Privacy policy

Effective 19 October 2026

This policy explains what MSE Today collects when you use our app and website, why we collect it, who helps us run the service, and how to ask us to show, fix or erase your data. We never sell your data. If anything here is unclear, email [email protected].

Who this covers

This policy applies to the MSE Today app (iPhone and Android) and the website at mse.today. We serve people in Malawi and around the world, so your data may be processed in other countries by the providers listed below. The service is run by MSE Today.

What we collect

When you sign in. You can sign in with Google or Apple. We store your email address and which of the two you used. From Google we also store your first and last name and your profile picture. Apple may hide your email behind a private relay address, and we only get the name and email Apple chooses to share. We create a username from the first part of your email address.

What you put into the service.

- Your portfolios: holdings, transactions, purchase lots, sales and the amounts you enter.

- Your watchlists and price alerts.

- Your preferred broker, if you pick one.

- Your progress in Learn, quizzes and daily games.

- If you opt in to the leaderboard, the name and avatar you choose to show there.

- Your Ask conversations (see "The Ask assistant" below).

- Feedback you send us.

When you subscribe.

- If you subscribe through the App Store or Google Play, Apple or Google takes the payment. We never see your card details. We use RevenueCat to check your purchase and keep your subscription status in step. RevenueCat knows you by your MSE Today account number, not your name.

- If you pay by mobile money or card through PayChangu, PayChangu takes the payment. We keep your phone number, the mobile money network, the payment reference, the amount and the dates, so we can match payments to your subscription and renew it. If you pay by card, you enter your card details on PayChangu's own page. We never receive or store them.

Notifications. If you allow notifications on your phone, we store a push token for your device, a device ID, whether it is an iPhone or Android phone, the app version, and when the device last connected. We need these to send you alerts. They can be stored for a phone that is signed out, so we can still send public market news to it. Notifications are delivered through Expo's push service and Apple or Google. You can turn notifications off in your phone's settings or in the app.

Technical information. Like most services, our servers see your IP address, device and browser type, and access logs.

Photos. If you save a share card to your phone, the app asks for permission to add it to your photo library. It can only save, and we never read or upload your photos.

Analytics and crash reports

We use these tools to understand how the service is used and to fix problems.

- Google Analytics on the website and Firebase Analytics (also from Google) in the app count visits, screens and taps. The app turns Firebase Analytics off in development builds only.

- Microsoft Clarity on the website and in the app records how people use screens (taps, scrolls, and what the screen looked like) so we can see where people get stuck. Clarity is set to hide sensitive information.

- Sentry in the app reports crashes and errors. Reports carry the error and the part of the app it came from. We remove your account details and request details before they are sent, and we blank out ids in web addresses. The website does not send crash reports.

The website's analytics use cookies. You can block or delete them in your browser settings, and the service still works without them.

How we use your data

We use your data to:

- sign you in and keep your account secure;

- store and show your portfolios, watchlists and alerts, and keep them in step across the app and the website;

- run your subscription and process payments;

- send the notifications you have allowed;

- answer questions you ask in Ask;

- measure how the service is used, find crashes, and improve it;

- follow the law and protect the service from misuse.

If you are in the EU or EEA, our legal bases are: performing our contract with you, and our legitimate interest in running, measuring and improving the service.

The Ask assistant

Ask is our AI assistant for understanding market data and your portfolio.

- What you type goes to an AI model provider through the Vercel AI Gateway. It can include details Ask needs to answer you, such as the companies you mention or, if you ask about your own portfolio, your holdings. The provider receives it only to write your reply. The provider may be OpenAI, Anthropic, xAI or Google, and which one answers can change.

- We save your conversations to your account so you can come back to them. You can delete them in the app. After you delete a conversation, we may keep a copy for up to 90 days to look into problems and improve Ask, and then we delete it.

- We also keep a usage log of each question: the text, the topic, which tools were used, which model answered, how many tokens it used and whether you are on the free or Premium plan. The log does not carry your name or account. We keep it for up to 90 days.

- We do not use your personal information or portfolio data to train AI models, and we only share it with AI providers that protect it as this policy describes.

You can create a share link to a portfolio. Anyone with the link can see it, so only send it to people you trust. A link shows either percentages only or full amounts, as you choose, and you can switch the link off at any time. Links stop working if you delete your account.

We never sell your data. We share what is needed with:

- Google for sign-in and analytics, and Apple for sign-in and for App Store purchases;

- Microsoft for Clarity;

- Sentry for crash reports;

- RevenueCat to confirm App Store and Google Play purchases;

- PayChangu to take mobile money and card payments;

- Expo, Apple and Google to deliver push notifications;

- Vercel and the AI model providers behind it, for Ask;

- the hosting companies that run our systems (see below);

- public authorities, if the law or a legal process requires it.

Where your data lives

Our website runs on Vercel and our server and database run on Railway, both in EU regions. Cloudflare provides our domain's DNS.

Because these providers work around the world, your data can leave Malawi. We take reasonable steps to keep it protected to a standard comparable to Malawi's and the EU's.

Market data

Prices, indices and company data shown in the service come from the Malawi Stock Exchange's public website and daily reports. This data is not about you and is not personal data.

Your phone's app lock

The optional app lock (PIN, Face ID or fingerprint) works on your phone only. Your PIN and your biometric data are never sent to us. Face ID and fingerprint are handled by your phone's own system.

Keeping your data

We keep your data while your account is open. You can delete your account in Settings, on the app or the website. Deleting your account closes it straight away: you are signed out, you cannot sign in again, and your share links stop working.

To have the rest of your data erased, email [email protected] and we will do it within 30 days. We may keep some records, such as payment records, as long as the law requires.

Security

We protect your data with HTTPS encryption, sign-in through Google and Apple (we never see your password), and limited access to our databases. No system is perfectly secure, so we cannot promise absolute security.

Your rights

You can email us at any time to:

- ask for a copy of the data we hold about you;

- ask us to correct or erase it;

- ask us to stop using your data for analytics;

- object to how we use it, where the law gives you that right.

Children

MSE Today is for people aged 18 or over. We do not knowingly collect data from anyone younger.

Changes to this policy

We may update this policy. When we make an important change, we will put a new effective date at the top. If you keep using the service after that, you accept the update.

Contact us

For privacy questions or to use your rights, email [email protected].

Governing law

This policy is governed by the laws of Malawi, without regard to its conflict of laws rules.