App Privacy Policy

MansaMusaInvst.

Last updated: 3 October 2026

1. Who we are and what this policy covers

MansaMusaInvst. M. Schmidt, trading as MansaMusaInvst., is responsible for the personal information processed to operate the MansaMusaInvst. app and its member service. Business correspondence address: Speerweg 20, 8618, Zürich, Switzerland. This policy covers the iOS and Android versions of the app, their member service, and both independent networks: MansaMusa and NutsRabbit. The Android package name is com.mansamusainvst.android.

For privacy questions or requests, email info@mansamusainvst.com. Our website is mansamusainvst.com (https://www.mansamusainvst.com).

The app provides educational research, reflection and community tools. Purchasing the app or an in-app subscription does not by itself create a separately signed investment-oversight or formal company membership agreement. Such separately arranged services, and general browsing of our website, may have additional terms and privacy information. Your rights relating to app purchases and personal information remain applicable.

2. Information processed by the member service

We receive information you provide, records generated when you use member features, and purchase-status information from Apple or Google Play, depending on the store used:

- Account information: your name, email address, account identifier, password when authenticating, and verification and session records. Passwords are stored on the server as hashes, not as readable passwords. On iOS, the app keeps its session credential in the device Keychain. On Android, saved session credentials are encrypted with an installation-specific Android Keystore key.

- Network participation: your network memberships and numbers, rules acceptance and checklist records, company details and source links you submit, proposed market-cap targets, nominations, follow-up ballot choices, votes, reports, blocking preferences and relevant timestamps.

- Network names and commitment recognition: a generated name stored for each network, plus a private, account-linked activity and recognition history. This history records the activity type, identifying reference, network, recorded time, fixed points and lifetime activity total. For company submissions, nominations, rule checklists and approved holdings reports, it may also include the company or report title and research-cycle title already provided to the member service. Previously awarded points are retained. Names and activity records remain linked to your account; generated names and opaque identifiers do not make them anonymous.

- Reflection and research completion receipts: when you explicitly mark a daily or weekly reflection or a company research record complete, the app stores a receipt on your device and sends it to the member service for recognition. The receipt includes the activity type, an opaque activity identifier and the network. Reflection receipts also include the selected daily or weekly frequency, period start and UTC offset. The service adds the recorded time and fixed points. No private diary or research text, private company names, source URLs, prompt answers, conclusions or financial figures are sent in these completion receipts. This is a member-recorded completion, not administrator verification of the research.

- Holdings documents: a PDF you deliberately select, confirm and upload for the selected network through an available report feature, together with its filename, submission time, cycle, revision and review status or notes. The member service can hold reports for either MansaMusa or NutsRabbit, including reports submitted through earlier app versions. Report-upload availability depends on the app version and network; not every version presents an upload feature for both networks. Uploading is strongly recommended but entirely optional. Skipping a report does not restrict app membership, company submissions or voting. An uploaded report can contain financial information. Provide only the holdings needed for that review and remove unrelated account numbers, transactions and personal details before uploading.

- Knowledge-course progress and completion: the account, network, question-bank version, round, current stage, selected answers in that unfinished stage, the last reviewed explanation and update time. This lets you pause and resume the ten-stage, 100-question course across visits and devices. Individual choices are cleared from active course storage when that stage is completed. An unfinished stage can remain saved during a membership pause; it is not automatically erased when you close the app. Stage scores, completion times and award receipts remain with your account across repeated rounds and membership pauses, subject to account deletion and the limits below. The first completed stage per network per UTC day earns 10 points and one lifetime activity; further stages or repeats that day add no points. Older app versions use short-lived session identifiers for their daily games; expired identifiers are cleaned up during later requests. Saved progress and completion records are private and are not displayed to other members.

- Historical event attendance: live events have been removed. This version does not collect new broadcast attendance, camera, microphone or chat data. Attendance records from earlier versions may remain under the retention and deletion rules below.

