Privacy Policy

1. Who We Are

This Privacy Policy explains how Vikreya Inc. (“Vikreya”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information in connection with the DIOVRA application, including https://diovra.com and any related mobile or desktop applications (the “Service”).

This Policy applies only to information we collect through the Service. It does not apply to third-party websites or services that we do not control, even if linked from the Service.

We do not sell your personal information and we do not use it for targeted advertising.

2. Information We Collect

We collect information in the following categories:

• Account information — first name, last name, and email address, provided when you register.
• Authentication information — one-time passcodes (OTPs) sent to your email, session tokens, and records of your active sessions and devices (so you can review and revoke them).
• Portfolio and activity data — simulated trades, positions, cash balance, profit and loss, win/loss streaks, trade journal entries and notes, your confidence-threshold setting, and points or rewards.
• Communications — feedback, feature requests, and messages you submit through the Service.
• Technical and usage data — Internet Protocol (IP) address, browser and device type, pages viewed, referring URL, timestamps, approximate location derived from IP address, and error or diagnostic logs.
• Local storage — we store your session token, email, journal cache, and preferences in your browser’s local storage so the Service works across sessions on your device.

We do not knowingly collect payment card information; the Service is free.

3. How We Use Your Information

We use the information we collect to:

• provide, operate, maintain, and secure the Service;
• create and authenticate your account, and let you sign in with a one-time passcode;
• sync your portfolio, journal, and settings across sessions and devices;
• display your trade history, streaks, and progress;
• respond to your feedback, feature requests, and support inquiries;
• monitor performance, debug errors, and improve the Service;
• detect, prevent, and respond to fraud, abuse, or security incidents;
• comply with legal obligations and enforce our Terms of Use.

We may create aggregated or de-identified statistics that cannot reasonably identify you and use them for any lawful purpose.

4. How We Share Your Information

We do not sell or rent your personal information. We share it only with:

• Service providers who process information on our behalf — including cloud hosting and database providers, email delivery (for OTP codes), market data providers, and AI/decision-engine providers. They may use the information only to provide services to us.
• Third-party data sources referenced in the Service, such as Alpaca (market data) and Jev (decision engine), which receive only what is necessary to answer a request (for example, a stock symbol) — not your account details.
• Legal authorities, when required by law, subpoena, or court order, or where necessary to protect the rights, safety, or property of Vikreya, our users, or the public.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We may also share information with your consent or at your direction.

5. Cookies, Local Storage, and Tracking

We do not use third-party advertising cookies or cross-site tracking cookies.

We use first-party local storage to keep you signed in, remember your preferences (such as your confidence threshold), and cache your journal so it works offline. You can clear this data at any time through your browser settings; doing so will sign you out and remove locally cached content.

Where required by law, including Colorado law, we honor legally recognized opt-out preference signals, such as the Global Privacy Control (GPC), as a valid request to opt out of any sale or sharing (which we do not engage in) and targeted advertising (which we do not conduct).

6. Data Retention

We keep your personal information for as long as your account is active and as needed to provide the Service.

Portfolio, journal, and settings data are retained until you delete them or close your account. After account closure, we delete or de-identify personal information within a reasonable period, except where retention is required or permitted by law (for example, to resolve disputes or comply with legal obligations).

Technical logs are retained only for as long as needed for security, debugging, and compliance purposes.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including transport-layer encryption (HTTPS) for data in transit, token-based authentication, restricted access to production systems, and least-privilege practices for anyone with access.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect your information and to respond to incidents promptly.

If a security breach involving your personal information occurs, we will notify affected individuals and the relevant authorities as required by Colorado law (C.R.S. § 6-1-716) and other applicable law.

8. Your Privacy Rights (Colorado Privacy Act)

If you are a resident of Colorado, the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) gives you the following rights with respect to your personal information:

• Right to access — know whether we process your personal information and obtain a copy of it.
• Right to correct — request correction of inaccurate personal information.
• Right to delete — request deletion of personal information, subject to legal exceptions.
• Right to data portability — receive your personal information in a portable, usable format.
• Right to opt out — opt out of the processing of personal information for targeted advertising, certain profiling, and any sale of personal information. We do not sell personal information, do not conduct targeted advertising, and do not engage in profiling that produces legal or similarly significant effects.
• Right to non-discrimination — we will not deny, degrade, or charge you a different price for exercising your privacy rights.

How to exercise your rights: email [email protected] from the address associated with your account, or through your profile in the Service. We may need to verify your identity before completing a request, and we will respond within the time required by law (45 days, extendable once by an additional 45 days where permitted).

Right to appeal: if we deny your request, you may appeal our decision by replying to the denial email or emailing [email protected] within a reasonable period. We will respond to your appeal as required by law. If your appeal is denied, you may lodge a complaint with the Colorado Attorney General.

If you live in another U.S. state with applicable privacy law (for example, California or Virginia), you may have similar rights. Contact [email protected] and we will respond as required by the law that applies to you.

9. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our eligibility terms require users to be at least 18.

If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

10. Third-Party Links and Services

The Service may link to third-party websites or rely on third-party services (for example, market data and documentation). Those parties have their own privacy practices, which this Policy does not cover. We encourage you to review their privacy policies.

11. Where Your Information Is Processed

We operate in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. By using the Service, you acknowledge this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Effective” date above when we do, and, for material changes, provide additional notice through the Service or by email.

Your continued use of the Service after an update means you accept the revised Policy.

13. Contact Us

For privacy questions or to exercise your rights, contact:

• Vikreya Inc. (operator of DIOVRA)
• Colorado, United States
• Privacy requests: [email protected]
• Legal notices: [email protected]
• Web: https://diovra.com

Please include the email address associated with your account so we can verify and respond to your request.