Privacy Policy
Version 1.4 — Effective 14 October 2026This is the same policy the app asks you to read and confirm at sign-up. See also the Terms & Conditions and Risk Disclaimer.
1. What we collect
1.1 Account data: your email address and, where one is supplied, your display name — provided by your Apple or Google sign-in, or entered by you when you create an account with an email address and a password — your sign-in provider identifiers, and the country you select at sign-up (or, once you subscribe, the country reported by your app store). If you sign in with an email address and a password, the password is held in protected (hashed) form by our authentication provider (see 3.1); our own servers never receive or store it.
1.2 Content you create: your strategies and their conditions, watchlists, applications of strategies to instruments, and settings (theme, digest timing, notification preferences).
1.3 Service activity: your alert history and the evaluation results behind it, backtest requests and results, and match/ranking data computed for your configurations.
1.4 Device data: push notification tokens for your devices, and the app version and platform.
1.5 Subscription data: your plan, subscription status, renewal state, the identifiers the store or Stripe assigns to your subscription, and an append-only history of subscription lifecycle events (for example "subscribed", "renewed", "cancelled renewal", "refunded"). We never receive or store card or payment details — payment is handled entirely by Apple, Google, or Stripe.
1.6 Promotion records: which promotional codes you redeemed, when, and the sign-in identity and email that redeemed them (kept to enforce one-redemption-per-person; see 5.3).
1.7 Legal acceptance records: which version of the Terms, this policy, and the Risk Disclaimer you accepted or confirmed reading, when, from which app version, the email on the account at the time, and a best-effort IP address (kept as evidence of acceptance; see 1.9 and 5.3).
1.8 Technical logs: request identifiers, timestamps, and operational events, used to run and support the Service.
1.9 We do not collect: payment card details, GPS or other precise device location, your contacts, or advertising identifiers. The Service contains no third-party advertising or analytics SDKs. IP addresses, which may indicate an approximate country or region, are processed for security, fraud prevention, country-availability controls (Terms 2.5), and evidence of legal acceptance; we do not use them to track your location.
2. Why we process it (and legal bases where applicable)
2.1 To provide the Service you asked for — evaluating your strategies, generating and testing variations of them when you ask, sending your alerts and digests, showing your history, honouring your plan.
2.2 To operate billing entitlements from store and payment-provider events.
2.3 To prevent fraud and abuse — including enforcing one-promotion-per-person and detecting misuse of the Service.
2.4 To keep evidence of what you agreed to and of subscription events, so that we can establish and defend legal claims.
2.5 To communicate with you about the Service itself. We do not send marketing without a separate choice, and we never sell your personal data.
2.6 Legal bases. In the United Kingdom, and in any other jurisdiction whose law uses comparable concepts, we rely on: performance of our contract with you (2.1, 2.2); our legitimate interests in running the Service honestly and in establishing and defending legal claims (2.3, 2.4), and legal obligation where one applies; and consent where the law requires it for a specific activity. In other countries we rely on the grounds their law provides — consent where it is required, and the permitted-use grounds their law recognises for providing a service you have asked for, preventing fraud, and keeping legal records. Where the law requires consent for a particular processing activity, we ask for it separately and specifically; reading or acknowledging this policy is not that consent.
2.7 Automated processing. The Service uses automated systems to evaluate market rules, to generate or modify candidate strategy configurations when you ask, and to calculate and rank historical performance. These processes concern the analytical configuration you requested. They are not used to make decisions about your credit, employment, insurance, eligibility for services, or other similarly significant personal matters.
3. Who receives it
3.1 Apple and Google: sign-in, billing, and push notification delivery (APNs and Firebase Cloud Messaging) as independent services you also have a relationship with. Google also operates the authentication service we use (Firebase Authentication), which handles sign-in for every method on our instructions and, for accounts that use an email address and a password, holds the password and sends the address-confirmation and password-reset emails.
3.2 Stripe (Stripe, Inc. and its affiliates): when you subscribe on our website, we send Stripe your email address and an identifier for your account, so that it can open the checkout and tell us which account a payment belongs to. Stripe then collects your name, billing address, and payment details on its own pages and — as the merchant of record for web purchases under its Managed Payments service — processes the payment, calculates and remits any tax, sends receipts, and handles refunds and disputes under its own terms and privacy policy; purchases appear as sold through Link, Stripe's payment service. We receive back the subscription's identifiers, status, and lifecycle events, and never your card details. Stripe acts on our instructions for the email address and identifier we send it, and as an independent controller for the payment data it collects itself.
3.3 Our hosting and infrastructure providers, acting on our instructions.
3.4 Our AI provider, Anthropic PBC (United States): when you use the AI strategy features, the description you type, your strategy's configuration, and your plan's capabilities are sent to Anthropic's API to generate the response, on our instructions and under Anthropic's commercial terms and data processing addendum. No market positions, trades, account identifiers, or payment information are included. Under those commercial terms this data is not used to train Anthropic's models, and Anthropic retains it only for the limited period its terms allow for abuse monitoring and service operation.
3.5 Market data providers receive no personal data from us.
3.6 Authorities or advisers where required by law or to establish or defend legal claims.
3.7 A buyer or successor in a business transfer, under this policy, with notice to you.
4. International transfers
4.1 Your data is stored and processed on our hosting infrastructure in the United States: on Microsoft Azure (East US 2, Virginia) and, for our database, Timescale (TigerData) in the same region. We access and administer it from the United Kingdom. Requests to the AI strategy features are processed by Anthropic in the United States (see 3.4). Apple and Google process sign-in, billing, and push delivery, and Stripe processes web payments, in their own locations under their own terms.
