Privacy Policy

In short

Alpha22 has no user accounts, analytics, ads or cookies. The app does not collect data about you. We only process what is technically necessary for the Service, as described below.

Controller

The controller is [to be completed: name], [to be completed: address], as an unregistered business activity (Article 5 of the Polish Entrepreneurs' Law) (the Controller). For anything about personal data, write to contact@alpha22.app.

What we process

Technical connection data

When the app or a browser connects to our servers, the hosting providers log the IP address, the time and address of the request and information about the browser or system. This keeps the Service running and secure (Article 6(1)(f) GDPR). Logs are kept for the period set by the providers' rules, described in the privacy policies of Supabase and Cloudflare, and are not used to identify you.

Abuse protection

The app's requests to our server pass through a proxy server on the Cloudflare network. It counts the requests sent from each IP address to limit their number and protect the Service from abuse, and it checks the app key, which confirms that the request was sent by the Alpha22 app. The counters cover one minute and are not stored permanently. The legal basis is our legitimate interest in keeping the Service secure (Article 6(1)(f) GDPR).

Subscription check

When downloading full reports, the app sends the App Store transaction signed by Apple. We verify it and its current status with the App Store Server API. We do not store or log the transaction itself. To avoid asking Apple on every download, the server keeps in memory, for no longer than an hour, the original transaction identifier with whether the subscription is active; after that this information is deleted. The transaction contains purchase identifiers, but not your name, email or Apple Account. These identifiers are pseudonymous data: we cannot link them to you ourselves. The legal basis is the performance of the contract (Article 6(1)(b) GDPR).

Correspondence

If you write to us, we process your email address and the message to reply (Article 6(1)(b) or (f) GDPR), for as long as needed to handle the matter and any claims. Messages are stored by our email provider.

Data on your iPhone

Downloaded reports, settings and which reports you have read are stored only on the device and are not sent to us. Notifications about new reports are local: we do not use push notification tokens.

Statistics and crash reports from Apple

If you agree in your iPhone's settings to share data with app developers, Apple gives us aggregate app usage statistics and crash reports. Apple processes this data as a separate controller, and we do not receive data that identifies you. You can withdraw this consent in your iPhone's settings (Privacy & Security → Analytics & Improvements).

Payments

Apple handles payments as a separate controller under Apple's privacy policy. We do not receive payment data.

Do you have to provide data

Technical connection data is necessary to use the Service: without it the server cannot answer a request. Writing to us is voluntary.

Recipients

Data may be received by:

• Supabase – server and database hosting on our behalf (region in the European Union); privacy policy,
• Cloudflare – content delivery network, website server and the proxy for the app's requests, on our behalf; privacy policy,
• Apple – checking the subscription status through the App Store Server API; Apple acts as a separate controller; privacy policy,
• our email provider – hosting the contact@alpha22.app mailbox, on our behalf.

Stock price providers receive no user data.

Transfers outside the European Economic Area

Supabase, Cloudflare and Apple are based in the USA or use subprocessors there, so data may be transferred outside the European Economic Area. Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (for certified companies) or on standard contractual clauses approved by the European Commission. You can get a copy of these safeguards by writing to contact@alpha22.app.

Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR), and we do not profile you. Reports are the same for everyone.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interests. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). As we do not keep accounts, we usually do not hold data that would identify you.

Children

The Service is not directed at people under 18, and we do not knowingly process children's data.

Website

alpha22.app uses no cookies, analytics or tracking tools. The server only logs the technical connection data described above.

Changes

The current version of this policy is shown on the website and in the app's Settings. We will announce significant changes on the website and in the app.