- Purchases and access: Apple transaction and product identifiers, Google Play purchase tokens and product identifiers, the account reference associated with a purchase, selected network, and subscription, renewal, expiry, refund and revocation information. Apple or Google Play processes the paid download and subscription payment; we do not receive your full payment-card details through their checkout. For Android subscriptions, the app sends a purchase token to our authenticated member service, which verifies it with Google. An account-derived pseudonymous identifier links checkout to the correct app account; it is not anonymous. The Google Play integration stores encrypted purchase tokens for verification, acknowledgement, restoration and purchase-status updates, together with hashed purchase references and membership status. Access already verified through Apple can be recognised when the same app account is used on Android; that subscription remains managed through Apple.

- Support and service records: messages and attachments you send to support, and technical information such as IP addresses, request times, device or browser information, delivery status and error information processed to deliver and protect online services.

Providing account information is necessary to create and authenticate an online account. Other information is needed when you choose the corresponding feature.

Each eligible activity earns 10 nonmonetary commitment points and one lifetime activity: an explicitly completed reflection once per daily or weekly period; a successful company submission or nomination once per company, member and network; a fully saved rules checklist once per network research cycle; an explicitly completed company research record once per record; the first completed knowledge stage per network per UTC day; or an optional holdings report through an available report feature after its first administrator approval in a cycle. A saved draft, repeated edit or save, replacement report or repeated approval does not earn extra points. Completing a reflection or research record is your own declaration; it is not an investment recommendation or assessment by an administrator. Company submission or nomination recognition does not imply moderation approval.

The lifetime tally has no maximum and does not reset during a break or when an optional report is skipped. Points have no cash value and do not measure investment quality or returns. Both networks receive an initial generated name: formal in MansaMusa and playful in NutsRabbit. A qualifying first administrator approval of a holdings report in a cycle can change the generated name for that network where this report feature is available. Other activities, replacement uploads and repeated approvals in the same cycle do not change it. Records and names created through earlier app versions can remain even if the current interface no longer offers that network’s upload feature.

3. Private writing, saved research and reminders

Notebook drafts, research notes, quick notes, reflection diary text, private company names and source URLs, private bookmarks and reminder preferences are stored on your device, separated by app account and network. They are not automatically sent to our member service or included with company submissions. Administrators cannot read this private writing through the member service. If you separately submit a company to a network, the company information you choose to include in that submission is sent as described above.

Choosing Complete sends only the minimal completion receipt described in section 2. Saving or editing a private draft does not create a completion receipt. Pending receipts are kept on the device for later synchronisation; the member service requires an active membership and current rules acceptance before recording them, and accepts eligible offline receipts only within its 366-day limit. Synchronising a receipt does not synchronise the underlying private writing.

When you export your workspace, the exported file can contain your private writing and saved research; it goes to the destination you choose. On iOS, device backups may include local app data, depending on your Apple and device settings. On Android, saved private files are encrypted with an installation-specific Android Keystore key, and private app data is excluded from automatic Android backup and device transfer. Reminder scheduling preferences are held in app-private storage. The app does not provide its own cross-device notebook or diary synchronisation. Exported copies are outside the app’s private storage and are controlled by you and the destination you choose.

Daily or weekly reflection reminders are optional local notifications. They use a general reminder message without private company names or investment notes. No push-notification server or push token is used for these reminders. You can change or disable them in the app or your device notification settings. Android may request notification permission and delay scheduled reminders. The Android app uses the system document picker for PDF selection and export; it does not request broad storage, contacts, location, microphone or camera access.

4. Why we use information

We use information to create and secure accounts; send verification and password-reset messages; operate the chosen networks; record rule acknowledgements; process company submissions and voting; provide holdings review, generated network names, private commitment recognition and knowledge practice; verify purchases and restore membership access; answer support requests; and prevent misuse.

Where a legal basis is required, processing is based on providing the requested app service, our legitimate interests in security and effective administration, compliance with applicable legal obligations, or consent where required for an optional activity. You may withdraw consent for consent-based processing without affecting earlier lawful processing.