4.2 Because we are established in the United Kingdom, transfers of your data out of the United Kingdom — including to our hosting providers in the United States — are made under UK GDPR: to countries covered by UK adequacy regulations, which include transfers to United States organisations certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US “data bridge”), or otherwise under the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, with a transfer risk assessment where required. Details of the mechanism relied on for each provider are available on request.
4.3 If you are outside the United Kingdom, your data is transferred to the United States (and to the United Kingdom, where we access it, and to the processors above) to provide the Service. We handle that transfer under the rules of your country — for example the reasonable-steps and accountability obligations of Australian Privacy Principle 8, the comparable-protection requirement of Singapore's PDPA, the cross-border transfer rules of the UAE Personal Data Protection Law, the Philippine Data Privacy Act, and India's Digital Personal Data Protection Act as its provisions commence — by contractual arrangements with our processors, by the technical measures in section 7, and by the rights in section 6, which we honour wherever you are. Details of the mechanisms in place for your country are available on request.
5. How long we keep it
5.1 While your account is active: for as long as needed to provide the Service. Alert history is kept for a fixed period (currently 14 days) that is the same on every plan, and then removed by scheduled cleanup.
5.2 When you delete your account: your account is closed immediately and permanently; strategies, watchlists, applications, and device push tokens are removed from service at deletion, and the remaining account data is scrubbed on a scheduled cycle.
5.3 Exceptions that survive deletion, kept separate and used for nothing else: (a) legal acceptance records (1.7): the account identifier, the document and version accepted, the time, and the app version are kept as evidence of what was agreed for the limitation period for contract claims that applies to you, up to a maximum of 15 years after account deletion (the longest such period among our launch countries, Ontario's ultimate limitation period; six years in England and Wales). The email address and IP address recorded with an acceptance are removed from the record six years after account deletion unless a claim or dispute involving that acceptance is open; (b) subscription event history (1.5): store and payment-provider identifiers and lifecycle events are kept for as long as tax, accounting, and store- or payment-dispute requirements demand, and as evidence for the same limitation period as (a), up to the same maximum; (c) promotion redemption records (1.6): while the promotion they belong to is active and for 36 months after it closes, where reasonably necessary to prevent repeat redemption and to resolve disputes, after which they are deleted. These records exist to prove what was agreed and what occurred if a claim is ever made (see UK GDPR Article 17(3)(e) and equivalents), and access to them is restricted to that purpose.
6. Your rights
6.1 Everyone, regardless of region: you can export everything we hold about you from the account screen (delivered as a machine-readable file), correct your settings in the app, and delete your account in the app.
6.2 United Kingdom: under UK GDPR you have rights of access, rectification, erasure (subject to the retention exceptions in 5.3), restriction, portability, and objection, and the right to complain to the Information Commissioner's Office (ico.org.uk).
6.3 Australia: under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may request access and correction, and complain to the OAIC (oaic.gov.au).
6.4 Canada: under PIPEDA you may request access and correction, and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If your province has its own private-sector privacy law (for example Alberta or British Columbia), you may also complain to your provincial privacy regulator. The Service is not currently offered to consumers in Quebec (see the Terms of Service, clause 13).
6.5 Singapore: under the PDPA you may request access and correction, and complain to the PDPC (pdpc.gov.sg). Our data protection officer for the purposes of the PDPA is our Privacy Lead (see 6.11).
6.6 United Arab Emirates: under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data you may request access, correction, and deletion, and complain to the UAE Data Office.
6.7 India: we voluntarily make access, correction, export, and erasure (subject to the retention exceptions in 5.3) available to you as described in 6.1, and you may raise a grievance with us at support@sixone8.app, our grievance contact. Statutory rights and obligations under the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 apply from their respective commencement dates, which are staggered; as each provision commences we will honour it — including the right to escalate an unresolved grievance to the Data Protection Board of India — and update this policy and our processes accordingly.
6.8 Philippines: under the Data Privacy Act of 2012 you have rights of access, correction, erasure, objection, and damages, and may complain to the National Privacy Commission (privacy.gov.ph).
6.9 Pakistan: no comprehensive data protection statute is currently in force; we honour access, export, and deletion for all Pakistani users as described in 6.1.
6.10 United States: depending on your state you may have rights of access, deletion, and correction; we honour access and deletion requests for all US users as described in 6.1.
6.11 To exercise any right that the in-app tools do not cover, contact support@sixone8.app with "Privacy" in the subject line; our Privacy Lead — our designated data protection officer wherever the law requires one — handles these requests. We may need to verify you control the account before acting. We provide the Service and our support in English.
7. Security
Data is encrypted in transit; access is restricted and logged; we hold no payment card data at all. No system is perfectly secure — if a breach affects you and the law requires notice, we will notify you and the relevant authority.
8. Children
The Service is for adults (18+). We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
9. Changes to this policy
This policy is a notice, not a contract. When we publish a new version we make it available in the app and on our website, ask you to confirm you have read it before continuing, and record the version and the time of that confirmation. Where a change means the law requires your consent for a particular processing activity, we ask for that consent separately. Confirming that you have read this policy is not consent to processing beyond what the law otherwise permits.