Molio Privacy Policy

Last updated: October 25, 2026

1. Who we are

Molio is operated by KEPLOOM TECH FZCO, a company registered in the Dubai Integrated Economic Zones (License No. 78779), Dubai Technology Entrepreneur Campus (DTEC), Dubai Silicon Oasis, Dubai, United Arab Emirates. KEPLOOM TECH FZCO is the data controller for the personal data described in this policy.

Contact for anything in this policy, including privacy requests: privacy@keploom.com.

Our website, molio.app, describes Molio and carries this policy, our Terms of Use and support information. It runs no scripts and contains no analytics or advertising. Cloudflare hosts it (Section 6).

During the closed beta, Molio is distributed through Apple TestFlight under KEPLOOM TECH FZCO's own Apple developer account.

2. What Molio is (and is not)

Molio is a read-only portfolio tracker and investment-education app. You enter your holdings yourself; Molio never connects to your brokerage, never holds brokerage credentials, and never moves money. Market prices refresh automatically; your share counts and transactions change only when you edit them. Molio provides educational analysis, not investment advice.

3. Information you give us

• Account. Your email address and a password (salted and hashed by our authentication provider; we never store it in readable form) — or your identity via Google Sign-In (your email and the basic profile details Google provides) or Sign in with Apple (email only; we deliberately do not request your name, and Apple lets you use a private relay address if you prefer).
• Subscription — only if you subscribe. If you buy Molio Plus through Apple, we store your subscription's status, plan (monthly or yearly), the date its current period ends and when it last changed, as RevenueCat reports them, together with a log of RevenueCat's notices about it. We never receive your card or payment details. These are deleted with your account.
• Profile and preferences. An optional display name, language (English/Arabic), numeral preference, display currency, appearance, timezone, and similar display settings.
• Profile photo — only if you add one. You can add a profile photo from your camera or photo library. Molio makes a smaller copy on your phone, without the location or other details stored inside the original, and keeps only that copy, in private storage other users cannot reach. It is shown in the app, including on the App Lock screen, where anyone holding your phone can see it before Face ID or your passcode unlocks Molio, and it is never sent to our AI provider. Removing the photo, or deleting your account, deletes it.
• Religious preferences — only if you choose. Molio's Sharia-aware and Zakat features are optional. Your annual Zakat date is recorded only when you set it; the default state is "not set". Molio does not ask for or store your madhhab (school of jurisprudence); values recorded before this version were deleted. Molio records no Zakat amount, because it calculates none — the reminder tells you the date has arrived and the calculation is your own. (Accounts created before August 2026 may also hold a Sharia stance, a setting Molio has since removed; it is no longer shown, changeable, or sent anywhere.) We treat this as sensitive data: it is used solely to render the features you enabled, and it is included in the AI-processing disclosure in Section 5. Molio no longer asks you to declare a Sharia stance at all. If you use the Zakat reminder you choose your annual Zakat date, and you can remove that reminder at any time from the Zakat screen — which clears the date and stops the notifications. Whether Sharia markers are shown is a display setting kept only in the app on your device; Molio does not receive it or store it with your account.
• Portfolio data you enter. Portfolios (including an optional broker name you may type for your own reference — it is a label, not a connection), holdings, transactions, cash amounts you choose to record (one amount per currency for your account, not tied to any portfolio; Molio does not hold or move this money), goals, watchlist entries, strategies you choose to track, and optional notes. CSV files you import are read and parsed on your device; only the resulting rows are stored in your account.
• Molio Plans — only if you make one. A plan is something you write yourself. It holds the name you give it, the strategy it follows, the portfolio it belongs to, and the securities in it and how you split contributions between them. It also holds the amount and currency you plan to contribute and how often, its start date, the time and time zone for its reminders, and how often you want to review it. If you set them, it holds a target mix by category, a band around that mix, an amount of cash you count toward it, and your notification choices. When you log a contribution, Molio records the date it was due, the security, and the quantity, price and currency you entered, and adds the buy to your portfolio as a transaction; when you skip one, it records only that you skipped that date. The AI Coach does not read your plans. A buy you log through a plan becomes a transaction in your portfolio, and the Coach can look up your transactions like any others (Section 5). The plan's name is free text that stays in your account — it is not included in notifications or in our audit record — so please don't put personal details such as names or addresses in it.
• Coach conversations. The messages you type to the AI Coach and the Coach's responses are stored as your conversation history. That history also includes a technical record of the portfolio data the Coach looked up to answer each question (for example, your holdings summary at the time you asked).
• Feedback. If you flag a Coach response ("this is wrong", thumbs-down), we store the flag and any comment you add. Flagged responses are reviewed to improve Molio and may be kept as internal test cases to prevent regressions; test cases derived from flags may be retained even if you later delete your account.

