Legal · Data protection
Privacy Policy
Applies to the Investiq mobile app, web app, landing site, prelaunch programme and support. Version 2026-11-04.1, last updated 4 November 2026.
Investiq does not sell personal data, use advertising trackers, or send your accounts, portfolios, messages or profile images to generative AI models. On the web, PostHog analytics remains off until you choose it. In the mobile app, usage statistics and crash reports, not linked to your account, are on from the start and can be turned off.
1. Controller and contact
The data controller for the processing described in this policy is:
William UllerstigInvestiqSöderberga Allé 3, 162 52 Vällingby, Swedeninvestiqco@gmail.comNo data protection officer has been appointed because the current operation is not subject to that requirement. Privacy questions go directly to the controller.
2. What Investiq does
Investiq is an account-based educational and social investing simulator with lessons, simulated portfolios, leagues, teams and a prelaunch programme. It does not execute real securities trades, hold customer funds or receive bank or brokerage logins. If you choose to, you can add your real stocks and funds in My stocks (Mina aktier) to follow them in the app; Investiq does not connect to your bank. Paid preorders may be offered separately through Stripe or an app store.
3. Personal data we process
We receive data mainly from you and your use of the service. Authentication providers, payment providers and your device may also provide the limited data needed for the selected feature.
| Category | Examples |
|---|---|
| Account and identity | Name, email address, internal user ID, verification status, authentication provider and session information. |
| Profile and choices | Profile image, handle, biography, language, theme, investing goals, experience level, risk level and privacy settings. In the app also your country (from the phone's region at sign-in, or your own choice) and, if you choose one, your school. |
| App activity | Onboarding, lessons, quizzes, saved stocks, simulated orders, portfolios, leagues, teams, achievements and progress. |
| My stocks (Mina aktier, optional) | Bank and account type, the stocks and funds you add, number of shares, average purchase price (GAV) or what you paid, values and dates. Screenshots you choose are read on your phone and not stored by us, unless you choose to send them to us when the app cannot read them. |
| Personalised suggestions (mobile app, if you have them on) | How you react to Upptäck cards (shown, for how long, swipes, saves, "Show fewer" and why), which stocks you open and for how long, your watchlist, which search result you tap (not the search text), simulated trades (buy or sell and a rough amount), lessons started and finished and whether quiz answers were right (not the answer itself), and which countries and lists you open. From this we work out interests by sector, style and country, a knowledge level and a risk limit. We also store what we showed you and why: which cards, the order of Markets and the news, which lesson we suggested and which notifications we sent. Also technical details: the app version, which screen it happened on and an id for the visit. When suggestions are fetched, the app also sends the stocks you already own or watch and your answers from the introduction (interests and experience). We don't store these. We store when you said yes or no, and to which text. |
| Social content | Friend relationships, blocks, reports, group and direct messages, posts, comments and voluntary feedback. |
| Content and safety reports | Reporter name and email where provided, exact content location and ID, allegation, possible legal basis, correspondence, review events, decisions and affected user. |
| Prelaunch and purchases | First name, verified email, referral code, campaign status, optional profile answers, marketing choice, and order and payment references. |
| Withdrawal and refund matters | Email, order reference, contract description, date, optional note, timestamped receipt, handling events and decision. |
| Technical and security | IP address, user agent, platform, app version, session and device identifiers, push token, timestamps, coarse performance metrics and error codes. |
| Support | What you send to support, contact details and our correspondence. |
When reporting content or sending a withdrawal notice, provide only data needed for the matter. Do not send passwords, full card details, medical records or other sensitive data unless strictly necessary to understand a specific safety risk.
What we do not collect
- No bank or brokerage logins or passwords. Real holdings only if you add them yourself in My stocks.
- No precise location, address book, microphone data or camera access.
- No full payment-card details; those are handled by Stripe or the app store.
- No sale of personal data and no advertising profiling. The only profiling we do is personalised suggestions in the app, which you can turn off.
The mobile app requests photo-library access only when you choose a profile image or screenshots for My stocks, and notification permission when a notification feature is enabled. Investiq receives the selected profile image or a push token, not your entire photo library. Screenshots for My stocks are read on your phone; we only receive the holdings you save, or the images if you choose to send them to us.
