Privacy Policy

1. Who is responsible for your data

The controller of the personal data collected through ikigaifamily.com and the Ikigai iPhone application is Rita El Khoury, with registered address at Irakleous 22, Glyfada 16675, Greece.

For anything related to your privacy, write to ikigaiteam7@gmail.com.

2. What data we collect

Almost everything we store is written by you. We do not buy lists, we do not import data from third parties and we do not connect to your bank or your broker.

Account and identity

• Your email address and your password. The password is handled by the Supabase authentication service, is never stored in plain text and we cannot see it.
• The name you want to be called by, your preferred language and your base currency.
• Your Ikigai community username (the @evo_user field), if you choose to provide it when you sign up. It is optional.
• Account operation data: sign-up date, whether you completed onboarding, which guided tours you have seen, which modules you have been granted and your last sign-in.
• If you sign in with Google, we receive from Google your email address, your name, your profile picture and the identifier Google assigns to your account. We do not request or receive access to your Gmail, your Drive, your calendar or any other Google service.

Your finances

• Accounts: the name you give them, the type (cash, bank, credit card, investment, loan, asset or crypto), the currency, the opening balance, expected returns and whether it is an asset or a liability.
• Movements: amount, date, category, tag and any free-text note you write.
• Categories, monthly budgets per currency, fixed items and how you choose to allocate whatever is left over.
• Goals: name, what you want it for, target amount, date and priority.
• Net worth: monthly snapshots of your net worth with the breakdown by account and currency.
• Recurring rules and projection plans, with their assumptions, scenarios and calculated results.

Trading journal

• Your trades: instrument, side, entry and exit times, prices, stop loss, take profit, volume, commission, swap, result and balance.
• You can enter them by hand or upload a MetaTrader 4 or 5 report that you exported yourself. The file is parsed to extract those trades. We do not connect to your broker: we neither hold nor ask for your broker credentials.
• From the summary contained in that report we store the account figures: currency, balance, equity, margin and free margin.
• Your annotations on each trade: rating, flagged mistakes, free-text notes and any screenshot you attach, which is stored inside your own row in the database.
• Your playbooks, their rules and your journal notes.

Academy

• Your progress per lesson: whether you completed it, how many seconds of video you have watched, where you left off and any notes you write.
• Your quizzes: when you started, your answers, your score, whether you passed and how long you took.
• Which resources you downloaded and when.
• The messages you exchange with the team inside the academy. The team reads them: it is a support channel, not a private notebook.
• Which courses and lessons you have been granted, who granted them and until when.

Contact form

• If you write through the public form we store your name, your email address and your message.
• The team may add an internal note and mark the follow-up status of that contact.

Administrative activity log

• We keep a record of the administration team actions: who granted or revoked an access, who sent an email campaign, who invited or suspended someone. It includes the identity and email address of whoever did it.
• It is a log of what the team does, not of what you do inside the application.

What we do not collect

• We do not store your IP address or your browser in our database.
• We use no third-party analytics, no advertising pixels and no tracking tools: there is no Google Analytics, no Meta Pixel, no Hotjar and nothing equivalent.
• We do not collect health data, location data or biometric data.
• We do not carry out automated profiling that produces legal effects on you.
• We do not sell or rent your data to anyone, for anything.
• No payments are processed inside the application: there is no active payment gateway, so we neither receive nor store card details.

Free-text fields (movement notes, the purpose of a goal, journal notes, academy messages) are written by you. We do not ask you to put sensitive information there and we recommend that you do not.

3. Why we use the data and on what legal basis

• To provide the service: showing your accounts, calculating your budget, your net worth and your projections, keeping your journal and giving you access to the courses. Legal basis: performance of the contract you enter into by using Ikigai.
• To maintain your account and communicate with you about it: sign-up confirmation, password recovery, access granted notices. Legal basis: performance of the contract.
• To answer what you send us through the contact form or the academy messages. Legal basis: your consent in writing to us, and our legitimate interest in supporting you.
• To send you informational or commercial communications about Ikigai. Legal basis: your consent, which you can withdraw at any time by writing to ikigaiteam7@gmail.com.
• To keep the service secure and detect abuse, including the administrative action log. Legal basis: our legitimate interest in protecting the service and its accounts.
• To comply with legal obligations where they apply. Legal basis: legal obligation.

4. Who else processes your data

We do not hand your data to anyone for their own purposes. We work with these providers, who process it solely on our behalf and for the stated purpose:

• Supabase: database, authentication and file storage. Practically everything described above lives here.
• Vercel: hosting and execution of the web application. By the mere act of serving pages, its infrastructure processes IP addresses in technical logs.
• Resend: delivery of the application emails (confirmation, password recovery, invitations, notices and campaigns). It receives your email address, your name and the content of the message sent to you. When you write through the contact form, the internal notification includes your name, your email address and your message.
• Google: only involved if you choose to sign in with your Google account, in which case Google processes your identification as the sign-in provider. The typefaces are served from our own domain, so browsing Ikigai hands Google nothing.
• Academy video provider: lessons are played embedded from the service where they are hosted, currently Vimeo. The player also supports YouTube and Bunny Stream. When you play a lesson, that provider receives your IP address, your browser details and its own cookies.

