This policy explains what personal data the Insider Stock Trader apps for Android and for iPhone and iPad, their alerts and this website (together, the "Service") collect, why, who else handles it, how long it is kept, and the choices and rights you have.
Key points
- We collect only what the Service needs: your account, your settings and your subscription status.
- No ads, no advertising ID, no tracking across apps, and we never sell or share personal data for advertising.
- Usage analytics are off unless you choose to allow them.
- We send no marketing emails. The only emails are your sign-in codes.
- You can delete your account in the app at any time, or ask us by email.
1Who we are#
The Service is run by two operators, one for each app store:
- Android app (Google Play)
- CallistoVentures, address: John Lennon 1, Lviv 79079, Ukraine
- iPhone and iPad app (App Store)
- Roman Balkan FOP, an individual entrepreneur registered in Ukraine, address: John Lennon 1, Lviv 79079, Ukraine
- Contact for both
- contact@callisto.ventures
Both apps use the same backend and the same accounts, so the two operators decide together how personal data in the Service is used. They are joint controllers of that data and have agreed that privacy requests for both are handled at the contact address above. You can still exercise your rights with either of them. In this policy, "we", "us" and "our" mean the two operators together.
2What this policy covers#
This policy covers the Insider Stock Trader apps, their alerts, the sign-in code emails and the website insider.callisto.ventures. Google Play and the App Store handle your payments under their own privacy policies (see section 11).
3Data we collect#
| Data | When | Why |
|---|---|---|
| Email address | Always (required for an account) | To create your account, sign you in and send your sign-in codes. If you sign in with Apple and choose Hide My Email, we receive a private relay address from Apple instead of your own address. |
| Name and profile picture URL | If you sign in with Google (name and picture URL), or with Apple and choose to share your name (name only) | Kept with your account by our sign-in service. The apps do not show or use them. |
| Account id | Always | A random identifier for your account. It also links your subscription to your account. |
| Sign-in records | Each time you sign in or your session is renewed | The time, IP address and device or browser type of each sign-in, to keep your account secure and stop abuse. |
| Purchase history (subscriptions) | When you subscribe | To give you paid access in both apps. It is received from Google Play or the App Store via RevenueCat, together with which store you subscribed in. We never receive your card details. |
| App activity: your preferences in the app | As you use the app | Your onboarding answers, watchlist, alert settings, saved alert filters, quiet hours, digest time, time zone, display style and alert history, so the app works the way you set it up. |
| Search queries | When you search | Tickers and company names are sent to our backend to answer your search. They are not saved to your account. |
| Device and push identifiers | When you allow notifications; on iPhone and iPad, also whenever the app checks your subscription | An installation id, a Firebase messaging token, the platform and the app version, so alerts reach your device. On iPhone and iPad, Firebase delivers them through Apple Push Notification service. On iPhone and iPad, also a vendor identifier (IDFV) and device details sent to RevenueCat to manage your subscription. |
| Crash logs and diagnostics | In both apps, when the app crashes or misbehaves, and each time you open the app | To find and fix errors (Firebase Crashlytics), and app session events (start time, app and device model, OS version) used to measure crash-free sessions (Firebase Sessions). They are not linked to your account. |
| Technical data (IP address, device model, OS and app version, language) | Always | To deliver and secure the Service. Our servers and every provider in section 11 receive it when the apps or this website contact them, and our providers keep server logs for a limited period (see section 13). |
| Usage events and approximate location | Only if you allow analytics (both apps) | To understand how the app is used. Firebase Analytics derives an approximate location from your IP address (country or city). |
| Messages you send us | When you email us | To answer you, including privacy and deletion requests. |
| Server logs | When the apps or this website contact our servers | Your IP address, the time and the request, and for some requests your account id, kept for a limited period (see section 13) to run the Service securely and to investigate faults. |
An email address is needed for an account, and the Service cannot work without one. Everything else in the table is either collected as the Service runs or is optional.
4How we use it and why#
Where the EU or UK GDPR applies, we rely on these legal bases:
- To provide the Service: your account, sign-in, subscription, feed, searches, alerts and daily digest (performance of our contract with you).
- To keep the Service secure and working: sign-in records, server logs, crash reports and abuse prevention (our legitimate interest in a reliable and secure service).
- To improve the Service: usage analytics (your consent, which you can withdraw at any time).
- To communicate with you: sign-in codes, essential notices about the Service and replies to your messages (contract and legitimate interests).