4. How we use data and our legal bases
| Purpose | Legal basis | What this means |
|---|---|---|
| Provide the account and service | Contract or steps taken at your request | Create an account, save progress, display simulated portfolios and provide social features. |
| Automatic leagues: Everyone, country and school | Contract | Every player is in the Everyone league (Hela Investiq) and in the league for their country. The country comes from the phone's region at sign-in until you choose one yourself, and you can change country once every 30 days. A school league is optional: you are only in one if you choose your school under Settings → Privacy → Leagues, and you can remove the school at any time. Other members of the same league see your display name and your results. In a school league these are other pupils who chose the same school, and many of them are under 18. |
| Teacher view: the class league | Contract | A teacher can create a class in Investiq. The class is a league you are only in if you join it yourself with the teacher's code. The teacher then sees your display name, your return in percent since you joined, your place in the class, how many lessons you have finished in Lär dig, how many trades you have made since you joined, which days in the last two weeks you made a trade or finished a lesson, and roughly when you were last active. The teacher never sees amounts in kronor, your holdings or what you bought and sold. The teacher does see which stocks the class as a whole traded most in the last week: how many students bought or sold each stock, only for stocks at least two students traded, and never who. The teacher can also type in the names in the class to see who has not joined yet. If you leave the league, the teacher stops seeing your details. |
| My stocks: your real holdings | Contract (at your request) | Show the value and performance of the stocks and funds you have added yourself, using Investiq's prices. Only you see them, they are not shown in leagues or to others, and nothing here is advice to buy or sell. |
| My stocks: screenshots you send us | Contract (at your request) | If the app cannot read your screenshots, you can choose to send them to us. We read them, add your holdings for you and keep only the extracted text, with changed amounts and without your name, to teach the app to read more banks. The images themselves are not kept longer than below. |
| Personalised suggestions in the app | Consent | We adapt the app to how you use it: which cards you see in Upptäck, the order of countries, lists and sectors in Markets, companies like the ones you saved, which lesson Lär dig suggests and the order of the news. If you turned on Notifications about your stocks, we also send notifications about companies you own or saved, for example that a report is out tomorrow. The data is linked to your account. We store ids and rough values, never search text, quiz answers or exact amounts. Suggestions never learn to show you riskier stocks, only fewer: how much a stock swings is left out of what we learn about what you like, and lists like Rör sig mest are never moved up because you opened them. If you said something feels too risky, or you said you were new when you started using the app, no highly volatile stocks are shown in suggestions. Notifications are only about companies you own or saved, come at most once a day and never at night, and never tell you to buy or sell. Nobody else sees what we work out about you, not teachers or others in your leagues. One in ten people get a selection that is not based on their use of the app, so we can measure whether suggestions help. We also work out totals per card, without ids, to make the card texts better, for example how often a card is saved. Under "Undvik i förslag" you can leave out, for example, weapons, tobacco or gambling. The choice is kept on your phone and sent along when suggestions are fetched, but we don't store it. What you set yourself, such as your watchlist and the companies and sectors you follow in the news, works as usual when the feature is off. The feature is off until you say yes. The app asks once, and not at all if you turned statistics off. You can change your mind any time under Profile → Settings and privacy → Personalised suggestions, and if you turn it off the data is deleted. |
| Security, troubleshooting and abuse prevention | Legitimate interests | Protect accounts, limit abuse, fix errors and keep the service stable. We balance these interests against your privacy. |
| Content moderation and statutory notices | Legal obligation and legitimate interests | Receive, investigate and document reports, provide receipts and reasoned decisions, protect users and handle review or legal claims. |
| Optional product analytics on the web | Consent | Understand named product flows with PostHog on the web. Web analytics remains off until accepted and can be disabled again. |
| Usage statistics and crash reports in the mobile app | Legitimate interest | Find faults and understand which parts of the app are used (for example which screens open, that a lesson was finished or that a simulated order was placed). The statistics are tied to a random id that only lasts until the app is closed and is never saved on the phone. Crash reports contain the error, app version, technical details about the phone (for example model, operating system and language) and the latest screens and calls before the error. The calls are shortened so that they contain no ids for people, chats, groups or leagues, and the phone's own name is removed. None of this is linked to your account, name or email. The feature is on from the start. The app tells you once, with a button to turn it off: on the first screen if you are new, otherwise the first time you finish a lesson or make a trade. You can turn it off at any time under Profile → Settings and privacy → Usage analytics and crash reports. |
| In-app feedback | Legitimate interest | Receive and answer what you send with Send feedback. The app version, phone model and operating system are sent with the text, and the screens you last visited if usage analytics is on. Your email address is only sent if you choose to get a reply. |
| Product updates | Consent | Send launch or product emails when you have expressly selected this option. |
| Preorders and payment | Contract and legal obligation | Administer orders, refunds, accounting and consumer rights. |
| Right of withdrawal | Contract and legal obligation | Record when you withdraw from a contract, provide a durable receipt and handle a refund or decision. |
| Legal requirements and claims | Legal obligation or legitimate interests | Comply with law, respond to authorities, and establish, exercise or defend legal claims. |
Required account data is needed to create and operate an account. Without it, signed-in features cannot be provided. Analytics and marketing are optional and do not affect the core service.
