Shinro
Codex IPO1. Who We Are
Codex IPO is an application for iPhone, iPad, and Android phones and tablets that tracks upcoming IPOs. It is published by Shinro OÜ, a company registered in Estonia ("Shinro", "we", "us"), which is the controller for the personal data described in this policy. If you have any questions about this policy, please contact us using the details at the bottom of this page.
2. What Information We Collect
Shinro does not receive your watchlist, searches, or API keys. The app contains no advertising, no analytics SDKs, and no tracking or attribution libraries, and Shinro does not operate an app backend.
Your watchlist, notification preferences, provider selection, and other app settings are stored on your device. Like other app data, the watchlist is included in your iPhone or iPad backup and in Android's backup to your own Google account (section 8).
When you search for a company or refresh one, the company name, ticker, and any alternate names that company is known by are sent directly from your device to the AI provider you configured, as described below. On Android the app also refreshes your watchlist about once a day in the background, when the device has a network connection, so listing dates and their notifications stay current while the app is closed; it sends the same kind of query for each company that has not listed yet. On iPhone and iPad refreshes happen only while you have the app open, and each time the app starts it also contacts every AI provider whose key you have saved. None of these requests pass through Shinro.
The sensitive items the app handles are your Finnhub API key and, if you configure an AI provider, your Anthropic or OpenAI API key. They are stored securely on your device and are never transmitted to us (section 6).
The one category of data that does reach a processor on our behalf is crash reports, described in section 5. They contain no watchlist content, no search terms, and no API keys, but they do carry pseudonymous installation identifiers.
3. How We Use Your Information
Shinro does not receive or use your in-app watchlist, searches, API keys, or notification preferences. The app uses this local information only to provide company search, IPO monitoring, timeline, and notification features on your device.
Crash reports are used for one purpose: finding and fixing defects in the app. They are not used to profile you, are not combined with any other data, and are not sold or shared for advertising.
If you contact us for support, what you send is handled as described in our general privacy policy. The app's Contact link opens a draft in your email app with only the app name and version in the subject.
4. Third-Party Services
Finnhub: Codex IPO uses the Finnhub API to retrieve IPO calendar data. API calls are made directly from your device to Finnhub's servers using your own Finnhub API key, and carry a date range and, optionally, an exchange. Your search terms are not sent to Finnhub; the app matches companies on your device. We are not party to these requests. Free Finnhub accounts cover US markets; the Asia tier covers Hong Kong and other Asian exchanges; the Premium tier covers European exchanges. Please refer to Finnhub's Privacy Policy for details on how they handle requests.
Anthropic (Claude): If you select Claude as the AI provider, the app sends company and IPO search queries directly from your device to Anthropic's API using your own Anthropic API key. A query contains the company name or ticker you are looking up, the alternate names that company is already known by in your watchlist, and the current date. The app uses Anthropic's web-search capability to find current IPO information. Please refer to Anthropic's Privacy Policy for details.
OpenAI: If you select OpenAI as the AI provider, the app sends the same kind of query directly from your device to OpenAI's API using your own OpenAI API key, and uses OpenAI's web-search capability to find current IPO information. Please refer to OpenAI's Privacy Policy for details.
Key checks and model lists: When you test a key or refresh the models available from Anthropic or OpenAI, and on iPhone and iPad each time the app starts, the app sends that provider a request with your key that lists or recommends models. It does not send your watchlist, searches, or notification settings with that request.
Google Firebase Crashlytics: The app uses Firebase Crashlytics to report crashes, so defects can be found and fixed. It is on by default and can be switched off in the app's Settings. Section 5 describes what a report contains. Data is processed by Google as our processor under Firebase's privacy terms and Google's Privacy Policy.
Apple App Store and Google Play: If you purchase Lifetime Pro, Apple or Google processes the transaction and the app checks your purchase with them on the device. Shinro receives no payment-card details and no purchase information. Purchase processing is governed by Apple's Privacy Policy or Google's Privacy Policy, depending on your platform.
Beyond crash reporting, we integrate no advertising, analytics, or tracking SDKs of any kind.
5. Crash Diagnostics
When the app crashes, it sends a report so the fault can be traced and fixed. A report contains the stack trace, the date and time, the app version and build, the device model, the operating-system version, a Crashlytics installation UUID, and a Firebase installation ID. These pseudonymous identifiers group reports from one installation and may be considered personal data under some privacy laws. The app sends no reports other than crashes.
A report does not contain your API keys, your watchlist, the companies you searched for, your notification settings, your name, your email address, your precise location, or any advertising identifier. The app attaches no account to it.
Turning it off. Crash reporting is enabled by default. Turn it off under Settings → Privacy → Send crash reports; from then on no new reports are collected or sent. Reports already waiting on the device are not deleted. The choice persists across restarts and app updates. On Android, app settings are not part of the app's backup, so after a restore or a move to a new phone crash reporting is on again until you turn it off.
Retention. Firebase states that Crashlytics keeps crash reports and their installation identifiers for 90 days before beginning to remove them from its live and backup systems. We do not export crash reports anywhere else. Firebase operates on Google's global infrastructure, so reports may be processed outside the country where you live, under Google's Firebase Data Processing and Security Terms.
Legal basis. Where data-protection law requires a legal basis, we process this limited diagnostic data on the basis of our legitimate interest in keeping the app stable and secure (GDPR Art. 6(1)(f)).
6. API Keys & Security
On iOS, your Finnhub, Anthropic, and OpenAI API keys are stored in the iOS Keychain using device-only protection. On Android, they are stored in encrypted app preferences protected by the Android Keystore. The keys are sandboxed to Codex IPO, are not synchronized through the app to cloud storage, are not included in device or Google backups, and are not logged by the app.
On iPhone and iPad, the Keychain keeps the keys after the app is deleted, and the app finds them again if you reinstall it. To delete a key, use Remove key in the app's Settings.
API calls made with your keys go directly from your device to the selected third-party service: Finnhub, Anthropic, or OpenAI. Shinro infrastructure is not involved in those requests.
7. Notifications
Codex IPO can send you notifications in advance of an upcoming IPO date. These notifications are scheduled locally by iOS or Android using date information stored on your device. No notification content or scheduling data is sent to Shinro.
On both iOS and Android you can configure notification timing, from 3 to 30 days before an IPO at the hour of your choice, in the app's Settings screen. You can disable notifications at any time through your device settings.
8. Deleting Your Data and Your Rights
In the app you can remove each company from your watchlist and remove each saved API key. Deleting the app removes the watchlist and settings from the device. It does not remove:
- on iPhone and iPad, saved API keys, which stay in the Keychain (section 6);
- the watchlist in your iPhone or iPad backup, or in Android's backup to your Google account;
- queries already sent to Finnhub, Anthropic, or OpenAI under your own accounts, which those providers keep under their own policies;
- crash reports already sent (kept by Firebase as described in section 5);
- your purchase, which stays with your Apple or Google account.
We hold no account for you, so there is no profile to export or close. The only data processed on our behalf is crash reports. You can stop that collection at any time in the app's Settings, and you can ask us to delete reports already received by writing to the address below; quote the app version and the approximate date, since reports carry no name or account we could search for. Depending on where you live, you may also have rights of access, restriction, and objection, and the right to lodge a complaint with your local data-protection authority or with ours, the Estonian Data Protection Inspectorate.
If you contacted us for support and want any correspondence removed, reach out at the address below.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page and, where appropriate, notify you within the app. Continued use of Codex IPO after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have any questions or concerns regarding this Privacy Policy, you can reach us at:
Email: contact@shin.ro