Privacy Policy

Last updated: October 12, 2026

1. Information We Collect

• Account information: email address (required for login and password reset), hashed password, account creation date.
• Profile data: portfolio configuration, retirement plan inputs, tax assumptions, allocation choices, simulation parameters — all data you explicitly enter.
• Usage data: simulation runs, snapshot timestamps, version history of your profile (so you can roll back).
• Operational logs: server access logs (IP, timestamp, request) retained for 30 days for security and debugging.

2. Information We Do NOT Collect

• Brokerage account credentials or API keys — Arya has no integration with brokerages and never asks for credentials.
• Social Security numbers, tax-ID numbers, or government identification.
• Bank account or credit card information — there is no payment infrastructure.
• Live brokerage holdings, executed trades, or transaction history — you manually enter holdings as you choose.
• Health, family-membership-roster, or other sensitive personal data beyond financial planning inputs.

3. How We Use Information

• Provide the Service: run simulations against your inputs, save your profile, surface analytics.
• Communicate: account verification, password reset, optional product announcements.
• Improve the Service: aggregate, anonymized usage patterns inform model refinements.
• Security: detect abuse, prevent fraud, debug issues.

4. Third-Party Service Providers

We use a minimal set of third-party services solely to operate the Service:

• Brevo (email): transactional email (verification, password reset, account and service emails, contact form responses).
• Hosting: hosted by a third-party cloud infrastructure provider on servers in the United States.
• Yahoo Finance / yfinance (market data): public market data fetched server-side; user-specific data is never sent.

We do not sell, rent, or share user data with advertisers, data brokers, or marketing third parties.

5. Cookies and Tracking

The Service uses minimal cookies and local storage solely for authentication session management. We do not use third-party advertising cookies, social-media tracking pixels, or cross-site behavioral tracking.

6. Data Security

Passwords are hashed with industry-standard algorithms (bcrypt/argon2). Data in transit is protected by TLS 1.2+ via Let's Encrypt certificates. Data at rest sits in encrypted server volumes. Access to user data is restricted to operational personnel (currently the founder) on a need-to-know basis. No system is perfectly secure; we cannot guarantee against all forms of breach.

7. Data Retention

• Active accounts: data retained for the lifetime of the account.
• Deletion requests: account and associated data deleted within 30 days of request.
• Operational logs: 30 days.

8. Your Rights (CCPA / GDPR)

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (right to erasure).
• Export your data in machine-readable form (data portability).
• Opt out of any data sharing (we do not sell or share, but you may still opt out formally).

Exercise these rights by sending us a message (or by emailing aryaadmin@ndinomics.com directly). We will respond within 30 days.

9. Children

The Service is intended for users 18 years or older. We do not knowingly collect data from minors.

10. Contact

Privacy questions: send a message (or email aryaadmin@ndinomics.com directly)