AI and automated decisions
Investiq does not send personal data such as account data, simulated portfolios, messages or uploaded images to generative AI models and does not use it to train such models. Suggestions in the app are ranked with simple rules and statistical models. The models are trained on how suggestions were received and hold no ids, names or email. Suggestions are not personal financial advice. They only affect the order you see things in the app and which notifications about your own companies you get. The service does not make decisions with legal or similarly significant effects based solely on automated processing. Market and educational content may include automated calculations and is not personal financial advice.
5. Cookies, device storage and analytics choices
Essential storage is used without analytics consent for sign-in, security, language and features you request. PostHog is not loaded and does not set analytics storage until you choose Accept all or enable analytics under Manage choices. In the mobile app, usage statistics and crash reports are on from the start. The statistics store nothing on the phone: events sit in the app's memory until they are sent, and the id only lasts until the app is closed. Crash reports are kept briefly on the phone until they can be sent, because the app may have been closed by the error. Your choice is saved if you turn it off. You turn it off under Profile → Settings and privacy. On the App Store, product interaction, search history and diagnostics are listed as linked to you. That refers to the app's own features, such as lessons, trades, leagues and personalised suggestions, not the usage statistics. Personalised suggestions are a separate choice next to the statistics. What is sent to us stays only in the app's memory until it is sent. Your Upptäck swipe history is also kept on the phone so the cards work offline. It and anything else the app kept on the phone for suggestions is deleted when you turn the feature off.
| Name | Type | Purpose | Duration | How to opt out |
|---|---|---|---|---|
| Better Auth session | Essential | Keeps you signed in and protects your session. | Normally 7 days or until you sign out. | Sign out or clear browser/app data. Signed-in features will then stop working. |
| investiq.privacy-consent | Essential | Stores your analytics choice and the policy version. | 12 months. | Clear site data; we will ask for your choice again. |
| investiq.analytics-consent | Essential | Makes your analytics choice available to server features without exposing other storage. | 12 months. | Change the choice under Privacy choices or clear site data. |
| investiq.locale | Preference | Remembers the selected language. | 12 months. | Change language or clear site data. |
| investiq-device-id | Essential | Distinguishes signed-in devices so that you can review and sign out sessions. | Until you clear site data. | Clear site data; the device receives a new ID on the next sign-in. |
| investiq.se.attribution / visit | Essential for referrals | Connects a referral visit to the correct campaign code and prevents duplicate credit. | 30 days or until registration is completed. | Clear site data; the referral may then not be credited. |
| investiq.se.* prelaunch state | Preference | Remembers campaign steps, a referral code and whether an offer was shown or completed. | Until the campaign ends or you clear site data. | Clear site data. |
| news_viewer_id | Analytics | Prevents the same browser from being counted repeatedly for a news view. | 12 months; created only after consent. | Disable Analytics under Privacy choices. The cookie is removed on the next view call. |
| App and web cache | Essential/preference | Stores local choices, notes and cache on your device. Sensitive authentication credentials use the mobile device's secure storage. | Until replaced, the account is deleted, or you clear app/browser data. | Clear app or site data in your device or browser settings. |
| settings_analytics_enabled | Essential | Stores your choice for Usage analytics and crash reports, and that you have seen the notice about them. | Until you change the choice or clear app data. | Turn off Usage analytics and crash reports under Settings and privacy. Statistics that have not been sent are then removed at once. |
| Sentry crash report | Troubleshooting | Stores a crash until it can be sent, and a random id for the crash reports. | Until the report has been sent; the id until the app is removed. | Turn off Usage analytics and crash reports, and no more crash reports are sent. |
| PostHog storage (ph_*) | Analytics | Associates consented analytics events with the same browser without session recording. | Up to 12 months; created only after consent. | Choose Reject or disable Analytics under Privacy choices. |
You can reopen Privacy choices on the site at any time and withdraw analytics consent. You may also clear cookies/local storage in your browser and app data in device settings. We use no advertising cookies or tracking across different companies' sites and apps. On the web, we respect Do Not Track by not starting PostHog or counting news views when that signal is active.
