Privacy Policy

1. Controller

The controller responsible for Chart Scanner Ai is:

Julin Münz Wieselweg 26 76228 Karlsruhe Germany

Privacy and support contact: support@chartscannerai.com.

2. Scope

This Privacy Policy applies to the Chart Scanner Ai iOS app, the website at https://chartscannerai.com, including the support form, and the related backend processing needed to provide those services.

It does not apply to Apple’s processing of your Apple Account, App Store account, or payments; to third-party websites or news sources you open from the app or website; or to other services that publish their own privacy policies.

Chart Scanner Ai provides automated technical chart readings and general market information. It is not investment advice, financial advice, or a personal recommendation to buy or sell any financial instrument.

3. Information processed

Chart Scanner Ai does not operate a user account system. There is no sign-in, no in-app email registration, and no Apple Sign-In. You can use the app without creating an account, and the app does not keep a persistent login session with our backend.

Depending on how you use the service, the following categories of information may be processed:

• Information stored only on your device, such as onboarding answers, language preference, analysis history, and local chart images.
• Information sent for chart analysis, including chart images and/or market data, which is processed using the OpenAI API.
• Search text or a selected financial symbol sent to Yahoo Finance for market data.
• Subscription and purchase information processed through RevenueCat and Apple.
• Name, email address, subject, and message if you use the website support form, together with short-term processing of IP address for rate limiting.
• Editorial market-briefing content stored on our backend. The app does not insert your personal profile into that briefing content.

4. Local device data

The app stores certain information locally on your device. That information may include whether onboarding has been completed; your selected language; onboarding answers such as trading experience, markets of interest, and a stated goal; the remaining free-analysis allowance and the calendar month used for that allowance; saved analyses; and local references to chart images you have chosen.

Saved analyses may include the technical reading (such as Long, Hold, or Short), confidence, reasoning, detected patterns, insights, an optional deeper reading, symbol and name, price and candlestick data, technical indicators, related news context, and an internal chart identifier.

Chart photos or screenshots you take or select may also remain as local image files on the device.

Onboarding answers remain on the device. They are not sent to our servers in the current service, and they are not used to personalise the service after onboarding.

There is currently no in-app function to delete an account, because the app does not create user accounts. There is also currently no in-app function to delete individual saved analyses or the locally stored onboarding answers. Showing onboarding again only resets the onboarding-completed flag; it does not erase saved analyses, the stored profile, or the Profile ad-measurement choice. That choice is stored on the device until you change it or the app’s local storage is removed. An older ad-measurement value from a previous version, stored under a different name, is not used.

Local data generally remains until the app’s local storage is removed, for example if you delete the app. Device backups and operating-system behaviour may differ, and we cannot independently verify every device or backup copy.

5. Chart analysis and AI processing

If you run a chart analysis, the app sends the information needed for that analysis to our backend, which is hosted by Supabase.

Depending on the request, that information may include a financial symbol and name, related market data such as prices, candlesticks, and technical indicators, related news context, and/or a chart image. Chart images are typically compressed before they are sent.

The analysis function returns the result to the app. It does not store the analysis request or the analysis result in our market-briefing database. If you keep an analysis, it is stored locally on your device.

Chart analysis uses the OpenAI API. Relevant chart and market data and, where you upload or select a chart image, that image are sent to OpenAI for processing. OpenAI returns a structured technical reading. This is the OpenAI API, not the ChatGPT consumer application.

According to OpenAI’s current API documentation, data sent to the OpenAI API is not used to train or improve OpenAI models by default, unless a customer explicitly opts in. OpenAI also states that certain abuse-monitoring logs may include customer content such as prompts and responses and may be retained for up to 30 days by default, unless a longer period is required by law or is reasonably necessary to protect OpenAI’s services or third parties. We do not claim that OpenAI stores no data, and we do not claim zero retention. Please see OpenAI’s documentation: Data controls in the OpenAI platform.

The app accesses the camera or photo library only if you choose to take or select a chart image, and only after the operating system permission has been granted. You can change that permission in the device settings.

If a screenshot contains information you do not want processed — for example names, account numbers, or other personal details visible on the image — do not upload that image.

6. Market and news data

If you search for a financial instrument or load a chart, the app may send the search text or selected symbol to Yahoo Finance in order to retrieve quotes, chart data, and related headlines. Yahoo may also receive ordinary technical connection data, such as an IP address, as part of providing that service. Yahoo’s processing is governed by Yahoo’s own privacy information.

The app’s market briefing is generated on the server. A backend process retrieves general business headlines from GNews and stores editorial briefing content so the app can display it. The app does not send your search terms, onboarding answers, or other user input to GNews. GNews publishes its own privacy policy at https://gnews.io/legal/privacy-policy.