None of these providers receives your financial movements or your trading journal, except Supabase, which is where they are stored.

Supabase, Vercel and Resend process this data as processors, meaning solely on our behalf and following our instructions, subject to the data processing terms that form part of their service agreement. Google and the video provider are not our processors: when your browser connects to them, they handle the information they receive as independent controllers under their own policies.

5. Where the data is hosted and international transfers

Your data is stored on Supabase infrastructure, in the eu-west-1 region (Ireland, European Union). The application runs on Vercel infrastructure.

The providers listed in the previous section are companies headquartered or operating infrastructure outside the European Union, mainly in the United States. If you reside in the European Economic Area, this involves an international transfer of data, covered by the standard contractual clauses approved by the European Commission that these providers include in their processing agreements.

6. How long we keep the data

• While your account exists we keep your data: it is precisely what the application gives back to you every time you sign in. We do not delete your movements or your history because of age.
• When your account is deleted, your profile, your accounts, your movements, your categories, your budgets, your goals, your net worth, your projections, your entire journal and your academy progress are deleted with it, immediately.
• Two things survive deletion, and we want to say so clearly: the administrative action log keeps the email address of whoever performed each action, and messages sent through the contact form are kept until the team deletes them by hand.
• If you wrote to us through the contact form without signing up, that message is kept until you ask for its deletion or the team removes it.

7. How we protect the data

• Every row in the database is protected by row level security policies: your session can only read and write your own rows, never another user rows.
• All traffic between your device and the service travels encrypted over HTTPS.
• Passwords are handled by the Supabase authentication service; they are not stored in plain text and we cannot look them up.
• Lesson files and audio are kept in private storage and served through temporary signed links, only after verifying that you have access.
• The administration team can see your account management data and the messages you send to the academy, because it needs that in order to support you.

8. Your rights and how to exercise them

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given.

• Access and rectification: most of your data is visible and editable by you inside the application, on each screen and in Settings. If you want a complete copy of everything we hold about you, request it at ikigaiteam7@gmail.com.
• Erasure: the application currently has no button to delete your own account. Write to ikigaiteam7@gmail.com asking for deletion and we carry it out. The deletion takes all your data with it, as explained in section 6.
• Portability: ask us at ikigaiteam7@gmail.com for your data in a structured format and we will provide it.
• Objection and restriction: write to ikigaiteam7@gmail.com explaining which processing you object to.
• Unsubscribing: write to ikigaiteam7@gmail.com and we will stop sending you informational or commercial emails. Emails essential to the operation of your account, such as password recovery, cannot be switched off while the account exists.

We will answer your request within a maximum of 30 calendar days. If you believe we have not handled your request properly, you may lodge a complaint with the data protection authority of your place of residence.

9. Cookies and session

We only use technical cookies, the ones strictly needed for the service to work. There are no advertising, analytics or profiling cookies.

• Session cookies from the Supabase authentication service: they keep you signed in without typing your password on every screen. They are removed when you sign out.
• A cookie named locale that remembers which language you want the application in.
• The home page also stores your language in your browser local storage, under the key ikigai-lang. It never leaves your device.
• Academy videos are played embedded from the external provider, which may set its own cookies in your browser once you press play. That falls under the policy of that provider.

10. The iPhone application

The Ikigai iPhone application shows the same web application inside a native container, so everything above applies equally. These are the differences specific to the phone:

• Face ID and Touch ID: the application may ask for your face or your fingerprint to unlock when you open it and when you return from the background. That check is performed entirely by iOS. The application only receives a yes or no answer from the system. Your fingerprint and your face never leave your phone, the application never receives them, and they never reach our servers or those of any provider. We store no biometric data, neither on the phone nor anywhere else.
• If your phone has no Face ID, Touch ID or passcode configured, the application opens anyway: there is nothing to verify and we do not want to lock you out of your own data.
• Your session is stored in the encrypted system keychain, not in ordinary application storage.
• When the application goes to the background the screen is covered, so the system does not keep an image with your figures visible in the app switcher.
• The application does not track your activity inside or outside it, and shares nothing with other applications or advertising networks. That is what its privacy manifest declares to Apple.

11. Minors

Ikigai is intended for people over 18. We do not knowingly collect data from anyone under that age. If we find that an account belongs to a minor, we will delete it together with its data. If you are a parent or guardian and believe this has happened, write to us at ikigaiteam7@gmail.com.

12. Changes to this policy

If we change this policy, we will publish the new version at this same address with its update date. When the change materially affects how we handle your data, we will notify you by email before it takes effect.

13. Contact

For any question, or to exercise your rights, write to us at ikigaiteam7@gmail.com. If you prefer postal mail, the address is Irakleous 22, Glyfada 16675, Greece.