6. Recipients and processors
We share data only with providers needed for the relevant function, or where required by law. Depending on the service and agreement, a provider may act as our processor or as an independent controller. Each provider is bound by contract to protect the data at least as well as this policy describes. Better Auth is software operated inside Investiq's own environment and is not a separate processor.
| Provider | Function | Privacy |
|---|---|---|
| Microsoft Azure | Core API, authentication database, app data, profile images, email and real-time features. Core resources are deployed in Sweden Central. | Policy |
| Cloudflare | Delivery and protection of the landing site, Workers logs and the D1 preorder database. The D1 database was created with EU jurisdiction. | Policy |
| PostHog EU | Web analytics after consent, and usage statistics from the mobile app that are not linked to your account. Automatic click collection and session recording are disabled. On the web, your IP address is not sent to PostHog. Data is stored in Frankfurt. | Policy |
| Sentry (EU) | Crash reports from the mobile app and feedback you choose to send with Send feedback. Data is stored in Frankfurt. | Policy |
| Expo | Registration and delivery of push notifications to devices on which you have allowed notifications. | Policy |
| Apple | Sign in with Apple, APNs push notifications and App Store distribution. | Policy |
| Google Sign-In, FCM push notifications and support email through Gmail. | Policy | |
| Logo.dev | Display of company logos. When a logo is requested, Logo.dev may receive the IP address, requested domain and request timestamp. | Policy |
| Stripe | Secure checkout and payment administration if paid preorders are enabled. Investiq does not store full card details. | Policy |
| Upstash | Short-lived caching and controls against abuse or excessive API requests. | Policy |
7. How long data is kept
| Category | Retention |
|---|---|
| Account, profile and active app data | For as long as the account is active. Following a valid deletion request, active data is deleted or anonymised within 30 days. |
| Country, school and league results | Country and school are kept in the profile while the account is active, and the school is removed as soon as you remove it. If you change country or school, your membership of the old league ends, but your results stay in seasons that have already finished. When the account is deleted, country and school are removed and the results are anonymised as in the row above. |
| My stocks | For as long as the account is active, or until you choose Delete my real holdings in the app. Deleted with the account. |
| Screenshots you sent us | Deleted once we have added your holdings, at the latest 30 days after you sent them, and immediately if you delete your account or your real holdings. |
| Personalised suggestions | Events and what we showed you (cards, order, lesson suggestions and notifications) are kept for 90 days. What we work out (interests, knowledge level, risk limit) is recalculated every night and kept while the feature is on and the account exists. Turning the feature off or deleting the account removes it all from active data at once, and from backups within 7 days. We keep when you said yes or no for as long as the account exists. |
| Security and error logs | Normally 30 days. Relevant material may be kept longer where a specific incident or legal claim requires it. |
| Product analytics | PostHog events, consented news-view events and the mobile app's usage statistics are kept for up to 12 months from collection, or less after consent is withdrawn where deletion can technically be linked to your analytics identifier. |
| Crash reports and feedback | Crash reports are kept for up to 12 months. Feedback is kept until the matter is closed, at most 12 months. |
| Support email | 24 months after the matter is closed, unless needed longer for a legal claim. |
| Content reports and moderation decisions | Normally three years after the matter is closed. Data may be kept longer for an active authority matter, safety need or legal claim, and for less time where it is no longer needed. |
| Withdrawal and refund matters | The request itself is normally kept for three years after closure. Order, refund and accounting evidence is kept for the longer statutory period below. |
| Prelaunch and referrals | Until the campaign and promised rewards have been administered, normally no longer than 12 months after the campaign ends. Marketing data is removed when consent is withdrawn. |
| Order and accounting records | For the period required by Swedish accounting and tax law, normally seven years after the end of the calendar year in which the financial year closed. |
| Backups | After active data is deleted, residual copies may remain in rolling backups for up to 7 additional days and are not restored to active use. |
Public or shared content may need to be anonymised rather than deleted if removing it would damage other users' conversations, leagues or safety matters. In that case, the name, profile image and active account link are removed.
