026

Clavix is operated by Andover Digital LLC (“we,” “us,” “our”). The Clavix iOS app is distributed on the Apple App Store. The App Store may display an individual developer name as the seller for Apple distribution purposes. Andover Digital LLC operates the Clavix service, handles personal information as described in this policy, and provides support and the product experience.

1. Scope

This policy applies to all users of the Clavix service in the United States. Clavix is intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

The Clavix iOS app is available through the Apple App Store. Apple collects certain information as described in Apple’s own privacy policy. This policy covers only our handling of your information.

2. Information We Collect

2.1 Information You Provide to Create and Manage Your Account

2.2 Information You Provide to Use the Service

Portfolio holdings. When you add positions, you provide ticker symbols, number of shares, average purchase price, and optionally a purchase date. This information is stored with your account and used to compute risk scores for the tickers you have entered.

Watchlist items. Ticker symbols you add to your watchlist are stored with your account.

Alert and notification preferences. You can configure which alerts you receive, quiet hours, delivery time, and digest length.

2.3 Information Provided for Push Notifications

If you enable push notifications, we receive a device token provided by Apple’s Push Notification service (APNs). This token is used solely to deliver notifications you have requested. You can disable push notifications at any time in your iOS Settings.

2.4 Information Collected Automatically

We collect limited technical information to operate and secure the service:

• IP address — collected temporarily for rate limiting, security, and operational monitoring. Not stored long-term.
• Request metadata — the type of request, endpoint accessed, and timestamp are logged temporarily for debugging and performance monitoring.

We do not collect session recordings, advertising identifiers, or cross-site behavioral tracking. We do not sell your data to third parties.

2.5 App Usage and Crash Data

Product interaction events. The app records limited in-app events (such as when the upgrade screen is viewed or when a subscription is initiated) to help us understand how the product is used and improve it. These events are stored on our servers tied to your user account. No third-party advertising or analytics network receives this data.

Crash and performance reports. We use Sentry to automatically collect crash reports and limited performance traces when the app encounters an error. Reports may include a stack trace, a device model category, iOS version, and a session identifier generated by Sentry. Crash data does not include your name, email address, or portfolio holdings. Sentry acts as our service provider and, under its standard terms and data processing terms, does not use crash data for its own purposes such as advertising.

2.6 Subscription and Purchase Information

Apple processes all subscription payments. We do not receive or store your payment card or bank account details. To verify and provide subscription access, we receive and store Apple-signed transaction identifiers, product ID, subscription status, introductory-offer status, purchase date, expiration date, and App Store environment. This purchase history is linked to your Clavix account and used only for billing verification, fraud prevention, customer support, and enabling Pro features.

2.7 Brokerage Connections

Brokerage account connections are not available in the current version of the app. If brokerage connection becomes available in a future update, we will update this policy.

3. How We Use Your Information

• To provide the Clavix service. This includes computing risk scores, daily briefings, news filtering, and alerts for the tickers in your portfolio. The same ticker scores the same way for every user; your holdings determine which tickers we compute and show, not how they are scored.
• To communicate with you. We may send you account-related communications (e.g., password reset emails). We do not send marketing emails.
• To improve the service. We may analyze aggregated, de-identified data to improve the product.
• To secure the service. We monitor for unauthorized access, abuse, and technical issues.
• To comply with legal obligations.

4. AI and Model Processing

Clavix uses artificial intelligence (AI) and large language models (LLMs) to write portfolio briefings, news analysis, and explanatory text, and to help score the risk of individual securities. Our AI provider is MiniMax. MiniMax Group Inc. is headquartered in Shanghai, China, and listed on the Hong Kong Stock Exchange. We use MiniMax’s international API platform, which is provided under MiniMax’s standard API terms by Nanonoble Pte. Ltd., a MiniMax subsidiary in Singapore. Nanonoble is the company we contract with.

What is sent to the AI provider:

• The ticker symbols of the holdings and watchlist items a briefing or analysis covers, how many holdings you have, and the style tag stored with a holding where there is one (such as “core”).
• Coarse descriptions that we calculate on our own servers from your holdings. For example: “your largest holding,” “a major holding” (10% or more of your portfolio), “a mid-sized holding” (3% to 10%), “a small holding” (under 3%), “moved your book up a lot,” “concentration risk: moderate,” “your book this week: edged down,” or “behind the market.” Your portfolio’s overall grade letter, and whether its risk readings rose or fell, are sent the same way.
• Grades, scores, and analysis for each ticker. These are computed from public data and are the same for every user who holds that ticker.
• Public market data and news articles about those tickers, such as a stock’s own price and price moves.