The briefing content stored on our backend is editorial or news information, such as title, summary, source, URL, image, and time. The app does not insert your personal data into that content.

7. Subscriptions and payments

Premium access is offered through in-app subscriptions purchased via the Apple App Store.

RevenueCat is used to manage subscriptions. That includes loading available offerings, completing purchases, restoring purchases, and checking whether premium access is active. RevenueCat may process subscription and transaction information and technical information needed to manage subscriptions, such as device type, operating system, receipt information, and related subscription status. The app does not provide RevenueCat with an email address or a custom account identifier. Further detail is published by RevenueCat at https://www.revenuecat.com/privacy-policy.

We do not receive your payment card number through the app. Apple handles App Store account and payment processing independently. Apple’s practices are described in Apple’s privacy policy: https://www.apple.com/legal/privacy/.

Install and subscription measurement is separate from providing the subscription. The app starts AppsFlyer only when both of these are true: the Profile ad-measurement choice is on, and Apple’s tracking status is granted. The choice stays on until you turn it off. If the choice is off, AppsFlyer is not started, whatever Apple’s status is. If the choice is on and the status is denied, restricted, or not yet decided (undetermined), the app does not initialize or start AppsFlyer and does not send RevenueCat an AppsFlyer identifier. Apple’s restricted status is reported to the app as denied.

If the choice is on and tracking is granted, AppsFlyer can receive an install event. That event can include the IP address, the vendor identifier (IDFV), the advertising identifier (IDFA), and an AppsFlyer identifier. The app then sends the AppsFlyer identifier to RevenueCat and calls Purchases.collectDeviceIdentifiers(). That call can send the advertising identifier (IDFA), the vendor identifier (IDFV), and the IP address to RevenueCat. RevenueCat can send subscription purchases and renewals to AppsFlyer, linked by the AppsFlyer identifier. Those events can include the product identifier and the purchase amount. When measurement starts, the app clears AppsFlyer’s partner-sharing filter. Sharing with advertising partners then follows the partner and event configuration in the AppsFlyer account.

The app does not show a separate Allow or Don’t allow screen before the paywall. Apple’s tracking dialog is the system permission for the advertising identifier. Allowing it is not stored as consent for personalized advertising or for storing advertising information on the device. The app does not tell AppsFlyer that those consents were given. The Profile choice does not open that dialog again.

Profile lists Ad measurement under Legal. While the choice is on, the row reads Stop ad measurement. After you turn it off, the row reads Allow ad measurement. Turning it off stores that choice on the device first. The app then asks the AppsFlyer SDK to stop when that SDK was started in the same app session, asks RevenueCat to clear a stored AppsFlyer identifier, and asks RevenueCat to block sharing with advertising partners. Turning it on stores that choice first. AppsFlyer starts on that tap only when Apple’s tracking status is already granted. If it is not granted, the app leaves the partner-sharing block in place and does not start AppsFlyer. On each later launch while the choice stays off, the app reads that choice before the tracking status, repeats the request to RevenueCat, and does not start AppsFlyer even when tracking is granted. These requests to RevenueCat are not a guarantee that RevenueCat deletes the identifier or applies the block. Events already sent are not deleted. RevenueCat documents that some device identifiers cannot be changed once stored. If the AppsFlyer identifier cannot be deleted, RevenueCat can still send later renewal events to AppsFlyer. You can also change Apple’s tracking permission in the iOS settings.

8. Product analytics

The app uses PostHog to understand how the app is used. This product analytics is separate from AppsFlyer and from RevenueCat. The app does not send PostHog an AppsFlyer identifier or a RevenueCat customer identifier, and it does not replace PostHog’s identifier with either of those.

PostHog starts when the build contains a PostHog project token and host. It does not show Apple’s tracking dialog, and it does not depend on Apple’s tracking status. A granted, denied, restricted, or undetermined status does not start or stop PostHog. The Profile ad-measurement choice does not start or stop it either. That choice and Apple’s tracking status control AppsFlyer, as described in section 7.

The app sends only these events: the app was opened; onboarding was completed; the paywall was viewed; a subscription plan was selected; a subscription purchase completed, failed, or was restored; a chart analysis was requested, completed, or failed; and a watchlist item was added or removed.

An event can include the app version, build number, app name, bundle identifier, and the name and version of the PostHog library. Onboarding can include the number of markets selected and whether onboarding had already been completed. A subscription event can include the plan, which is only weekly or halfyear. A failed purchase can include one of two categories: entitlement inactive or purchase error. A chart-analysis event can include whether the reading was standard or deep, and whether it came from a scan or a symbol. The app does not send chart images, ticker symbols, analysis identifiers, AI prompts, news articles, AI responses, names, or email addresses.

