Transparency
Privacy policy & cookies
Last updated 18 August 2026
Catalyst does not use third-party advertising or cross-site tracking cookies, and we never sell your data. Everything below is stored either in your browser or in your own account records.
Essential storage
Always active — the app cannot sign you in or remember your choices without it.
- Your sign-in session token, so you stay logged in between visits.
- Your "remember me on this device" preference and remembered email address.
- Acceptance of the not-financial-advice disclaimer.
- Your answer to the cookie banner itself.
Optional product analytics
Off until you agree. When enabled, we record a small set of interface events so we can see whether features are working:
- Install prompt shown, dismissed, accepted or declined, and app installed.
- Push notification prompt shown, accepted or dismissed.
- A randomly generated session id and a coarse platform label (iOS, Android, desktop) — no IP-based profiling, no advertising identifiers, no data sold or shared.
Turn this off and collection stops immediately; the random session id is deleted from this device.
Your choices
Product analytics
Anonymous install and push prompt events, tied to a random session id — never to other websites. Turning this off stops collection immediately and clears the session id on this device.
Essential storage
Sign-in session, remembered device and disclaimer acceptance. Required for the app to work, so it can't be switched off.
Your account data
Holdings, watchlists, ratings and settings are stored against your account and are only readable by you. You can download everything or delete your account from Settings at any time.
Depending on what you use, that record can include:
- your email address and sign-in details;
- portfolio holdings imported from Trading212, CSV files or screenshots (screenshots are kept in private storage so you can revert an import);
- your broker API key, held encrypted and used only to read positions and balances;
- notification, alert and display preferences, including a phone number if you add one;
- saved items, reminders, citation watches and support messages you send us.
Why we hold it
To run the account you asked for: to sign you in, calculate exposure and event risk, generate research, send the alerts you switched on, and answer your support requests. Optional analytics are used only with your consent, and you can withdraw it at any time.
Who processes it
We use a small number of providers to operate the service. They process data on our instructions only:
- our cloud backend, for database, authentication and file storage;
- AI model providers, to generate research and read imported screenshots;
- market data providers, for calendars, prices and filings;
- Trading212, when you choose to connect it;
- our email delivery provider, for account and alert emails.
We do not sell your data or share it for advertising.
How long we keep it
Account data is kept while your account is open. Delete your account and we remove your personal records, imports and stored screenshots, other than anything we must keep for legal or accounting reasons. Import screenshots can be removed earlier by reverting the import.
- Account, holdings, watchlists, alerts and settings: kept while your account is open, deleted when you delete it.
- Import screenshots: kept until you revert the import or delete your account, and in any case no longer than 12 months.
- Support messages: kept for 24 months so we can show a history of an issue.
- Optional analytics events: kept for 12 months, then deleted.
- Security and abuse logs, including invite-code attempts: kept for 12 months.
How we keep it safe
Data is held with an EU-hosted managed database behind row-level access rules so records are readable only by the account that owns them. Broker API keys are encrypted before storage and used only to read positions. Traffic is encrypted in transit. No system is perfectly secure, so if a breach is likely to put your rights at risk we will tell you and the Information Commissioner's Office without undue delay, and within 72 hours of becoming aware where the law requires it.
Children
Catalyst is not for under-18s. We do not knowingly collect data from children, and any account we find to belong to a minor is closed and its data deleted.
Why we're allowed to hold it
Under UK GDPR we rely on three lawful bases, and nothing else:
- Contract — your account, holdings, broker connection, alerts and support messages exist so we can deliver the service you signed up for.
- Consent — optional product analytics and push notifications, both off until you switch them on and withdrawable at any time.
- Legitimate interests — keeping the service secure, preventing abuse of invite codes and support forms, and keeping minimal records we need for accounting.
We don't run automated decision-making that produces legal or similarly significant effects on you. AI output is research you read and act on yourself.
Where your data is processed
Our database and file storage are hosted in the European Union. Some providers — AI models, market data and email delivery — process data in the United States. Where that happens we rely on the UK International Data Transfer Addendum and EU Standard Contractual Clauses in each provider's terms.
Your rights
You can access, export, correct or delete your data from Settings, withdraw analytics consent above, restrict or object to processing, and ask for a portable copy. Deletion from Settings is immediate; requests sent to us are actioned within 30 days.
The data controller is Catalyst (sole trader, United Kingdom), operating as Catalyst. To exercise any right, use the contact support form — messages are logged and answered by email. If you're unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your own EU supervisory authority.
Your use of the app is also governed by our terms of service and legal & risk information.