4. Information created as you use Molio

• Derived insights. Molio computes behavioral-pattern indicators (for example, concentration risk) from your transactions on a regular schedule. It also records the value of your portfolio: a reading every 15 minutes, for the one-day chart on the Home screen, and one reading a day, for the longer charts. Each reading is the value of your investments, in your display currency (the figure labelled "Investments" when you record cash), with the total of any cash you record stored beside it. These stay in your account; the behavioral indicators inform the AI Coach's answers when you ask about your habits.
• Plan reminders. If you have a plan, Molio checks it every 15 minutes against the dates and times you set. When a contribution date or review date you set arrives, when a category of your target mix moves outside the band you set, or — if you kept that choice on — when new company figures arrive for a security in a Quality Growth or Dividend Income plan, Molio adds a notice to your notifications list and, if you allowed notifications, sends it to your phone. To avoid repeating notices, Molio keeps a note of whether each category was last inside or outside your band, and of the date of the latest company figures it has seen for the plan's securities. Paused and archived plans get no reminders.
• Service and compliance records. We keep per-query technical logs for the AI Coach (model used, token counts, cost, timing, the type of question it was classified as (for example a portfolio or a Sharia question), which tools and disclosures were used, your app language and numeral setting, and whether the answer completed or failed with any error detail, and similar, without message text) and an append-only audit record of consent acknowledgments and significant account events (for example, a Sharia-stance change, a holding deletion, or a change to the cash you record), protected as described in Section 8, together with limited app metadata (app version, display language). Once a month we use the dates your account was created, last signed in or last refreshed its session, the per-query technical logs, and the account-deletion entries in the audit record to count how many accounts were active or deleted that month, and how many accounts existed in total, because the terms of our market-data license depend on the number of users. We keep only the totals; if we need to report them under that license, the market-data provider receives the totals and nothing about any person. Like most online services, our providers also process IP addresses in server and security logs. Our hosting provider's request logs record each request the app makes to our servers: its time, the web address requested (which can name a security or a plan you open, but not the text you type into Search) and, when you are signed in, your account identifier. In app versions before 1.0.5 the search text was part of the web address. We do not control how long the provider keeps these logs, and deleting your account does not delete them.
• Crash and error reports. If something breaks or the app stops responding, an error report is sent to our error-monitoring service (Sentry, EU data ingest), from the app or from our servers. A report from the app contains the error and where in our code it happened; the app version and which update of it is running; technical device context (for example, device model, operating system and version, memory, and your language, region and time-zone settings); and a short trail of recent technical steps in the app (for example, a tap, a call to our servers and whether it succeeded, or a log line from our code). It may also contain a random identifier the error-reporting software creates for this installation of the app. For errors in the app's own code, sign-in tokens, account identifiers and the values in web addresses are removed before the report is sent; crash reports from the phone's native layer are sent as the error-reporting software builds them. Earlier versions of the app also attached your random account identifier to its reports. A report from our servers contains the error, where in our code it happened, technical details our code attaches (for example which step failed), and, where relevant, your random account identifier. Our error-monitoring service is configured not to store the IP address a report came from. We do not run performance tracing, session replay, or analytics.

5. AI processing (Anthropic)

When you use the Coach, the following is sent to Anthropic — our AI provider, processing in the United States — to generate the response: your message, the history of the conversation you are in (up to its last 100 messages), and the portfolio data needed to answer (for example, holdings summaries and values, the Sharia status of the securities you hold, your Zakat reminder state, and behavioral-pattern indicators). The cash amounts you record in the app are not sent, unless you type them into a Coach message yourself. Under Anthropic's commercial API terms, this data is not used to train Anthropic's models; Anthropic may retain API data for a limited period for abuse prevention under those terms. Before anything is sent, a screening filter blocks messages containing certain obvious sensitive identifiers (such as card numbers or U.S.-format Social Security numbers); this is a safety aid, not a guarantee — please do not type passwords, card numbers, or government IDs into the Coach.

6. Service providers

We share personal data only with the processors that run Molio:

We do not sell personal data, we show no ads, and the app contains no third-party analytics or advertising SDKs.