Automatic checks enforce access, purchase validity and submission limits. Automatic research cycles select the highest-supported qualifying companies at the deadline and open further ballots where required. They do not execute investment trades or assess your creditworthiness. Contact us if you want an account or access decision reviewed.

5. Who can see information

Active members of the same network can see validated final company submissions immediately, before the research deadline, and the resulting aggregate support counts and percentages. A submitted company is shared for research and perspective; publication does not mean administrator endorsement. Percentages use distinct participating members as the denominator, and members may support multiple companies. Private bookmarks and drafts are not published or counted. Follow-up rounds store each member’s choices, but the shared results do not identify individual voters. Your email address, private diary, notebook, personal checklist and holdings PDF are not included in the community board. Joining one network does not grant access to the other network's member content. Your generated network names and commitment recognition histories are private account features and are not published to other members.

Authorised administrators can review membership and participation records, submissions and reports. Holdings PDFs are available to the submitting member and authorised administrators for the report’s network. No new event attendance is collected. Historical attendance remains subject to the same retention and deletion process.

We use service providers to run the app and respond to you. We may also disclose information when legally required or necessary to investigate misuse, protect rights or resolve disputes. The native app does not include advertising or analytics SDKs, and we do not sell app member information or use it for cross-app advertising tracking.

6. Service providers and international processing

- Railway hosts the member API and its database, including uploaded holdings PDFs. The currently configured application and storage region is US West, California, United States. Railway also processes service and security metadata. See Railway's privacy information (https://railway.com/legal/privacy) and data-processing terms (https://railway.com/legal/dpa).

- Resend delivers account verification and password-reset emails. We send the recipient address, sender and reply address, subject and message containing the one-time code. The configured sending region is Ireland. Resend's primary processing operations are in the United States; choosing an Irish sending region does not mean all email data stays in Ireland. Open and click tracking are disabled for the app's sending domain. See Resend's data-processing terms (https://resend.com/legal/dpa).

- Apple handles App Store purchases and subscriptions, signed purchase information and any device backups you enable. Our existing support mailbox uses Apple's iCloud mail infrastructure. Apple processes that information under its own applicable terms and privacy policy (https://www.apple.com/legal/privacy/).

- Google handles Google Play paid downloads, subscription checkout, purchase verification and related platform services for Android. We exchange the purchase and account-linking information described above to operate membership and prevent purchase reuse. Google also processes information under its own privacy notice (https://policies.google.com/privacy), including its service and transaction records. Google operates internationally, including in the United States and Ireland; its notice explains its processing locations and transfer arrangements.

- Squarespace hosts our website and the audio introduction requested when you press Play. Its delivery infrastructure receives connection information such as your IP address. Our website has separate privacy and cookie practices; the native app’s absence of advertising or analytics SDKs does not mean the website uses no cookies. When you follow an external source link, that site's privacy and cookie practices also apply. See Squarespace's privacy policy (https://www.squarespace.com/privacy).

Information may therefore be processed outside your country, including in the United States and Ireland. The Railway and Resend data-processing terms provide international-transfer mechanisms, including standard contractual clauses where applicable and Swiss or UK adaptations. You can contact us for information about the safeguards applicable to your data. Other providers' international processing is described in their linked notices.

7. Retention, cancellation and deletion

Local research and reflections. Cancelling a subscription or letting membership expire does not automatically delete the app's local research, notes, diary or bookmarks. Member access may pause. If those files remain on the same device, you can reopen them by signing into the same app account and restoring the relevant membership. Export and deletion controls remain available in More. Deleting the app, clearing its data, deleting the app account or losing the device can remove local work; resubscribing cannot recreate erased files. iOS backups are controlled by your Apple and device settings; this Android version excludes its private app data from automatic backup and device transfer.

