App Privacy Policy

MansaMusaInvst.

Last updated: 20 September 2026

1. Who we are and what this policy covers

MansaMusaInvst. is responsible for the personal information processed to operate the MansaMusaInvst. app and its member service. This policy covers both independent networks available in the app: MansaMusa and NutsRabbit.

For privacy questions or requests, email info@mansamusainvst.com. Our website is mansamusainvst.com (https://www.mansamusainvst.com).

The app provides educational research, reflection and community tools. Purchasing the app or an in-app subscription does not by itself create a separately signed investment-oversight or formal company membership agreement. Such separately arranged services, and general browsing of our website, may have additional terms and privacy information. Your rights relating to app purchases and personal information remain applicable.

2. Information processed by the member service

We receive information you provide, records generated when you use member features, and purchase-status information from Apple:

• Account information: your name, email address, account identifier, password when authenticating, and verification and session records. Passwords are stored on the server as hashes, not as readable passwords. The app keeps its session credential in the device Keychain.

• Network participation: your network memberships and numbers, rules acceptance and checklist records, company details and source links you submit, proposed market-cap targets, nominations, votes, reports, blocking preferences and relevant timestamps.

• Holdings documents: a PDF you deliberately select, confirm and upload for MansaMusa review, together with its filename, submission time, cycle, revision and review status or notes. This can contain financial information. Provide only the holdings needed for that review and remove unrelated account numbers, transactions and personal details before uploading.

• Live-event attendance: the event you join, first joining time, most recent connection time and presence status. The app plays the administrator's broadcast; it does not broadcast your microphone, camera or chat messages.

• Purchases and access: Apple transaction and product identifiers, the account reference associated with a purchase, and subscription, renewal, expiry, refund and revocation information. Apple processes payment; we do not receive your payment-card details through the app.

• Support and service records: messages and attachments you send to support, and technical information such as IP addresses, request times, device or browser information, delivery status and error information processed to deliver and protect online services.

Providing account information is necessary to create and authenticate an online account. Other information is needed when you choose the corresponding feature. You can explore the separate sample login without creating a real member account.

3. Private writing, saved research and reminders

Notebook drafts, research notes, quick notes, reflection diary entries, private company bookmarks and reminder preferences are stored on your device, separated by app account and network. They are not automatically sent to our member service or included with company submissions. Administrators cannot read this private writing through the member service.

When you export your workspace, the exported file can contain your private writing and saved research; it goes to the destination you choose. Device backups may also include local app data, depending on your Apple and device settings. The app does not provide its own cross-device notebook or diary synchronisation.

Daily or weekly reflection reminders are optional local notifications. They use a general reminder message without private company names or investment notes. No push-notification server or push token is used for these reminders. You can change or disable them in the app or your device notification settings.

Network test sessions use sample data and do not create paid memberships or send sample submissions to real members. Closing a network test discards its temporary test-session changes.

4. Why we use information

We use information to create and secure accounts; send verification and password-reset messages; operate the chosen networks; record rule acknowledgements; process company submissions and voting; provide holdings review and event access; verify purchases and restore membership access; answer support requests; and prevent misuse.

Where a legal basis is required, processing is based on providing the requested app service, our legitimate interests in security and effective administration, compliance with applicable legal obligations, or consent where required for an optional activity. You may withdraw consent for consent-based processing without affecting earlier lawful processing.

Automatic checks enforce access, purchase validity and submission limits. They do not execute investment trades or assess your creditworthiness. Contact us if you want an account or access decision reviewed.

5. Who can see information

Active members of the same network can see approved company information and voting results. Your email address, private diary, notebook, personal checklist and holdings PDF are not included in the community board. Joining one network does not grant access to the other network's member content.

Authorised administrators can review membership and participation records, submissions and reports. MansaMusa holdings PDFs are available to the submitting member and authorised MansaMusa administrators. Event administrators can see attendee names, email addresses and attendance; other members see an attendance count.

We use service providers to run the app and respond to you. We may also disclose information when legally required or necessary to investigate misuse, protect rights or resolve disputes. The native app does not include advertising or analytics SDKs, and we do not sell app member information or use it for cross-app advertising tracking.

6. Service providers and international processing

• Railway hosts the member API and its database, including uploaded holdings PDFs. The currently configured application and storage region is US West, California, United States. Railway also processes service and security metadata. See Railway's privacy information (https://railway.com/legal/privacy) and data-processing terms (https://railway.com/legal/dpa).