7. What we don't collect, and push notifications

No contacts, location, or microphone access. Molio uses the camera or photo library only when you choose a profile photo. No advertising identifiers. No brokerage credentials, ever.

If you allow notifications, Molio stores a push-notification token for your phone so that price alerts and plan reminders can reach it. The app asks for permission during setup, when you create a price alert or a plan, and when you set up a Zakat reminder, and you can also allow notifications later in your device settings. While notifications are allowed, the app registers the token again each time it starts while you are signed in and each time you sign in, because tokens can change. With the token we store your phone's platform (iOS or Android). Earlier versions of the app also stored the device name your phone reports to apps (on iPhones running current iOS versions this is a generic "iPhone" or "iPad", not the name you gave the phone; on other phones it can be the name you gave the device); current versions do not, and a name stored earlier is removed when the app next registers that token, and is deleted with the token.

When it first registers a token, the app also creates a random code and keeps it in your phone's secure storage (the keychain on iPhone), where it stays on that phone. We store only a one-way hash of that code, next to the token, and use it for one thing: a token can move to a different account only when the request comes from the phone that holds the code — for example, when someone else signs in on your phone. The code is not an advertising identifier, and we use it for nothing else. It stays on the phone when you sign out (on iPhone it can survive deleting and reinstalling the app); its hash is deleted along with the token.

Turning notifications off in your device settings stops them appearing, but it does not delete the token: our servers are not told, so we may still send notifications to that phone through Expo and Apple or Google, and your phone does not show them. Signing out on that phone normally removes the token, and deleting your account always does (Section 9). Zakat reminder notifications are scheduled on your device and never pass through our servers or Expo. The date you choose is saved in your account, as described in Section 3. Once you allow notifications for them, the app registers the token described above the next time it starts or you sign in.

8. Security

Data moves over encrypted connections (TLS). Every account's data is isolated by row-level security rules that are tested in our release pipeline. Passwords are salted and hashed by our authentication provider and screened against known breaches at sign-up and password reset (when the screening service is reachable). Audit records are append-only: our systems block changing or deleting an entry once it is written, except that deleting your account removes your account identifier from them (Section 9). Entries are also hash-chained, and we check the chain on a schedule, so a change to an entry, or the removal of an entry from the middle of the record, made outside those systems would show up at the next check. Someone with full administrative control of our database, such as our own administrator account or our hosting provider, could remove the most recent entries, or rewrite the records and the chain together, without the check showing it. Rate limiting and abuse protections apply to authentication and to market-data and Coach data requests. For those requests we keep a count of your requests in the current minute and the current day, and the time a request was last refused; the counts are overwritten as you use Molio and deleted with your account. Our database provider maintains encrypted backups for disaster recovery. Molio makes no automated decisions about you with legal or similarly significant effects. No system is perfectly secure; if an incident affects your data, we commit to honest and prompt communication.

9. Retention

Your data is retained while your account is active.

