Privacy Policy

1. Who we are

This Privacy Policy describes how the SHUYA.CAPITAL mobile application (the "App") collects, uses, and protects your personal data.

1.1 Operating entity and data controller

The App is owned and operated by SHUYA rev.A L.L.C-FZ ("SHUYA") — a UAE Free Zone limited liability company licensed by Meydan Free Zone under licence number 2643539.01 for the following activities:

• Investments Consultancy (UAE Activity Code 6619.11)
• Activities Auxiliary to Financial Services (UAE Activity Code 6610.00)
• Own Account Investment Activities (UAE Activity Code 6499.02)

SHUYA is the data controller for the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent regimes. The Apple Developer Program membership and App Store seller are assigned to SHUYA rev.A L.L.C-FZ. All references to "we", "us", or "our" in this Policy refer to SHUYA.

This revision reflects the completed Apple Developer Individual-to- Organization migration and the corresponding controller identification. The factual data-collection practices described below have not changed.

1.2 Audience

The App is offered exclusively to limited partners and authorized counterparties of the SHUYA Capital fund. The App is not available to the general public and is distributed under Apple's Unlisted App Distribution program. The production app is live and accessible only through its direct Unlisted link; it is not discoverable through App Store search or charts.

2. Information we collect

We collect only the information necessary to authenticate you and operate the App. We do not collect data for advertising, tracking, profiling, or any commercial purpose outside the App's stated function.

2.1 Information you provide

• Email address — required for sign-in. Stored in our authentication database (Supabase Auth, hosted by SHUYA in Germany).
• Password — stored only as a salted bcrypt hash; we never see or store your password in clear text.
• Display name (optional) — for personalized greetings in the App.
• Access request details — if you submit the "Request access" form: name, email, organization, and message text.

2.2 Information generated automatically

• Session tokens (JWT) — issued by Supabase Auth on each sign-in and stored locally in platform secure storage (iOS Keychain or Android Keystore-backed storage).
• Device biometric preference — a single flag indicating whether you have opted in to Face ID / Touch ID unlock. Stored locally on your device only; never transmitted.
• Push notification data (optional) — after you grant notification permission, an Expo push token and a random per-install identifier are stored with your user ID, platform, app version, and last-active timestamp. They are used only to deliver notifications, distinguish your installations, and remove stale tokens.
• Crash and performance diagnostics — redacted stack traces, app/OS/device context, session health, and sampled performance traces sent to Sentry (organization "shuya-capital"). Default PII, screenshots, view hierarchy, email addresses, JWTs, request credentials, and brokerage account IDs are excluded or redacted. Used solely to diagnose and fix defects.
• Server access logs — every request the App makes to our API is recorded on our own server in Germany with: date and time, your user ID and role, IP address, HTTP method, endpoint path, response code, response time, and the App version string. No request or response bodies, and no portfolio figures, are stored in these logs. They are used to operate and secure the service — investigating errors, detecting abuse, and understanding which parts of the App are used so we know where to improve it. This is a first-party log on infrastructure we control; it is not shared with an analytics vendor and is never used to track you across other apps or websites.

2.3 Information we do NOT collect

• Geographic location
• Contacts, calendar, photos, microphone, or camera data
• Health, fitness, or biometric measurements
• Advertising Identifier (IDFA) or cross-app tracking identifiers
• Browsing or search history outside the App
• Payment card numbers, bank account details, or credentials
• Government identification numbers (KYC documents are collected through offline channels separately, not through the App)

3. How we use your information

We use your information only to:

• Authenticate you and protect your account from unauthorized access
• Display data about your participation in the SHUYA Capital fund
• Communicate with you about your account and material fund events
• Fix bugs and performance issues reported through redacted diagnostics
• Comply with applicable legal obligations

We do not:

• Sell or rent your data to third parties
• Use your data for marketing, advertising, or profiling
• Share your data with data brokers
• Use your data to train AI models

4. Where your data lives

• Authentication & application data — stored on servers operated by SHUYA in Germany (DE), in a self-hosted Supabase instance. Access is restricted to authorized SHUYA operators.
• Session credentials on your device — stored in platform secure storage. Only the App can read them.
• Push token records — stored in SHUYA's self-hosted Supabase database in Germany; Expo processes the token to deliver notifications through APNs/FCM.
• Crash and performance diagnostics — stored by Sentry's hosted service (current project region: United States) for a retention period of 30 days, then deleted.
• OTA app updates — delivered by Expo (a service of 650 Industries, Inc., United States). Expo receives only the runtime version of your device and the App's update channel; it does not receive your account data.

All transit is protected by TLS 1.2 or higher.

5. Your rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to update inaccurate or incomplete data
• Deletion — ask us to delete your account and associated data (also available in the App at Settings → Account → Delete account)
• Portability — receive your data in a machine-readable format
• Objection / restriction — ask us to stop or limit processing
• Complaint — lodge a complaint with your local data protection authority (UAE: UAE Data Office; EU: your national DPA)

To exercise any of these rights, email privacy@shuya.capital. We respond within 30 days.

6. Account deletion

You can delete your account at any time:

• In the App: Settings → Account → Delete account. Confirmation required. Deletion is irreversible.
• By email: send a request to privacy@shuya.capital from the email address associated with your account.

Account deletion removes:

• Your sign-in credentials
• Your display name
• Your biometric preference
• Your push notification token (if any)
• Your access request history

Server access logs are NOT removed by account deletion. They keep your user ID for up to 12 months from each request so that a security or fraud investigation covering that period is still possible, and are then deleted automatically. They contain no portfolio figures — section 2 lists exactly what they hold.

Fund-side data (positions, statements, K-1s) that we are legally required to retain is preserved in our books for the retention period required by UAE law, but de-linked from your identity within the App.

7. Children

The App is intended for adult limited partners of the SHUYA Capital fund only. We do not knowingly collect data from anyone under 18.

8. Cookies and similar technologies

The App does not use cookies, web beacons, pixel tags, fingerprinting, or any tracking technology.

9. Third-party services

The App relies on the following third-party processors. Each acts as our data processor under our instructions:

We do not share data with advertising networks or third-party analytics providers, and we do not share it with anyone not listed above.

10. Security

• Passwords are hashed with bcrypt (cost factor 10) — clear text never stored or transmitted after initial sign-in
• All transit between your device and our servers uses TLS 1.2+
• Session tokens are stored in platform secure storage, accessible only to the App
• The App requires Face ID or device passcode to unlock when biometric unlock is enabled
• No financial credentials (bank, broker) are stored, transmitted, or requested by the App

If a personal-data breach occurs, we will notify affected users and competent authorities as required by applicable law.

11. Data retention

12. International transfers

Data may be processed in Germany (our primary servers) and the United States (Sentry, Expo, Apple, Resend), and at Cloudflare and Telegram edge locations worldwide. Where data leaves the UAE, we rely on contractual safeguards equivalent to the EU Standard Contractual Clauses.

13. Changes to this Policy

We may update this Policy from time to time. The current version is always the one published at this address, and the "Last updated" date shows when it last changed. We may notify you of a change through the App or another channel where applicable law requires it. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after a material change constitutes acceptance of the updated Policy.

14. Governing law and contact

This Policy is governed by the laws of the Emirate of Dubai and the applicable federal laws of the United Arab Emirates.

For questions, requests, or complaints, contact:

SHUYA rev.A L.L.C-FZ (data controller)
Privacy contact: privacy@shuya.capital
Postal address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.