Online account and participation records. These remain while your app account is retained, including when a subscription expires. Your saved network names, completed-activity receipts and commitment recognition remain during a membership pause and are removed from the active service when your account is deleted, subject to the retained-record and backup limits below. On Android, use More → Privacy & your data → Delete my account, enter your current password and confirm Permanently delete my account. On iOS, use My account → Delete my account and confirm your password. These controls initiate deletion through the member service. Successful deletion removes the account and related active personal participation records, including generated network names, completed-activity receipts, knowledge-course progress, unfinished-stage answers, stage histories and legacy game sessions/completions, follow-up ballot choices, commitment recognition records, uploaded holdings PDFs, sessions, historical attendance and encrypted Google Play purchase-token copies held by the active service. It also attempts to remove that account’s local workspace and pending receipts on the device used for deletion. Copies on other devices or in exports are not remotely erased.

Shared history and purchase records. Shared company records may remain detached from the deleted account, together with saved company snapshots and final aggregate voting totals, including support percentages. Finalized aggregate results are preserved even when an account is deleted; ongoing personal support and ballots are removed. Minimal transaction references, hashed account and included-choice references, and necessary administrative audit records remain after deletion to prevent purchase reuse, handle purchase-status changes and explain administrative actions. Hashing does not necessarily make these records anonymous. These retained records have no automatic deletion date in the current service; contact us to request an assessment of whether further deletion is possible, subject to purchase integrity and applicable obligations.

Email, support, logs and backups. Account deletion does not directly erase emails already delivered, support correspondence, provider security or delivery records, exports, or any retained backup copies. Retention depends on whether records are still needed to resolve a request, investigate abuse, support recovery, handle purchase disputes or meet legal obligations, and on the relevant provider's retention and deletion processes. The email provider’s retention settings and policies can differ between message content, delivery logs, suppression and security/compliance records. Railway's visible log-history window (https://docs.railway.com/observability/logs#log-retention) depends on the hosting plan and is not a guarantee of deletion of every provider-held copy. We do not promise that all backups or provider records are erased immediately when an account is deleted. Contact us about deletion of records outside the active app database.

Deleting an app account does not cancel an Apple or Google Play subscription or request a refund. Manage or cancel subscriptions separately in the store where you subscribed. For Google Play, visit https://play.google.com/store/account/subscriptions. For Apple, use your Apple account’s subscription settings. You can request account deletion whether or not you still have the app installed; subscription cancellation is separate from your deletion request.

Requests without the app. Email info@mansamusainvst.com from your registered app email address with the subject “MansaMusaInvst account deletion”. State that you want the app account and associated personal data deleted. If you cannot use the registered address, explain the access problem so we can arrange proportionate ownership verification. Never send your password, payment-card details or a verification code. Our account-deletion request page is https://www.mansamusainvst.com/app-account-deletion. We respond without undue delay within the time limits applicable to your request and explain any records that must be retained. You may also ask for specific personal data to be deleted without closing your account; some records are needed to continue providing the corresponding service.

8. Your choices and privacy rights

You can manage reminders, export or delete local writing, delete individual diary entries, and delete your online account in the app. You can also contact info@mansamusainvst.com to request access, correction, deletion or a portable copy of information we hold, or to raise an objection or restriction request where applicable. We may need proportionate information to verify that a request concerns your account; do not send your password or verification code.

Rights and exceptions depend on the law applicable to you. You may raise a concern with the competent data-protection authority, including Switzerland's Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/en), or your local supervisory authority where applicable. The app is intended for adults and is not directed to children. We do not request a date of birth or claim that every user’s age has been verified. Please contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

9. Security

The member service uses HTTPS, password hashing and authenticated access controls. Private holdings documents are not published as public download links. The iOS app uses device storage and Keychain protections. The Android app encrypts saved private files and session credentials using Android Keystore, excludes private data from automatic backup, and requires HTTPS for member-service requests. This is not end-to-end encryption: authorised service personnel can access server-held information as described in this policy. No system can guarantee absolute security; protect your device, app credentials and exported files.

10. Changes and contact

We will update this policy when the app's data practices change and show the new update date. If a change requires additional notice or consent, we will provide it as required. For questions about either network, account deletion or this policy, contact info@mansamusainvst.com.