• Holdings you remove stop appearing immediately, but the underlying records — including the transaction history behind them and a snapshot (with any notes) in our audit record (Section 8) — are retained for accuracy and audit integrity.
• Coach conversations you remove stop appearing in your conversation list immediately, but the underlying messages are retained until your account is deleted. The per-query technical logs described in Section 4 (model used, token counts, cost, timing and similar, without message text) are kept after account deletion with your account identifier removed. We keep these logs for as long as we license market data from Financial Modeling Prep and for two years after that license ends, and then delete them.
• Notifications you remove stop appearing in your notifications list immediately, but the record behind each one — price alerts and plan reminders alike — is retained until your account is deleted: its full text (for a plan reminder, including any amount you chose to hide from the notification itself), the details it was built from (such as the ticker, the price and the level you set), when it was created, whether it was handed to our push provider and what that provider reported back about delivery, and, until the provider reports back or we stop waiting for it (usually within a day), the push token of the phone it was sent to.
• Push token. Deleted when you sign out on that phone, if the phone can reach our servers at that moment. If it cannot, the token stays linked to your account — and your notifications can keep reaching that phone — until you sign in and out on that phone again, another account signs in on it while notifications are allowed there, or you delete your account. Signing out on one phone also ends your sessions on your other phones but does not delete their tokens. Deleting your account deletes every token. If Apple or Google tell us a phone no longer accepts notifications (usually because the app was deleted from it), we stop sending to that token and delete it about 30 days later. A copy of the token also stays in each notification record until our push provider reports back on delivery, or we stop waiting for it, usually within a day (see Notifications).
• Molio Plans you delete are removed straight away, together with their securities list and contribution log. Buys you logged through a plan stay in your portfolio as transactions (see Transaction records), and plan reminders already in your notifications list stay there (see Notifications). Pausing or archiving a plan keeps it but stops its reminders. If your account loses access to Plans, your plans are kept but their reminders stop. Each time you save a plan, our audit record notes the plan's identifier, its strategy and the version of the Terms or disclosure the save rested on — not the plan's name or any amount — and that note is kept as described under Account deletion; a contribution you log is recorded there like any other buy you enter.
• Transaction records cannot be deleted item-by-item; they are retained until your account is deleted.
• Cash amounts you change or remove update immediately, but each change, with the amount before and after, stays in our audit record (Section 8). Recorded cash belongs to your account rather than to a portfolio, so deleting a portfolio does not change it. When Molio moved recorded cash from portfolios to your account, cash still recorded in a portfolio you had already deleted was removed; its earlier changes stay in the audit record.
• Portfolio value readings. Molio deletes 15-minute readings after 48 hours: each time it takes a new reading for you, it deletes your readings older than 48 hours. If it takes no new reading for you — for example, after you remove all your holdings and any cash you record — your last readings stay until it takes one again or you delete your account. Daily readings are kept for about two years (760 days); older ones are deleted. Deleting your account deletes all of your readings straight away.
• Profile photo. Removing your photo deletes it from our storage and from the app's copy on your phone. Our database backups do not include the photo itself, so a removed photo is not restored from them.
• Account deletion — in the app (Home screen menu → Profile → Delete account) or by email — takes effect immediately and removes your account and the personal data linked to it. Compliance and audit records and the per-query technical logs (for how long the logs are kept, see Coach conversations above) are retained with your account identifier removed, but the event details inside the audit records (for example your Terms acceptance, snapshots of holdings and transactions you created, changed or deleted, including amounts and notes, the cash amounts you recorded before and after each change, and short excerpts of Coach replies flagged by our compliance checks) are preserved as recorded, for legal and audit integrity.
• Copies of deleted data persist in encrypted backups for a limited period. Error reports are retained by our monitoring service under its own schedule.

10. Your rights

Subject to applicable law (including the UAE Personal Data Protection Law and, where it applies to you, the GDPR), you can request access to, correction of, export of, or deletion of your personal data. During the beta, send requests to privacy@keploom.com — we aim to respond within 30 days. You can also delete your account yourself in the app: open the menu on the Home screen, then Profile → Delete account. If you signed in with Apple, deletion also revokes Molio's access to your Apple ID. Deleting your account does not cancel a subscription billed by Apple; cancel it in your Apple ID subscription settings. Deleting your account also does not delete the subscription records RevenueCat holds under your account identifier; email privacy@keploom.com and we will have them deleted.

Where the GDPR applies: we process your account and portfolio data to provide the service you signed up for (performance of contract), and your religious preferences only on the basis of your explicit consent. You can withdraw that consent at any time by removing your Zakat reminder in the app — which clears your Zakat date — or by contacting us to have the underlying values erased — withdrawal does not affect processing that already happened. Your profile photo is optional; we process it on the basis of your consent, which you withdraw by removing the photo. You may also lodge a complaint with your local supervisory authority.

11. International transfers

We are a UAE company; the services that run Molio process data in the regions listed in Section 6 (Germany for the Molio app from the App Store, Japan for our beta test environment, and the United States); our email (Google Workspace) and our website (Cloudflare) are served from those providers' data centers around the world. We use established providers, we require them to protect your data, and we are putting a data-processing agreement in place with each provider that handles your personal data.

12. Age

Molio is for adults. The service is not directed to anyone under 18, and you must be 18 or older to create an account.

13. Beta note

This policy covers the Molio mobile application, including TestFlight beta builds, and our website, molio.app. It is a founder-authored interim, pending legal review.

During TestFlight distribution, Apple's TestFlight terms also apply; feedback you submit through TestFlight's own feedback tools goes to Apple and is shared with us under those terms.

14. Changes to this policy

This policy is versioned. If we make material changes, we will update the "Last updated" date above and the version at the end of this policy, and take reasonable steps to notify you — for example, by email or a notice in the app — and, where required, ask you to acknowledge the new version.

Version: privacy-v1.5.1-beta