Last updated: 12 October 2026
Who operates OTOX
OTOX is operated by Ali AlSaffar, based in Kuwait. It is a personally operated product, not a registered company. For privacy questions or requests, contact info@otoxapp.com.
Portfolio information
OTOX processes the investment records you enter or import, including holdings, transactions, amounts, currencies and planning information, to display your portfolio and support analysis. Storage depends on the version you use.
- Native app: portfolio snapshots are stored encrypted on your device. Exported backups are protected by a passphrase that you must keep securely.
- Private web app: structured portfolio records are stored using Cloudflare services behind access controls. Authorized service code can access these records; this storage is not end-to-end encrypted.
- Imports: supported records are previewed before you explicitly save them. Saved records become part of your portfolio. The browser supports manual IBKR XML review; the native app also supports direct Flex report retrieval.
Native and hosted records are separate. Automatic phone-to-web portfolio synchronization is not offered. Copies you export remain wherever you choose to save them.
IBKR Flex credentials
The native app stores the Flex token and Query ID encrypted in a separate device-only credential store, excluded from portfolio backups and cloud portfolio records. It requests reports directly from IBKR. Removing saved credentials in OTOX does not revoke the token at IBKR or delete previously imported records.
Guided IBKR authorization is not available. Any future backend authorization service will have its own data-handling disclosure before activation.
Support emails
When you email info@otoxapp.com, your email address, message and any attachments are processed to respond to your enquiry. Support correspondence stays in the GoDaddy mailbox; OTOX does not save separate copies elsewhere. On OTOX’s side, only Ali AlSaffar accesses these messages. The email provider processes messages to deliver its service.
Received support emails are manually deleted after a reply. Sent replies are manually deleted after 30 days. Messages in deleted items are automatically removed after 90 days. These periods describe mailbox handling and do not establish when the provider removes separate backups.
Never send passwords, Flex tokens, account identifiers or unredacted investment statements in ordinary support emails.
Services and website use
GoDaddy supplies website hosting and email services; Cloudflare supplies services used by the private app, including hosted storage and access infrastructure. IBKR supplies requested Flex reports. Market-data, app-update and device-approval services involve network requests when those features are used.
This website includes no advertising trackers, analytics scripts or contact forms added by OTOX. Hosting and service providers may process technical connection information and operational logs. Their processing may take place outside Kuwait or your country.
Retention and your requests
Saved portfolio records persist in their applicable device or hosted store; this version does not provide a scheduled portfolio-data expiry. Exported backups are managed separately by the person who saves them. Removing credentials or uninstalling one app should not be treated as deletion of hosted records or separate backups.
Contact info@otoxapp.com to ask about access, correction or deletion of information held by OTOX. Describe your request without sending secrets or unredacted financial records. The appropriate steps depend on whether the information is on your device, in hosted storage or in support email. There is no public self-service account-deletion flow, and no immediate deletion of provider backups is promised.
Changes
Updates to this notice will appear on this page with a revised date. Current product access is private. OTOX is intended for users worldwide, but availability and eligibility may vary by country.