Privacy Policy

1. Introduction

CaribVest Ultra ("the app", "we", "us") is an investment portfolio tracker published by Hibiscus Technologies LLC, a company registered in the United States. This policy explains what information the app collects, why, who it is shared with, and the choices you have.

We have designed the app to collect as little personal information as possible. Your portfolio holdings are stored on your own device and in your private iCloud account by default — not on our servers.

If you have questions about this policy or your data, contact us at support@hibiscus-technologies.com.

2. Information we collect

2.1 Account information

When you sign in with Apple or Google, we receive:

• Your name, if your sign-in provider supplies it. Sign in with Apple lets you withhold or use a private relay name; if you do, we simply do not have it.
• Your email address, or Apple's private relay address if you choose to hide your email.
• An account identifier supplied by the sign-in provider, which we use to recognise you across sessions and devices.

We do not receive or store your password, and we do not have access to your Apple or Google account.

2.2 Portfolio information

Your holdings — the securities you own, quantities, cost basis, and the values calculated from them — are stored on your device and synchronised through your own private iCloud account using Apple's CloudKit. Hibiscus Technologies does not store your portfolio on its servers and cannot browse it.

Two limited exceptions, both described below, are the optional community holdings feature (section 2.3) and AI-assisted analysis (section 4.3).

2.3 Community information

If you use the community features, we store on our servers:

• Posts, comments, poll questions and votes you create
• Likes, follows, blocks, and room memberships
• Direct messages you send and receive
• Your display name, chosen @handle, and profile image
• Reports you submit about other users' content

Holdings shared to the community are ticker symbols only. If you turn on holdings sharing, other users can see which securities you hold — never how many shares, what they are worth, or what you paid. Our community database is structurally incapable of storing those amounts.

Direct messages are stored on our servers so they can be delivered and displayed. They are not end-to-end encrypted. Please do not share sensitive personal or financial details in messages.

2.4 Device and technical information

• Push notification tokens, if you enable notifications, so we can deliver alerts to your device.
• Basic technical data necessary to operate the service, such as request timestamps and rate-limiting counters.

2.5 What we do not collect

We do not use analytics, advertising, or crash-reporting services. We do not track you across other apps or websites. We do not collect your location, your contacts, your photos beyond images you deliberately upload, or your phone number and address. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

3. How we use your information

We do not use your information for advertising or profiling.

4. Third parties who process data for us

4.1 Infrastructure

• Supabase — hosts our database and server functions, storing community content and account records.
• Cloudflare — runs the background services that fetch market data.
• Apple — provides Sign in with Apple, iCloud storage for your portfolio, and push notification delivery.
• Google — provides Google Sign-In if you choose it.

4.2 Market data providers

Market data providers supply prices, charts, and company information. They receive ticker symbols and general requests only — never your identity, your account, or which securities you personally own.

4.3 AI-assisted analysis (Anthropic)

The app offers AI-generated commentary on your portfolio. How this works depends on your device and the feature:

AI Coach. On devices that support Apple Intelligence, this runs entirely on your device and no portfolio information leaves it. On devices without that support, the request is instead processed by Anthropic (the provider of Claude).

Portfolio Insight. This feature always uses Anthropic.

When a request is processed by Anthropic, we send a text summary of your portfolio: ticker symbols, company names, position values, share counts for Jamaica Stock Exchange positions, percentage returns, and general market context. No name, email, account identifier, or device identifier is attached — the request passes through our own server, which holds the credentials, so Anthropic receives portfolio content without knowing whose it is.

Uploaded statements. If you upload a brokerage statement that the app cannot read on your device, the document is sent to Anthropic to be read. A brokerage statement may contain considerably more than tickers and values — potentially your name, account numbers, and full transaction history. This only happens for statements you deliberately upload and that cannot be processed on-device. If you would rather this did not happen, do not upload statements; you can enter holdings manually instead.

Anthropic processes this information under its commercial API terms as our service provider. See Anthropic's privacy policy at https://www.anthropic.com/legal/privacy.

5. How long we keep information

• Community content — until you delete it or your account.
• Direct messages — until you or the other participant deletes the account.
• Account records — until you delete your account.
• Portfolio data — on your device and in your iCloud, under your control; deleting the app or your iCloud data removes it.
• AI requests — not logged with the content of your prompts by our servers. Anthropic's retention is governed by its own terms.

6. Your choices and rights

6.1 In the app

• Delete your account. The app includes a delete-account function that removes your posts, comments, likes, follows, blocks, messages, memberships, shared holdings, profile, and push tokens from our servers. This cannot be undone.
• Control holdings sharing. Sharing tickers to the community is off unless you turn it on, and can be turned off at any time.
• Control notifications. Every notification category can be enabled or disabled individually.
• Block and report. You can block another user, which prevents messages and notifications between you, and report content for review.

6.2 Legal rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing.

If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect and how it is used, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioural advertising.

If you are in the United Kingdom, the European Economic Area, or another region with comparable law, you may have equivalent rights, including the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@hibiscus-technologies.com. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request.

7. Security

We protect your information using encrypted connections, server-side access controls that prevent one user from reading another's private data, and credentials that are held only on our servers and never in the app. Your portfolio is stored in your own private iCloud account rather than in a central database we control.

No system is completely secure. We cannot guarantee absolute security, and you share information at your own risk.

8. Children

CaribVest Ultra is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

9. International users

We are based in the United States, and our service providers may process information in the United States and other countries. If you use the app from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

10. Not financial advice

CaribVest Ultra is an informational and educational tool. Nothing in the app — including AI-generated commentary, risk assessments, calculators, or community content — is investment, financial, tax, or legal advice, and Hibiscus Technologies is not a licensed financial adviser or broker. Market data may be delayed and is provided without warranty. Always do your own research and consider consulting a licensed professional.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date above, and for significant changes we will provide notice in the app. Continued use of the app after a change means you accept the updated policy.

12. Contact

Hibiscus Technologies LLC
Email: support@hibiscus-technologies.com

For privacy questions, requests about your data, or to report a concern, please write to the address above.