- To comply with the law: for example, answering lawful requests and keeping records of the privacy requests we handle (legal obligation).
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The "signal strength" scores in the app rate public filings, not the people who use the app.
5Signing in#
You can sign in with Google, with Sign in with Apple or with a 6-digit code sent to your email address, in either app. We never ask you to create a password.
With Sign in with Apple, Apple shares your name only once, at your first sign-in, and only if you choose to share it. Apple does not share your profile picture. If you choose Hide My Email, Apple gives us a private relay address (ending in @privaterelay.appleid.com) that forwards our emails to you, and we never see your own address.
When two sign-ins have the same verified email address, they belong to the same account. You can also link another sign-in method in Settings → Sign-in methods. Linking adds a way to sign in to your account; it never moves data between accounts.
6Analytics and crash reports#
Both apps work the same way. Analytics runs only with your consent. When you first open the app, on Android and on iPhone and iPad alike, it asks whether you want to share usage statistics. Firebase Analytics collects nothing unless you choose Allow, and you can change your choice at any time in Settings → Share usage analytics. Choosing Not now does not limit the app in any way.
Crash reports are sent to Firebase Crashlytics from both apps regardless of this choice, because we need them to keep the Service working. They contain technical details such as the device model, the operating system version and what the app was doing when it failed. Firebase Sessions also sends an app session event each time you open the app (start time, app and device model, OS version), used to measure crash-free sessions. None of this is linked to your account.
7Email and notifications#
We send no marketing emails. There is no newsletter and nothing to sign up for. The only emails the Service sends are the 6-digit sign-in codes you ask for, and our replies when you write to us.
Manage email preferences or unsubscribe. Because we send no marketing email, there is nothing to unsubscribe from. If you want us to stop all email, including sign-in codes, write to contact@callisto.ventures. You can then still sign in with Google or Apple, or you can delete your account.
Push alerts are sent only for the alerts you turn on. You can switch each alert type off in the app's Alerts tab, mute a company on your watchlist, or turn off all notifications for the app in your phone's settings (Settings → Notifications on iPhone and iPad; Settings → Notifications → App notifications on most Android phones).
9What we do not do#
- We do not collect your precise (GPS) location. We also do not collect your contacts, photos, files or messages.
- The app has no advertising id: the apps do not read or transmit the Android advertising ID or Apple's advertising identifier (IDFA), contain no advertising SDKs and show no ads.
- The iPhone and iPad app does not track you across apps and websites owned by other companies, and it never asks for permission to track you.
- We do not sell or rent personal data, and we do not use it for cross-app tracking or for profiling for advertising.
- The Service uses no artificial intelligence. Trade summaries come from fixed rules applied to each filing.
10Public SEC data#
The Service displays information from public filings with the U.S. Securities and Exchange Commission (SEC), including the names of company insiders as filed with the SEC. We obtain these records from the SEC's EDGAR system, not from you, and display them for their public-information purpose: the law requires insiders to report these trades publicly. Every trade links to its original filing. If you are named in a filing and have a question about how we show it, contact us.
11Service providers#
We share personal data only with service providers that process it on our behalf, under contracts that limit its use to providing their service, and with the app stores and sign-in providers you choose to use:
- Railway (Railway Corporation, United States): hosting of our servers in its EU West region (the Netherlands), namely the database, the sign-in service and the API, which run on the open-source Supabase software, the backend worker and this website, and the logs of those services, which Railway stores in the United States.
- Google Firebase (Google LLC): delivery of push notifications (Firebase Cloud Messaging), crash reports and app session events from both apps (Crashlytics and Firebase Sessions) and, with your consent, analytics in both apps.
- RevenueCat (RevenueCat, Inc., United States): subscription management.
- Resend (Resend, Inc.): emails with your sign-in code.
- Google Play (Google LLC): distribution and billing of the Android app.
- Google (Google LLC): Sign in with Google (Credential Manager on Android, Google Sign-In on iPhone and iPad).
- Apple (Apple Inc.): distribution and billing of the iPhone and iPad app (App Store), Sign in with Apple, and delivery of alerts to iPhone and iPad through Apple Push Notification service (APNs), via Firebase.
- Brandfetch: company logos. The apps load each logo directly from Brandfetch's servers, so Brandfetch receives your device's IP address and the ticker or company website of each logo requested. No account data or identifiers are sent.
