Privacy policy
Last updated: 2026-09-29
In short: we collect the minimum the service needs, we sell data to nobody, we use no advertising networks and we put no marketing trackers on the site.
1. What we collect
| Category | What it contains | Why |
|---|---|---|
| Account | E-mail address, password stored as a hash, username, plan and period | Creating the account, signing in, access to paid features |
| Authentication | Short-lived sign-in codes, the public keys of your passkeys, a session cookie | Two-step verification and keeping you signed in |
| Sign in with Apple or Google | The identity token issued by Apple or Google, verified on our server; we keep only the e-mail address from it | Passwordless sign-in |
| Push notifications (mobile app) | The Expo notification token for your device, only if you turn notifications on | Delivering alerts to your phone |
| Crash reports | Error type, app version and the technical trace, on an error tracker we host ourselves | Fixing defects in the app |
| Preferences | Language, timezone, panel layout, your chart drawings and notes | So the app looks the same next time |
| Notifications | Your Telegram bot token and your per-signal subscriptions | Sending signals to your own channel |
| Payments | Invoices, the amount, the network and the public transaction id | Confirming payment and accounting records |
| Analysis requests | The text of your request and any chart crop you send | Producing the answer you asked for |
| Technical logs | IP address, request time and browser agent | Security, abuse prevention and debugging |
We do not collect card data, bank account numbers or biometric data (a passkey keeps the biometrics on your device, we only receive a public key), and we never ask for access to your brokerage account. Crash reports carry no personal data and we use no advertising identifiers.
2. Legal basis
- Performance of the contract - the account, the plan, signal delivery, invoices.
- Legitimate interest - security of the service, abuse prevention, technical logs.
- Legal obligation - retention of financial records.
- Consent - connecting your Telegram bot and push notifications in the mobile app; you can withdraw either at any time by deleting the token or turning notifications off.
3. How long we keep it
- Account data: as long as the account exists, plus 30 days after a deletion request.
- Sign-in codes: minutes.
- Technical logs, including the IP address: 90 days at most.
- Financial records: the period required by tax law.
- Analysis requests and drawings: until you delete them or the account is deleted.
- The push notification token: until you turn notifications off, uninstall the app or delete the account.
3a. Deleting your account
You can delete the account yourself from the mobile app, under Account → Delete account, or by asking through the contact form. Deletion removes the account, the registered passkeys, the notification tokens and the subscription record. Invoices already issued stay for as long as tax law requires.
4. Who we share it with
We do not sell or rent personal data. We share it only with the providers the service strictly needs:
- Brevo - the transactional e-mail provider; it receives your address and the message content in order to deliver the sign-in code or the reply to a contact request. Its servers are in the European Union.
- Cloudflare - proxy and bot check (Turnstile) on the public forms; it sees the request IP.
- Telegram - receives the messages sent to the bot you created, under their terms.
- Expo - carries push notifications to your phone using the device token, only if you turned notifications on.
- Apple and Google - only if you choose to sign in with their account: they confirm the identity, we keep the e-mail address.
- The hosting provider - runs the servers the application sits on, in the European Union.
Cryptocurrency payments are recorded on public networks; the amount and the address are visible to anyone by their nature, but they carry none of your identifying data.
5. No advertising tracking
We use no Google Analytics, no social network pixels, no retargeting and no ad networks. The public site loads no third-party scripts other than the anti-bot check on the contact form. The mobile app contains no analytics or advertising SDK and does not read your phone's advertising identifier.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the supervisory authority (in Romania, ANSPDCP). Details and how to exercise them: the GDPR page.
7. Contact
For any request about your data: the contact form or (the address appears with JavaScript on — or write through the form).