What is never sent to the AI provider: your share counts, what you paid for a holding (cost basis) or when, the dollar value of any holding or of your portfolio, your exact position weights, how much of a day’s move any one holding accounted for, and any exact figure calculated from those, such as your portfolio’s own daily or weekly return. Where the app shows you these figures, our own servers calculate them and write them in. In most places our servers write the whole sentence. In the written paragraph of the weekly report, the AI provider is given a placeholder name in the spot where a number belongs (for example “[[BOOK_WEEK]]”), and our servers replace it with the real number after the AI’s text comes back. A placeholder name says which figure goes there. It never contains the figure, and the AI provider never sees the figure. Your name, email address, user ID, and other direct identifiers are not sent either.

The ticker list is still portfolio data. Although we do not send your name or account identifiers, the set of tickers you hold, together with the coarse descriptions above, is information about your portfolio, and an unusual combination of holdings could in principle be linked back to a person. We treat it as portfolio data, not as anonymous data.

How MiniMax may use this data: We access MiniMax through its standard commercial API terms. We do not have a negotiated, individually signed data processing agreement with MiniMax. MiniMax’s API terms say it may use the content we send, and what it generates, “to provide, maintain, develop, and improve” its services. Its API privacy policy also says it may de-identify data and use it for research and development. We do not control MiniMax’s practices, and we cannot guarantee that submitted content is not retained or used to improve its services. This is why we limit what we send to the items listed above.

Where MiniMax stores data: MiniMax’s API privacy policy (effective March 30, 2026) says personal data under that policy is stored in a data center in the United States, and that MiniMax may share data with its affiliated companies, including for system maintenance and hosting. MiniMax Group is headquartered in China, and several of its operating companies are incorporated there. We rely on MiniMax’s own statements for this and cannot independently verify where it processes data.

Opt-out: AI processing is integral to the core service. If you do not want the tickers you hold, and the coarse descriptions above, to be processed by MiniMax, you should not use the service.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

5.1 Service Providers (Subprocessors)

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or to protect our rights, property, or safety.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you through the app before your information becomes subject to a different privacy policy.

6. Data Storage and Security

• Your account data is stored on Supabase infrastructure hosted in the United States.
• Encryption in transit: TLS 1.2+
• Encryption at rest: AES-256
• Access to personal data is restricted to authorized personnel on a need-to-know basis.

International processing. Your account data is stored in the United States. The ticker symbols you hold, and the coarse descriptions listed in Section 4, are sent to our AI provider, MiniMax, which is not a US company. MiniMax’s API privacy policy says that data is stored in a data center in the United States and may be shared with MiniMax’s affiliated companies, including companies outside the United States. By using the service, you consent to this transfer.

7. Data Retention

We retain your personal information for as long as your account is active. News articles and events are automatically deleted after 30 days.

Account deletion: When you delete your account through the in-app settings, we delete or anonymize your personal data.

8. Your Rights and Choices

• Access and portability. Download your account data through the in-app “Export Data” feature.
• Correction. Update your profile and preferences in Settings.
• Deletion. Permanently delete your account through in-app “Delete Account.”
• Push notifications. Enable or disable in iOS Settings or in-app.

To exercise any rights not available in-app, email [email protected]. We will respond within 30 days.

California residents (CCPA/CPRA): We do not sell or share your personal information as those terms are defined under the CCPA.

9. Children’s Privacy

The service is not directed to individuals under 18. We do not knowingly collect personal information from children under 18. Contact us at [email protected] if you believe a child has provided us with personal information.

10. Cookies and Website Analytics

We use only essential session cookies to keep you logged in. We do not use advertising cookies, cross-site tracking, or third-party analytics scripts.

Two things do count activity, and neither is a third party. Cloudflare, our DNS and CDN provider, reports aggregate request volume for getclavix.com. The site also pings our own server when an App Store button is clicked, and we keep a running total per day. Those counters record the name of the event and the date, nothing else. No identifier, no cookie, and nothing you typed.

11. Changes to This Policy

We may update this Privacy Policy. When we make material changes, we will notify you through the app and update the “Last Updated” date.

12. Contact

Andover Digital LLC
Operator of Clavix
A Massachusetts limited liability company
57 Elm Street, Andover, MA 01810
Email: [email protected]