Your data, your rights

Your core account and portfolio data is stored in Singapore (SG) on Supabase infrastructure hosted in the ap-southeast-1 (Singapore) region.

Some data necessarily leaves Singapore to reach the service providers in the Third-Party Services section below — currently payment processing (Stripe), transactional email (Resend), product analytics (PostHog), and our hosting provider (Vercel). If you connect an external broker, exchange, wallet, or AI assistant, data also flows to and from that provider as part of using the integration you chose. We do not transfer data outside Singapore for any other reason, and only with appropriate safeguards in place.

• At rest: All data stored in our database is encrypted at rest using AES-256. Sensitive fields (e.g., API credentials for connected accounts) are additionally encrypted at the application layer using AES-256-GCM before storage.
• In transit: All communications between your browser and our servers are encrypted using TLS 1.2 or higher (HTTPS). We enforce HTTPS across all endpoints - unencrypted HTTP is not accepted.

• Account data: name, email address, password (hashed), subscription tier.
• Portfolio data: assets, valuations, accounts, and loans you manually enter or connect.
• Usage analytics: page views, device type, browser, OS, and country, collected only after you consent to it via the cookie banner. While you are logged in, these events are linked to your account so we can, for example, measure feature usage - they are not shared with advertising networks and are never used to track you across other websites.
• Product events: actions such as signing up, connecting an account, or importing positions are linked to your account the same way as the usage analytics above - only once you have consented via the cookie banner from that browser session.
• Billing and AI-assistant events: subscription changes reported by our payment processor’s webhook, and usage of a connected AI assistant, originate outside your browser session, so there is no cookie for us to check. We instead use the most recent consent decision on file for your account, from when you accepted, rejected, or updated your choice in the cookie banner, and only record these events if that decision was to allow it.
• Communications: messages you send via the contact form.
• Payment data: handled entirely by Stripe - we never store raw card numbers.

We collect only what is necessary to provide the service. We do not sell your data to third parties.

We retain your personal data for as long as your account is active or as needed to provide you the service. Upon account deletion, personal data is purged within 30 days, except where we are legally required to retain records for a longer period (e.g., financial transaction records under applicable Singapore law).

Under Singapore's Personal Data Protection Act 2012 (PDPA), you have the right to:

• Access - request a copy of the personal data we hold about you.
• Correction - request that we correct inaccurate or incomplete data.
• Deletion - request that we delete your personal data (subject to legal retention obligations).
• Withdrawal of consent - withdraw consent for data collection or use at any time, though this may affect your ability to use certain features.
• Data portability - request a portable copy of your data in a machine-readable format.

To exercise any of these rights, contact us at privacy@dollarodyssey.com. We will respond within 30 days of receiving a verifiable request.

We use a limited set of providers to run the service. We group them below by direction: who we chose and send data to, versus who you chose to connect and who therefore sends data to us.

Providers we engage, to operate the platform

• Supabase - database and authentication (Singapore region).
• Stripe - payment processing. Card data never passes through our servers.
• Resend - transactional email delivery.
• PostHog - product analytics, only after you consent (see “What We Collect” above).
• Vercel - application hosting; sees request metadata such as IP address as part of serving the platform.
• Content delivery and font providers (e.g. Google Fonts) see basic request metadata (IP address, user agent) needed to serve static assets.

Providers you choose to connect, which then send us your data

• Plaid, Binance, Luno - when you connect a bank, brokerage, exchange, or wallet account, you authorize that provider to send us your holdings, balances, and transactions. They already hold this data as your account provider, independently of us. We use the credentials you supply only to retrieve your own data from them.
• Wallet address lookups for crypto holdings you add are resolved via a blockchain data provider (Moralis), using only the public address you provide.

AI assistants you choose to connect

Dollar Odyssey supports connecting your account to a third-party AI assistant (e.g. Claude, ChatGPT, Cursor) so you can query your own portfolio data through it. This connection is authorized by you, can be revoked by you at any time, and only sends data for the account you connected.

We select every provider above for its own security and privacy commitments, and do not use advertising networks, data brokers, or analytics services that track you across other websites.

Contact & Complaints

For any privacy-related enquiries, requests, or complaints, contact our Data Protection Officer at privacy@dollarodyssey.com.

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at pdpc.gov.sg.