Catalyst Privacy Policy

Catalyst Finance, Inc.

Version 2.0 — Effective: June 11, 2026

Last Updated: June 11, 2026

1. Introduction

Catalyst Finance, Inc. ("Catalyst," "we," "us," or "our") provides the Catalyst mobile application and web platform (the "Service"). This Privacy Policy explains how we collect, use, share, and retain information when you use the Service. The Service is offered to residents of the United States, is operated from the United States, and your information is processed and stored in the United States.

By using the Service, you consent to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account information: email address and password, or the name and email address shared by your sign-in provider (Google or Apple; Apple may provide a private relay email if you choose to hide yours).
• Profile and onboarding information: an optional display name and profile photo, and your selections during onboarding and in settings, such as investment goals, self-described investing experience, and preferred sectors, markets, commodities, and topics. We may also derive preferences from your answers — for example, an inferred investing-style or risk preference based on your self-described experience. Derived preferences are used only to select and organize content, as described in Section 3.
• Content you create: watchlists, saved collections, notes, manually entered positions and trades, and feedback you submit (feedback is stored with your account identifier and email).
• AI chat conversations: the messages you send to the AI chat feature, the responses generated, and related context, as described in Section 4.
• Waitlist and communications: if you join a waitlist or contact us, the email address and message contents you provide.

2.2 Information from Linked Financial Accounts

With your authorization, you may connect brokerage, financial, or crypto-exchange accounts through third-party account aggregation services — Plaid Inc. ("Plaid") and SnapTrade — which retrieve, on a read-only basis: account identifiers and institution names; portfolio holdings (securities and digital assets, quantities, prices, and values); account balances; and investment transaction history (such as buys, sells, and dividends).

Your financial-institution login credentials are entered only on the aggregation provider's own pages — we never receive or store them. Access credentials issued to us by the aggregation providers are stored in encrypted form.

We use third parties to gather your data from financial institutions. By using the Service, you grant our third-party providers the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution according to the terms of those providers' privacy policies. Plaid's handling of your data is governed by Plaid's End User Privacy Policy, available at https://plaid.com/legal. SnapTrade's handling of your data is governed by its privacy policy, available on SnapTrade's website.

2.3 Information Collected Automatically

• Device and log information: device type and identifiers, operating system version, IP address, access times, and app version.
• Usage information: features used and content viewed, used to operate and improve the Service.
• Push notification tokens: if you enable notifications, a device push token associated with your account.
• Crash and diagnostic data: error and crash reports collected through a third-party error-reporting service, which may include your IP address, device information, and account identifiers.
• Web cookies and local storage: when you use the web version, we use cookies and browser local storage to maintain your session and remember preferences. We do not use advertising trackers, and we do not respond to browser "Do Not Track" signals.
• Biometrics: if you enable biometric unlock (such as Face ID), authentication is processed entirely on your device by its operating system. We never receive or store biometric data — only a pass/fail result.
• On-device data: some information — such as your search history and display preferences — is stored only on your device and is not transmitted to us. You can clear it by signing out or uninstalling the App.

3. How We Use Information

We use the information we collect to:

• Provide the Service — operate your account, portfolio tracking (linked-account and manually entered data), watchlists, and collections.
• Personalize content — use your stated and derived preferences, watchlists, and linked holdings only to select, filter, and organize impersonal content that is published generally to all users. We do not use this information to provide individualized investment advice or to assess the suitability of any investment for you.
• Operate AI features — process your chat messages and related context, as described in Section 4.
• Communicate with you — send account, security, and service communications and, with opt-out, marketing communications, using your email address and push tokens.
• Protect the Service — detect and prevent fraud, abuse, and security threats, using device, log, and diagnostic data.
• Improve the Service — analyze usage data, crash reports, feedback, and aggregated or anonymized analytics.
• Comply with law — meet legal obligations, where required.

4. AI Features

The Service's AI chat and content features are powered by third-party artificial intelligence service providers. When you use the AI chat, the content of your messages, your prior messages in the same conversation, and limited context — such as ticker symbols you select or that appear in your watchlists or linked holdings, and content you attach — are transmitted to those providers to generate responses. We do not provide them with your name, email address, account credentials, or the quantities or balances in your accounts.

Your conversations are stored with your account in our systems. Copies processed by our AI providers are retained by those providers under their own policies, and deleting a conversation or your account does not delete the copies they hold. Do not submit sensitive personal or financial information through chat.

5. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With service providers that process data on our behalf under contractual obligations to protect your information consistent with this policy, in these categories: cloud hosting, database, and storage; account aggregation (Plaid and SnapTrade, as described in Section 2.2); artificial-intelligence providers (Section 4); crash and error reporting; and push-notification delivery.
• For legal reasons: if required by law, regulation, court order, or other governmental request, or to protect our rights, users, or the public.
• In a business transfer: in connection with a merger, acquisition, or sale of assets, subject to this policy's protections.
• With your consent: for any purpose not described here.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect your information, including encrypted storage of financial access credentials and role-based access controls. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention and Deletion

We retain your information while your account is active. You may delete your account at any time in the App's settings. When you delete your account, we revoke our connections at the account aggregation providers, delete stored access credentials, your profile photo, and push tokens, and delete your account data. Limited residual copies (such as backups and archived records) may persist for a limited time after deletion and are retained longer only where required by law; aggregated or anonymized data that no longer identifies you may be retained. Copies of chat content held by our AI providers are subject to their retention policies, as described in Section 4.

You may also disconnect a linked financial account at any time in settings, which stops further syncing and deletes the holdings and transactions synced from that account from our systems, and revokes our access authorization for that account at the aggregation provider.

8. Your Choices and Rights

• Linked accounts: disconnect at any time in settings, or revoke access directly with the aggregation provider (for Plaid, at https://my.plaid.com).
• Notifications: enable or disable push notifications by category (insights, price alerts, digests) in settings or through your device.
• Marketing emails: opt out via the unsubscribe link in any marketing email. You will still receive transactional emails while your account is active.
• Biometric unlock: enable or disable at any time in settings.
• Access, correction, deletion: you may request a copy of, correction of, or deletion of your personal information by contacting us at the address below. We respond within 30 days.

9. Children's Privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. We will post the updated policy in the Service, update the "Last Updated" date, and notify you of material changes through the Service or by email. Continued use after changes are posted constitutes acceptance.

11. Contact Us

Catalyst Finance, Inc.

501 Knights Run Ave Apt 1302, Tampa, Florida 33602

Email: contact@catalystfinance.ai