Privacy notice

This explains what we collect, why, who helps us handle it, and the choices you have. We handle personal data in line with Kenya's Data Protection Act, 2019. The person responsible for your data is the individual who runs Quant-Assist (contact below).

What stays on your PC

Your research (alphas, results, vault, settings) is stored on your PC and is not sent to us. The app also stores the sign-in details you give it for the platforms you connect, in plain text on your PC, so anyone who can read your user folder can read them. Protect your PC and Windows account accordingly.

What our cloud holds

• Account: your email address and a protected form of your password (we cannot read your password).
• Phone numbers: the number you verify on WhatsApp, kept in a protected (encrypted) form so we can send you plan reminders, plus a one-way fingerprint of it so a number cannot be used on many accounts. The M-Pesa number you pay with is kept only as its last four digits plus a fingerprint.
• Plan and payments: which plan you have and until when, each payment's amount, status and M-Pesa receipt number. We keep payment records for tax and accounting even after you delete your account.
• Devices: the name of your PC, a public key that identifies it, and when it was last seen.
• Security log: actions such as sign-ins, device changes and refunds, so we can investigate abuse.

Who helps us

• Supabase hosts our database and sign-in (servers in Frankfurt, Germany).
• Cloudflare serves this website and our API address.
• PayHero (with Safaricom M-Pesa) processes payments. It sees your M-Pesa number and the amount.
• Resend sends our account emails (confirmations and password resets).
• A WhatsApp gateway delivers your verification code and plan reminders. It sees your number and the message. It is an unofficial gateway, not WhatsApp itself, which is why we also use it only for these short messages.

The app's WhatsApp notifications

If you switch on the app's own WhatsApp notifications, the app sends the message text and your number through a third-party gateway using a shared key that is built into the app. Do not put anything sensitive in those messages, and do not switch them on if you are not comfortable with this.

Your choices

• Download what we hold, or delete your account, from your account page. Deleting ends your plan with no refund of the time left, removes your account and device records, and keeps only the payment records described above.
• Ask us to correct or explain your data: support@xhinku.com. You may also complain to the Office of the Data Protection Commissioner of Kenya.

Cookies

This site does not use advertising or analytics cookies. While you are signed in, your sign-in is kept in this browser tab only and is cleared when you close it.

Changes

If this notice changes in a way that matters we will say so on this page and in the app.