• Resend delivers account verification and password-reset emails. We send the recipient address, sender and reply address, subject and message containing the one-time code. The configured sending region is Ireland. Resend's primary processing operations are in the United States; choosing an Irish sending region does not mean all email data stays in Ireland. Open and click tracking are disabled for the app's sending domain. See Resend's data-processing terms (https://resend.com/legal/dpa).

• Apple handles App Store purchases and subscriptions, signed purchase information and any device backups you enable. Our support email also uses Apple's iCloud mail infrastructure. Apple processes that information under its own applicable terms and privacy policy (https://www.apple.com/legal/privacy/).

• Squarespace hosts our website and the audio introduction requested when you press Play. Its delivery infrastructure receives connection information such as your IP address. When you visit a website or follow an external source link, that site's privacy and cookie practices also apply. See Squarespace's privacy policy (https://www.squarespace.com/privacy).

Information may therefore be processed outside your country, including in the United States and Ireland. The Railway and Resend data-processing terms provide international-transfer mechanisms, including standard contractual clauses where applicable and Swiss or UK adaptations. You can contact us for information about the safeguards applicable to your data. Other providers' international processing is described in their linked notices.

7. Retention, cancellation and deletion

Local research and reflections. Cancelling a subscription or letting membership expire does not automatically delete the app's local research, notes, diary or bookmarks. Member access may pause. If those files remain on the same device, you can reopen them by signing into the same app account and restoring the relevant membership. Export and deletion controls remain available in More. Deleting the app, clearing its data, deleting the app account or losing the device can remove local work; resubscribing cannot recreate erased files. Any device backup is controlled by your backup settings.

Online account and participation records. These remain while your app account is retained, including when a subscription expires. Use My account → Delete my account and confirm your password to request deletion through the app. Successful deletion removes the account and related active personal participation records, including uploaded holdings PDFs, sessions and attendance. It also attempts to remove that account's local workspace on the device used for deletion. Copies on other devices or in exports are not remotely erased.

Shared history and purchase records. Shared company records may remain detached from the deleted account, together with saved company snapshots and final aggregate voting totals. Minimal transaction references, hashed account and included-choice references, and necessary administrative audit records remain after deletion to prevent purchase reuse, handle purchase-status changes and explain administrative actions. Hashing does not necessarily make these records anonymous. These retained records have no automatic deletion date in the current service; contact us to request an assessment of whether further deletion is possible, subject to purchase integrity and applicable obligations.

Email, support, logs and backups. Account deletion does not directly erase emails already delivered, support correspondence, provider security or delivery records, exports, or any retained backup copies. Retention depends on whether records are still needed to resolve a request, investigate abuse, support recovery, handle purchase disputes or meet legal obligations, and on the relevant provider's retention and deletion processes. Resend publishes a 30-day email-data retention period for its standard plans (https://resend.com/pricing); this does not describe every security, suppression or compliance record. Railway's visible log-history window (https://docs.railway.com/observability/logs#log-retention) depends on the hosting plan and is not a guarantee of deletion of every provider-held copy. We do not promise that all backups or provider records are erased immediately when an account is deleted. Contact us about deletion of records outside the active app database.

Deleting an app account does not cancel an Apple subscription or request a refund. Manage or cancel subscriptions separately in your Apple account's subscription settings.

8. Your choices and privacy rights

You can manage reminders, export or delete local writing, delete individual diary entries, and delete your online account in the app. You can also contact info@mansamusainvst.com to request access, correction, deletion or a portable copy of information we hold, or to raise an objection or restriction request where applicable. We may need proportionate information to verify that a request concerns your account; do not send your password or verification code.

Rights and exceptions depend on the law applicable to you. You may raise a concern with the competent data-protection authority, including Switzerland's Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/en), or your local supervisory authority where applicable. Please contact us if you believe a child has provided personal information without appropriate authorisation.

9. Security

The member service uses HTTPS, password hashing and authenticated access controls. Private holdings documents are not published as public download links. The app uses device storage and Keychain protections for the data it holds. No system can guarantee absolute security; protect your device, app credentials and exported files.

10. Changes and contact

We will update this policy when the app's data practices change and show the new update date. If a change requires additional notice or consent, we will provide it as required. For questions about either network, account deletion or this policy, contact info@mansamusainvst.com.