Privacy Policy | Codega

Codega ("we", "us", "our") operates the website at codega.com.au (the "Service"). This Privacy Policy explains how we collect, use, store, and disclose your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the Service you consent to the practices described in this policy. If you do not agree, please discontinue use of the Service.

1. Who We Are

Codega is operated as a small business based in Australia. We are not currently required to have a Privacy Officer under the Privacy Act 1988, however we take your privacy seriously and are committed to handling personal information responsibly.

Contact: privacy@codega.com.au

2. Information We Collect

We collect the following categories of personal information:

Account information: Your email address and password (stored as a hashed credential) when you register for an account.
Usage data: Pages visited, features used (screener, watchlist, AI research cards), ticker symbols viewed, and timestamps. This is collected automatically via server logs and our application database.
Watchlist data: ASX ticker symbols you add to your personal watchlist.
AI card usage: Records of which AI research cards you have generated, for the purpose of enforcing free tier limits.
Technical data: IP address, browser type, device type, and referral URL, collected automatically when you access the Service.

We do not collect financial account details, tax file numbers, or payment card information at this time.

3. How We Use Your Information

We use your personal information to:

Provide, operate, and maintain the Service;
Authenticate you and manage your account;
Enforce free tier usage limits;
Send transactional emails (e.g. email verification, password reset) via Resend;
Monitor and improve the performance and security of the Service;
Comply with our legal obligations; and
Respond to your enquiries and support requests.

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

4. How We Store Your Information

Your data is stored in Supabase (PostgreSQL database) hosted in the ap-southeast-2 (Sydney, Australia) region. Session cache data is stored in Upstash Redis, also in the Sydney region.

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or destruction. These include row-level security (RLS) policies on our database, HTTPS-only access, and hashed password storage.

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal information within 30 days, unless retention is required for legal purposes.

5. Disclosure of Your Information

We may disclose your personal information to:

Supabase Inc. — database and authentication infrastructure (data stored in Sydney);
Upstash Inc. — Redis cache infrastructure (data stored in Sydney);
Vercel Inc. — hosting and edge network (servers in multiple regions; see Vercel Privacy Policy);
Resend Inc. — transactional email delivery;
Anthropic PBC — AI research card generation (your requested ticker symbol is sent to the Anthropic API; no personally identifiable information is included in these requests); and
Law enforcement or government authorities where required by Australian law.

We do not sell your personal information to third parties, and we do not disclose it for direct marketing purposes.

6. Cookies and Tracking

We use strictly necessary cookies to maintain your authenticated session. We do not use third-party advertising or tracking cookies. You may control cookie behaviour through your browser settings, however disabling session cookies will prevent you from remaining logged in.

7. Your Rights

Under the Australian Privacy Principles you have the right to:

Access the personal information we hold about you;
Request correction of inaccurate or out-of-date information;
Request deletion of your account and associated personal data; and
Complain about a breach of the APPs.

To exercise any of these rights, email privacy@codega.com.au. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date. Continued use of the Service after any changes constitutes your acceptance of the updated policy.

10. Contact

For any privacy-related enquiries, please contact us at: privacy@codega.com.au