Privacy Statement
Last updated: October 17, 2026
Who is responsible
Andrii Ivasiuk, Einzelunternehmer
Kinzigstr. 30, 10247 Berlin, Germany
support@odyn.app
We are the controller for the personal data described here. We have not appointed a data protection officer, and are not required to.
What we collect
Account data — your name, email address, and, if you use Google Sign-In, your Google account ID and the authentication tokens needed to keep you signed in.
Your financial records — everything you enter or import: holdings, valuations, transactions, and the notes and labels you add. You provide all of it; Odyn does not connect to your bank, broker or any other account.
Figures we calculate — net worth, profit and loss, IRR and similar metrics derived from your records.
AI inputs and outputs — the questions you ask in Ask Odyn and the material it works from, together with the answers produced.
Usage data — which features you use and how often, and technical information such as browser, operating system and IP address.
Peace of Mind — if you set it up, the name and email address of the partner and the guardian you nominate, the inactivity period you choose, and any instruction you write for them. If you do not sign in for that period, we email you to check in. If you still do not sign in, we email your partner and then your guardian a link to a report of your assets, liabilities and net worth, together with your instruction. The link expires after 90 days. Everything stops as soon as you sign in, and if you switch Peace of Mind off, any link already sent stops working. Please let the people you nominate know that you have given us their details and why.
Feedback — only when you choose to send us feedback from the app: the topic you pick, your message and, if you attach one, a screenshot. A screenshot may show anything on your screen, including your balances and holdings. With each message we also record the page you were on, your browser and device type, and your window size, and we link it to your account and email address so that we know who wrote and can reply. Nothing is sent until you press send.
All of it comes from you or from your use of the service. We do not buy personal data or obtain it from third parties.
Why we process it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run your account, store your records, calculate your figures | To provide the service you subscribed to | Art. 6(1)(b) — performance of a contract |
| Answer your questions through the AI features | Part of the service | Art. 6(1)(b) |
| Send account, billing and cancellation emails | To operate the contract and meet obligations under it | Art. 6(1)(b) |
| Run Peace of Mind for you | Part of the service you set up | Art. 6(1)(b) |
| Hold the details of your partner and guardian and email them | Our legitimate interest, and yours, in reaching the people you chose when you cannot be reached | Art. 6(1)(f) |
| Read and answer the feedback you send, fix the problems you report and improve Odyn | Our legitimate interest, and yours, in hearing what does not work and acting on it | Art. 6(1)(f) |
| Keep the service secure, prevent abuse, maintain backups | Our legitimate interest in a service that works and is not attacked | Art. 6(1)(f) |
| Measure how the product is used and whether our ads lead to sign-ups | With your consent, through the cookie banner | Art. 6(1)(a), and § 25 TDDDG |
| Meet legal obligations | Where the law requires it | Art. 6(1)(c) |
You can withdraw consent to analytics at any time, through the cookie settings, without affecting anything processed before you withdrew it.
Providing your account data is necessary to use Odyn — without it we cannot give you an account. Everything beyond that is yours to provide or not.
Who else is involved
Google. Google Cloud hosts Odyn and stores your data; Vertex AI provides the AI features; Google Sign-In handles authentication if you choose it; Google Workspace carries our email. For these, Google acts as our processor under the Google Cloud Data Processing Addendum.
Google Analytics measures how Odyn is used and whether our Google Ads lead to sign-ups — only after you accept analytics in the cookie banner; until then it is not loaded at all. For Analytics, Google acts as our processor under the Google Ads Data Processing Terms. Google signals, retargeting and personalised advertising are switched off, and we do not use Analytics data to target anyone. Where Google uses Analytics data for its own purposes, it does so as a separate controller under its own privacy policy.
Your financial data is not used to train AI models. Google does not use Vertex AI customer data to train its models, and we do not permit it.
Creem. Armitage Labs OÜ, trading as Creem, Rotermanni 14, Tallinn 10111, Estonia, is the merchant of record for your subscription. Creem takes your payment, handles VAT and issues your invoice, and is the controller for that payment data under its own privacy policy. We never see or store your card details.
SendGrid. Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA, delivers the emails Odyn sends — account, billing and cancellation emails, Peace of Mind messages, and the notice our team receives when you send feedback. SendGrid receives the recipient's name and email address and the content of the message, and acts as our processor under Twilio's Data Protection Addendum. A feedback notice contains your email address, your message and the page you sent it from — never your screenshot, which stays in Odyn and only our team can open.
