Privacy Policy

1. Information we handle

App settings and cached content. The app stores your watchlist, notification selections, tutorial preferences and cached market responses on your device. It also keeps signal IDs locally to avoid showing duplicate notifications. These settings do not require a personal account. Watchlist choices are not uploaded as a personal portfolio.

Network requests. Loading the site or requesting market data necessarily exposes connection information, including your IP address, to the systems delivering the service. Our API processes connection addresses for temporary request-rate limits and connection limits. Server diagnostic logs may include connection addresses, request paths, times, response codes and error information.

Notification registration, where enabled. A notification-enabled build can register a random installation ID, a hashed authentication secret, notification asset and strategy selections, a messaging token, an update time and delivery records. These are used to route selected signal alerts rather than to create a named user profile. The current Android build does not initialise Firebase Cloud Messaging because a Firebase project has not yet been configured, so Firebase push-token collection and delivery are not currently active. We will update this policy when that changes.

Support correspondence. If you email us, we receive your email address, message, attachments you choose to include and ordinary email metadata. The current in-app feedback form does not transmit its contents to us; use the support email to contact us.

What we do not request. The current service does not require your name, phone number, identity documents, payment details, broker credentials, contacts, precise location, camera or microphone access. The app does not place trades or collect your brokerage account balance or transaction history.

2. Why we use it

• Deliver market quotes, charts, signals and historical outcomes.
• Remember choices locally and provide cached content when a connection is interrupted.
• Route signal notifications when the feature is configured and you choose to enable it.
• Protect service availability, limit abuse and diagnose technical errors.
• Answer support messages and handle privacy requests.

We do not sell personal information, use advertising SDKs, or run behavioural advertising or cross-site tracking on this website. Firebase Analytics collection is disabled in the app. Depending on the law applicable to you, we rely on providing the requested service, legitimate interests in security and support, your consent where required, or a legal obligation.

3. Service providers and sharing

Hosting. Our site, API and database are hosted on DigitalOcean infrastructure in Frankfurt, Germany. The hosting provider processes the network and infrastructure information needed to operate that service.

Email. Mail to support@bosignals.org is routed by Cloudflare Email Routing to a Gmail inbox operated by Google. These providers process email content and metadata to deliver and store correspondence.

Market data. EODHD supplies market prices to our server. The app receives this data through our API; it does not send its installation identifier or notification selections directly to EODHD.

Optional push delivery. Google Firebase Cloud Messaging is included for future notification delivery but is not initialised in the current build. If enabled in a later build, Google will process messaging tokens and technical information needed to deliver alerts as explained in its documentation and privacy terms.

We may disclose information when required by law, to protect the service or the rights and safety of others, or as part of a lawful transfer of the service with appropriate notice and safeguards. Providers may process information outside your country, including outside the European Economic Area. Their own privacy terms describe their processing. See the privacy information of DigitalOcean, Cloudflare and Google.

4. Storage, security and retention

App-to-server and website connections use HTTPS, and live updates use secure WebSocket connections. Database ports are not publicly exposed. Local installation credentials are protected using Android Keystore-backed encryption. Access to server administration and backups is restricted. No method of storage or transmission is completely secure.

Local preferences remain until you clear the app’s storage or uninstall it. Cached market responses and notification deduplication records are periodically cleaned when their relevant app functions run, using a seven-day age threshold. This is not a guarantee of deletion while the app is unused.

Temporary API request counters normally expire after about a minute; installation-registration limits use an hourly window. Connection-limit keys have their own expiry. Diagnostic logs rotate according to size rather than a guaranteed calendar retention period.

If notification registration is used, installation records and associated delivery information are kept while needed for notification delivery and are removed following a valid deletion request or authenticated installation-deletion operation. There is currently no automatic inactivity-deletion schedule for these records.

Support correspondence is retained for as long as reasonably needed to resolve the request, maintain relevant records, protect the service and meet legal obligations. We review deletion requests rather than keeping correspondence for advertising.

Routine database backups retain seven daily archives. Separate migration or recovery copies may remain until no longer needed for recovery. A deletion in the live system may not immediately remove a record from an existing restricted backup. If a backup is restored, applicable deletion requests must be reapplied. Public market candles and signal results are not personal trading records and may be retained independently of app-installation data.

5. Your choices and deletion requests

You can change your watchlist and notification selections in the app, disable notifications in the app or Android settings, and clear local data through Android’s app settings. Clearing local storage or uninstalling does not by itself delete a server-side installation record, if one exists.

To ask about access, correction or deletion of information we hold, email support@bosignals.org with the subject “Privacy request”. Explain the information or request concerned. We may need proportionate information to verify the request and locate a record; do not send passwords, authentication tokens or financial account credentials. We will respond without undue delay and in accordance with applicable law.

Depending on your location and applicable law, you may also have rights to restriction, objection, portability, withdrawal of consent or a complaint to a data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal. Some information may need to be retained for a legal obligation, security or the establishment or defence of legal claims; we will explain any applicable restriction.

The website does not set analytics or advertising cookies and does not use local storage for tracking. Opening an external provider’s website is subject to that provider’s own policy.

6. Children

BOSignals is intended for adults and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and address it.

7. Changes and contact

We will update this page when our data practices or service features change and revise the date above. Where a material change requires additional notice or consent, we will provide it as required.

Privacy contact: support@bosignals.org
Website: bosignals.org