Session replay is turned off. The app does not send screenshots, touch autocapture, or automatic capture of text inputs for this analytics. It does not send person properties, and person profiles are set to never.

The PostHog SDK creates an anonymous identifier, stores it on the device, and sends it with these events so events from the same installation can be grouped. The app does not set that identifier to an account, email address, AppsFlyer identifier, or RevenueCat customer identifier.

Events are sent to the PostHog host configured for that build. The host set in this project is https://eu.i.posthog.com. The app does not add the IP address as an event property. The request still leaves the device, so PostHog can receive the IP address with the connection. The SDK is configured with GeoIP lookup disabled, but the app’s outbound filter does not keep that instruction on the event. This policy does not state that PostHog discards the IP address. The app does not set a retention period for these events and does not send PostHog a request to delete events that have already been sent. PostHog’s privacy policy is at https://posthog.com/privacy.

9. Website and support requests

The website at https://chartscannerai.com is used to present Chart Scanner Ai and to receive support requests. It does not provide user accounts or a payment flow, and it does not use a first-party analytics or advertising-tracking system.

If you use the support form, we process your name, email address, subject, and message. Hidden fields may be used only to help detect automated abuse.

Support messages are sent through Resend to support@chartscannerai.com. Your email address is used as the reply-to address so that we can answer you. Support correspondence may be kept in the support mailbox as ordinary email. Resend’s own documentation describes how Resend processes email as a service provider: https://resend.com/legal/privacy-policy and https://resend.com/security/gdpr.

To help prevent abuse, the support form may process your IP address for short-term rate limiting. That IP address is not stored in our own database. It is held only for the short period needed to apply the rate limit.

10. Hosting and infrastructure

We use the following service providers to operate Chart Scanner Ai:

• Supabase, for backend processing and storage of market-briefing content.
• Cloudflare, for website hosting and related network and security services.
• Resend, for delivery of support emails.
• Expo, for building and distributing the app. Expo is used as build infrastructure, not as an analytics service we run inside the app.

These providers may process ordinary technical information, such as IP addresses, timestamps, and security logs, as part of providing their services. We do not control their infrastructure logs.

11. External websites

If you open a news story or other link in the app or on the website, the destination website may load in an in-app or ordinary browser. That website may set its own cookies, run its own scripts, and collect its own information.

Chart Scanner Ai does not control those external websites. Their privacy practices are governed by their own policies.

12. Purposes and legal bases

We process personal data to provide the app and website; to perform chart analysis you request; to show market data, search results, and the market briefing; to store your own analyses on your device if you use that feature; to apply the free-analysis allowance; to provide and restore premium subscriptions; to answer support requests; to protect the service against abuse; and to comply with legal obligations where they apply.

Install and subscription measurement follows section 7, including the Profile ad-measurement choice and Apple’s tracking status. Product analytics follows section 8. The website does not use a first-party advertising or analytics SDK.

Where the GDPR applies, we rely on the following legal bases.

Article 6(1)(b) GDPR (performance of a contract or steps requested before entering a contract): processing that is necessary to provide the functions you ask for, including chart analysis, market-data display, local saving of analyses, subscription access, and answering a support message you send.

Article 6(1)(f) GDPR (legitimate interests): operating a stable and secure service; preventing abuse of the support form, including short-term IP-based rate limiting; and using specialist providers to host the website, backend, email delivery, and subscriptions. These interests do not include advertising profiling. You may object to processing based on legitimate interests as described below. If the processing is required for a function to work, we may be unable to provide that function if you object.

Article 6(1)(a) GDPR (consent): where the operating system requires permission before the app can access the camera or photo library, that access takes place only if you grant the permission. You may withdraw it in the device settings. Withdrawal does not affect processing that has already taken place and does not by itself erase analyses already stored on the device.

The app does not collect a separate in-app consent for advertising measurement, personalized advertising, or storing advertising identifiers. Apple’s tracking permission is a system permission for the advertising identifier. This policy does not treat that permission as consent for those other purposes.

13. Recipients and service providers

Personal data may be disclosed to the following categories of recipients, only as needed for the purposes described in this policy:

• Supabase, for backend processing and market-briefing storage.
• OpenAI, for AI analysis of the chart and market information described above.
• Yahoo Finance, for search and market-data requests made from the device.
• GNews, for server-side retrieval of general business headlines.
• RevenueCat, for subscription management and, as described in section 7, for the AppsFlyer identifier, device identifiers, and forwarding of subscription events to AppsFlyer.
• AppsFlyer, for install measurement when the Profile ad-measurement choice is on and Apple’s tracking status is granted, and for subscription measurement when those events are forwarded, as described in section 7. AppsFlyer’s privacy policy is at https://www.appsflyer.com/legal/privacy-policy/.
• TikTok, through AppsFlyer’s partner integration. Whether data is disclosed to TikTok depends on the partner and event configuration active in the AppsFlyer account.
• PostHog, for the product analytics described in section 8. PostHog’s privacy policy is at https://posthog.com/privacy.
• Apple, for App Store purchases and independent account and payment handling.
• Cloudflare, for website hosting and network security.
• Resend, for sending support email.
• News publishers and other websites you choose to open.
• Professional advisers or competent authorities if we are legally required to disclose information.