8. Your data protection rights
Under the GDPR, depending on the circumstances, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You withdraw your yes to personalised suggestions by turning them off in the app. Collection then stops and what we stored is deleted.
You can delete your account yourself in the app under Profile → Inställningar och integritet → Radera konto. Without the app, follow the instructions at useinvestiq.com/en/account-deletion.
Email investiqco@gmail.com. We may ask you to verify that the request relates to the correct account. We normally respond within one month; complex or numerous requests may be extended by two further months under the GDPR after notice.
You may also complain to the Swedish Authority for Privacy Protection (IMY): imy.se.
Investiq does not sell or share personal data for behavioural advertising, so there is no separate “Do Not Sell or Share” link.
9. International transfers
Core data is configured in EU-based Azure resources and the preorder database is restricted to Cloudflare's EU jurisdiction. Global providers may still provide limited support access, deliver authentication or notifications, or process metadata outside the EEA. Ordinary internet traffic may also transit other regions.
Where a transfer outside the EEA occurs, European Commission adequacy decisions, Standard Contractual Clauses and supplementary security measures are used under the provider agreements. You may request a copy or further information using the contact address below.
10. Children, young people and minimum age
You must be at least 13 and have reached the age at which you can consent to an information-society service in your country of residence. In Sweden that age is 13; in other EEA countries it may be as high as 16. Anyone below the applicable local threshold may not create an account through the standard registration flow.
We do not collect a full date of birth for age checks. Registration instead requires confirmation of the age requirement. If we learn that an account was created in breach of this rule, it will be disabled and the data deleted or anonymised under the periods above. A parent or guardian may contact us.
Many people using Investiq are under 18. That is why we ask before the app adapts to you. Suggestions use only ids and rough values, give beginners simpler cards, never learn to show riskier stocks and always mix different sectors. Notifications about your companies only come if you turned them on, at most once a day and never at night. Nobody else sees what we work out about you, not teachers either.
11. Security and incidents
We use measures including HTTPS/TLS, provider-managed encryption at rest, secure session cookies, the mobile device's SecureStore, access controls, rate limits, logging and separated production secrets. No internet service can promise absolute security. If a personal-data breach occurs, we notify the authority and affected people where required by law.
12. Changes to this policy
When this policy changes, the version and date at the top of the page are updated. Material changes affecting how existing data is used will also be communicated in the app, on the site or by email where appropriate. Please review the policy periodically.
13. Privacy contact
Send questions or requests using the details below. We normally acknowledge and respond to a verified data-protection request within one month.
William UllerstigInvestiqSöderberga Allé 3, 162 52 Vällingby, Swedeninvestiqco@gmail.com14. Sweden and EEA supplement
Investiq currently has Sweden/the EEA as the service's regional scope. Depending on the purpose, processing relies on GDPR Article 6(1)(a) (consent), 6(1)(b) (contract or pre-contract steps), 6(1)(c) (legal obligation) and 6(1)(f) (legitimate interests). The balancing test mainly covers security, abuse prevention, troubleshooting and legal claims.
Rights under GDPR Articles 15–22 are summarised in section 8. The controller is established in the EEA, so an Article 27 representative is not required. No data protection officer has been appointed because the current processing is not considered to trigger that requirement. You may complain to IMY or the supervisory authority where you live.