Google, Apple and RevenueCat also process data under their own privacy policies for their own services, for example to bill you. We may disclose data where the law requires it, or where it is needed to protect the rights and safety of users or the integrity of the Service. If the Service is ever transferred to another operator, your data would move with it under this policy, and we would tell you first.
12Where data is processed#
Our database, sign-in service, API and website run in the European Union (Railway's EU West region, the Netherlands). Railway stores the logs of these services, including request logs with IP addresses, in the United States. The operators are based in Ukraine. Some providers, including Google, Apple, RevenueCat, Resend and Railway itself, are based in the United States. They and other providers, including Brandfetch, may process data outside the European Union.
Where the EU or UK GDPR applies to such a transfer, we rely on an adequacy decision where one exists (for example, for providers certified under the EU-U.S. Data Privacy Framework and its UK extension) and otherwise on the European Commission's Standard Contractual Clauses or the UK equivalent, which our providers include in their data processing terms. You can ask us for a copy of the relevant safeguards.
13How long we keep data#
| Data | How long |
|---|---|
| Account data, preferences and alert history | Until you delete your account. They are then deleted from our live systems at once. |
| Push registrations | Until you delete your account. A device's registration is also deleted automatically when it has not checked in for 270 days or its token stops working. |
| Subscription records we hold | Until you delete your account. |
| Purchase records | Google Play and the App Store keep their own records as long as Google Play, the App Store and applicable tax law require. |
| Sign-in records | Up to 90 days. |
| Server logs | Up to 90 days. Our hosting provider, Railway, keeps the logs of every service, including request logs with IP addresses, for 90 days and then deletes them; it cannot delete them earlier. |
| Database backups | If backups are enabled, they are kept for up to 35 days, so deleted data leaves them within 35 days. |
| Crash reports and app session events | Up to 90 days (Firebase Crashlytics). |
| Analytics data | Up to 14 months, and only if you allowed analytics. |
| Emails with us and privacy requests | As long as needed to answer you, and a record of each privacy request for up to 3 years to show how we handled it. |
14Security#
- All data is encrypted in transit (HTTPS/TLS) between the apps, this website and our servers.
- Your watchlist, alerts and account data are protected by database access rules so that only your own account can read them, and each part of our backend has only the access it needs.
- We store no password for your account: you sign in with Google, Apple or a one-time code that expires after 15 minutes.
- Access to our systems is limited to the operators and protected by strong authentication. Our providers protect their infrastructure with their own physical and technical safeguards, including encryption at rest where they offer it.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities where the law requires it.
15Your rights#
EU, UK, Ukraine and similar laws
Depending on where you live, including under the EU and UK GDPR and Ukrainian data protection law, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data (see Delete your account);
- receive your data in a portable, machine-readable format;
- object to processing based on our legitimate interests;
- restrict processing in certain cases;
- withdraw consent to analytics at any time in Settings, without affecting earlier processing;
- lodge a complaint with your data protection supervisory authority, for example the authority in the EU country where you live, the UK Information Commissioner's Office, or the Ukrainian Parliament Commissioner for Human Rights.
California and other US states
California residents, and residents of other US states with similar laws, have the right to know what personal information we collect, use and disclose, to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information, as the California Consumer Privacy Act defines those terms, and we do not use it for cross-context behavioural advertising. We do not use sensitive personal information for any purpose that would give you a right to limit it. The categories we collect are listed in section 3, the sources (you, your device, your app store and your sign-in provider) in sections 3 and 5, and the recipients in section 11.
How to make a request
To make a request, email contact@callisto.ventures from the email address of your account. If you signed in with Apple and chose Hide My Email, include the private relay address shown in Settings in the app. We may ask for information to confirm the request is yours. We answer within one month, or sooner if your law requires it. If a request is complex, we may extend that once where the law allows, and we will tell you why. An authorised agent may make a request for you with your written permission.
16Children#
The Service is intended only for people aged 18 and over, and it is not directed to children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, or you believe a child has given us data, contact us and we will delete the account and its data.
17Changes to this policy#
We may update this policy as the Service changes or the law requires. We will post the new version on this page with a new date, and tell you in the app before material changes take effect. Where a change needs your consent, we will ask for it.
18About us and contact#
- Google Play operator
- CallistoVentures, John Lennon 1, Lviv 79079, Ukraine
- App Store operator
- Roman Balkan FOP, John Lennon 1, Lviv 79079, Ukraine
- contact@callisto.ventures
See also the Terms of Service, the Refund Policy and how to delete your account.