Market data providers supply prices and exchange rates. We send them a ticker symbol, never anything about you.
We do not sell personal data. We do not disclose it to anyone for their own purposes, except where the law requires it or where it is necessary to establish or defend a legal claim. Using service providers to deliver Odyn to you is not a sale, and is not a disclosure of that kind.
External AI assistants you choose to connect
You can choose to connect your Odyn account to an external assistant such as ChatGPT through OAuth. The connection lets that assistant request data within the permissions you grant and the records available to your connected account. The current Odyn MCP tools read records and calculate figures; they do not place trades, transfer money or edit your financial records.
Depending on the assistant's tool request, Odyn can return portfolio names and identifiers, holdings, valuations, transaction history and its notes, debts, and calculated performance or risk figures. Odyn receives tool arguments such as portfolio identifiers, dates, currencies, filters and documentation questions. This integration does not require the assistant to send Odyn your entire conversation.
The assistant's provider processes the information it receives under its own terms, privacy policy and your settings with that provider. Those govern its retention and any use for model improvement; Odyn's statement about Vertex AI does not determine an external provider's practices. For ChatGPT, see OpenAI's privacy policy. Review the provider's policies and controls before connecting, including where it processes data and the safeguards that apply; processing may take place outside the EU.
You can disconnect an assistant in Odyn's Security Center to revoke future access. Disconnecting does not delete information the provider has already received; use that provider's own controls or contact it about deletion. Reconnecting requires a new authorization.
Data outside the EU
Google and Twilio (SendGrid) are US companies. Where your data reaches them in the United States, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both are certified, and on the Standard Contractual Clauses in their data processing terms. You can ask us for a copy of those clauses at support@odyn.app.
Creem is established in Estonia, within the EU, so no transfer arises there.
Anonymous, aggregated information
We may use information in aggregated and anonymised form — from which you cannot be identified, directly or indirectly, and which cannot be traced back to your account — to operate, secure and improve Odyn. Once information is genuinely anonymous it is no longer personal data. We do not sell it, and we do not publish it in any form that could identify you.
How long we keep it
We keep your data for as long as you have an account. Cancelling a subscription does not delete it: your account becomes read-only and your financial records stay available to view and export.
Feedback you send is kept until we have dealt with it and delete it, or until your account is deleted, whichever comes first. Deleting it removes the message and the screenshot. The email notice our team received keeps a copy of your message in our mailbox; we delete it when you ask us to delete your data. Feedback is not part of the in-app export — write to support@odyn.app if you want a copy.
Analytics data is kept for at most 14 months and then deleted automatically.
We delete your data when you ask us to. Write to support@odyn.app and we will act on it without undue delay. Some records may be kept longer where the law requires it, or where they are needed to establish or defend a legal claim.
Automated decisions
Odyn does not make automated decisions that produce legal effects for you or similarly significantly affect you, within the meaning of Art. 22 GDPR.
The AI features generate information, not decisions. Nothing they produce is investment advice or a personal recommendation, and nothing about you is scored, profiled or assessed to determine an outcome. Section 8 of our Terms & Conditions says more.
Keeping your data safe
Your data is encrypted in transit and at rest. Access is restricted and logged. We hold identity data separately from financial data, and we take regular backups.
No system is perfectly secure, and we do not claim otherwise. Please use a strong, unique password, and tell us at support@odyn.app if you think your account has been accessed by someone else.
Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy
- correct anything inaccurate or incomplete
- erasure of your data
- restrict how we process it
- portability — receive your data in a structured, machine-readable format
- object to processing based on our legitimate interests, on grounds relating to your situation
- withdraw consent at any time, where processing rests on consent
Write to support@odyn.app to exercise any of these. We answer without undue delay and within one month.
You also have the right to complain to a supervisory authority. Ours is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
mailbox@datenschutz-berlin.de
You may also complain to the authority where you live or work.
Cookies
Odyn uses cookies and similar technologies. Those needed to run the service are set without consent because the service cannot work without them. Anything else — including analytics — is set only after you have agreed, and you can change or withdraw that at any time through the cookie settings. Our Cookie Policy has the detail.
Children
Odyn is not for people under 18, and we do not knowingly collect their data. If we learn that we have, we delete it.
Google API data
Odyn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Changes
We update this statement when our processing changes. Where a change matters to you we will tell you by email or in the product before it takes effect. The date at the top shows when it last changed.
Contact
support@odyn.app, or by post to the address at the top.