Privacy Policy

1. Who is responsible

The operator of the Service is the controller of the personal data described in this policy.

For any question about this policy, or to exercise the rights described in Section 10, write to usafintech.destek@gmail.com.

2. What we collect

Account data you give us:

• email address and username;
• your password, stored only as a bcrypt hash — we never store or can read the password itself;
• your interface language preference;
• if you sign in with Google: your Google account identifier and the email address on that account. We never receive your Google password;
• if you connect Telegram: your Telegram chat identifier;
• your watchlist symbols and your notification preferences;
• the date, version and record of your acceptance of the Terms of Service.

3. Technical data we record

When you create an account we record the IP address of that request and resolve it once to a country code. These two fields are stored on your account and are never refreshed; they describe where the account was opened, not where you are now. We use them to detect abuse and fraudulent registration. The country lookup happens only at registration — no other request is sent to the geolocation provider.

Your IP address is also recorded on a few later security-sensitive actions: requesting a password reset, requesting a new verification link, and completing a Google sign-in. Each of those writes the IP of that request to the corresponding token record, so an IP captured this way can reflect where you were at that moment. We use these to investigate abuse of those flows.

We also record timestamps needed to operate the account: when it was created and last updated, when your email address was verified, and when your password was last changed. Email-verification, password-reset and sign-in exchange tokens themselves are stored only as hashes, with an expiry and a single-use marker.

Our servers keep ordinary operational logs. We do not log passwords, tokens or full email addresses; email addresses appear in logs only in masked form.

4. Cookies and local storage

We use no advertising, analytics or cross-site tracking cookies. Everything below is strictly necessary for the Service to function and is set by us, not by third parties.

• “NEXT_LOCALE” cookie — remembers your interface language.
• “g_oauth_state” cookie — a short-lived, HTTP-only security token used only during Google sign-in to prevent cross-site request forgery. It is deleted as soon as sign-in completes.
• Browser local storage — your session token (which keeps you signed in), your theme choice, your region choice, and figures you type into on-screen calculators. These stay on your device; the calculator figures are never sent to us.

5. Why we use your data, and on what legal basis

• To create and operate your account, authenticate you, and provide the screens and lists you ask for — necessary for the performance of our contract with you.
• To send service messages such as email verification and password reset — necessary for the performance of our contract with you.
• To send the signal, summary and basket notifications you have switched on — on the basis of your consent, which you can withdraw at any time in your settings.
• To keep the Service secure, prevent abuse and investigate misuse — our legitimate interest in protecting the Service and its users.
• To keep a record of your acceptance of the Terms — our legitimate interest in being able to establish and defend legal claims, and compliance with our legal obligations.

6. Who we share it with

We do not sell your personal data and we do not share it for advertising. We share it only with providers that operate parts of the Service on our behalf, and only to the extent they need it:

• our hosting and infrastructure provider, which stores the database and runs the application;
• our email delivery provider — today this is Google, through its Gmail SMTP service. It receives your email address and the content of every message we send you, including verification, password reset, daily summary and signal notification emails. This applies to every account, whether or not you use Google to sign in;
• an IP geolocation provider (ipwho.is), which receives the IP address of your registration request in order to return a country code. No other data about you is sent;
• Google additionally receives your Google account identifier and email address if you choose to sign in with Google. Everything Google receives, by either route, is governed by Google's own privacy policy;
• Telegram, if and only if you choose to connect it, in order to deliver the notifications you enabled.

7. Market data providers

Prices, company information and index data come from third-party market data sources. Those requests are made by our servers about instruments, not about users. No personal data about you is sent to a market data provider, and they are not told what you look at or follow.

The same applies to the AI service that writes the short context notes shown next to some symbols — today this is Google Gemini. Those notes are produced in advance by a scheduled job, not when you open a page. The service receives only figures our own engines already calculated for that instrument; it receives no personal data, and it is never told who is reading, when, or which symbols you follow.

8. International transfers

The Service is available internationally and our providers may process data in a country other than the one you live in. Where personal data is transferred across borders, we take steps to ensure it remains protected to a standard equivalent to that of your home jurisdiction, using the transfer mechanisms recognised under applicable law.

9. How long we keep it

• Account data is kept for as long as your account exists.
• You can delete your account yourself, at any time, from Settings. Deletion is immediate and permanent: your account data, including your watchlist and notification preferences, is removed and cannot be restored.
• The record of your acceptance of the Terms, including its date and version, is stored on your account and kept for as long as the account exists; deleting your account deletes that record with it.
• Verification, password-reset and sign-in exchange tokens expire within minutes to hours and are invalidated once used.
• Operational logs are retained only for as long as needed for security and troubleshooting.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw a consent you previously gave. Withdrawing consent does not affect processing that took place before you withdrew it.

You can exercise several of these directly in the Service: you can change your email preferences, disconnect Telegram, change your language, clear your watchlist, and delete your account outright from Settings, at any time.

For anything else, write to usafintech.destek@gmail.com. We will respond within the period required by the law that applies to you. If you believe we have handled your data improperly, you also have the right to complain to your local data protection authority.

11. Security

Passwords are stored only as bcrypt hashes. Verification, reset and sign-in exchange tokens are stored only as SHA-256 hashes, are single-use, and expire. Changing your password invalidates existing sessions. Sensitive endpoints are rate-limited, and sign-in responses are deliberately written so that they do not reveal whether an email address is registered.

No system can be guaranteed completely secure. Keep your password confidential, do not reuse it on other sites, and tell us promptly if you believe your account has been compromised.

12. Children

The Service is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, write to usafintech.destek@gmail.com and we will delete it.

13. Changes to this policy

We may update this policy. Each version carries an effective date. Where a change materially affects your rights, we will ask you to review and accept the updated documents the next time you use the Service.