We do not sell personal data.

14. International transfers

Some of the providers named in this policy are established outside the European Economic Area, or may process data outside the EEA, including in the United States. That can apply in particular to OpenAI, RevenueCat, Apple, Yahoo, Cloudflare, Resend, AppsFlyer, and TikTok. Whether TikTok receives measurement data depends on the AppsFlyer account configuration described in section 13. Product-analytics events are sent to the PostHog host in section 8. This policy does not describe any further transfer by PostHog, because the app does not configure one.

Where a provider’s current official documentation identifies transfer safeguards, those include Standard Contractual Clauses. Cloudflare also states that it relies on the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework for relevant transfers to the United States. See Cloudflare’s privacy policy, OpenAI’s Data Processing Addendum, Supabase’s Data Processing Addendum, and Resend’s GDPR information.

Independent services such as Apple and Yahoo process information under their own policies when you use their services.

15. Retention

We do not apply a single retention period to every category of data. Retention depends on where the information is stored and which provider processes it.

Information stored locally by the app remains on the device until it is overwritten by the app or until the app’s local storage is removed, for example if you delete the app. There is currently no in-app deletion tool for saved analyses, and those analyses do not expire automatically. The free-analysis allowance resets by calendar month.

Chart-analysis requests and results are not stored in our market-briefing database. Market-briefing content is editorial content kept in order to provide the news feature.

Support messages are processed in order to deliver them to us. Copies may remain in the support mailbox as ordinary correspondence for as long as needed to handle the enquiry and any related legal obligations. Resend’s published documentation describes Resend’s own retention of email and log data; we do not control Resend’s infrastructure beyond that documentation.

IP addresses used for support-form rate limiting are held only for the short period needed to apply that limit and are not stored in our own database.

OpenAI’s current API documentation describes default abuse-monitoring retention. We do not claim a retention period we cannot control. Subscription information processed by RevenueCat and Apple is retained by those providers as needed to administer the subscription, restore purchases, and meet their own legal duties. The app does not set a retention period for PostHog events, and this policy does not state one.

Infrastructure logs held by hosting and security providers are retained according to those providers’ systems. This policy does not state a fixed deletion date for those logs.

16. Security

We take measures appropriate to a small app and website. Communication with our backend and website uses HTTPS. The app does not create user passwords or in-app accounts. Chart images are compressed before they are sent for analysis. Analysis requests and results are not stored in our market-briefing database.

No method of transmission or storage is completely secure. If you believe your personal data has been compromised, contact support@chartscannerai.com.

17. Your GDPR rights

If the GDPR applies to you, you may have the right to access your personal data, to obtain rectification, to request erasure, to obtain restriction of processing, to receive data portability, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. These rights are subject to the conditions and exceptions in the GDPR. Not every right will apply in every circumstance.

Because Chart Scanner Ai does not operate user accounts, we may hold little or no personal data about app-only use other than information you later send us, such as a support email, or information processed independently by subscription providers.

Local device data is stored on your device. We cannot remotely delete the app’s local storage. Deleting the app is currently the practical way to remove that local information, subject to device backups and operating-system behaviour.

To exercise rights regarding information we hold, such as a support message, email support@chartscannerai.com. We may need to verify the request. Subscription status and App Store payments are administered by Apple, and some requests may need to be directed to Apple as well. Apple’s tracking permission can be changed in the iOS settings. Ad measurement can be switched off or on in Profile, as described in section 7. Switching it off does not by itself delete events already sent. Product analytics has no switch of its own. Changing Apple’s tracking permission or the Profile ad-measurement choice does not start or stop PostHog. Whether PostHog starts follows section 8. The app does not send PostHog a request to delete events already sent.

You also have the right to lodge a complaint with a supervisory authority. Because the controller is established in Karlsruhe, Germany, you may contact the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI): https://www.baden-wuerttemberg.datenschutz.de. You may also contact the supervisory authority of your habitual residence, your place of work, or the place of an alleged infringement.

18. Children

Chart Scanner Ai is intended for a general audience interested in financial-market information. It is not directed at children, and we do not knowingly collect personal data from children in order to offer the service to them.

If you believe a child has sent us personal data through the support form, contact support@chartscannerai.com.

19. Automated processing

Chart analysis uses automated technical processing of market data and, where provided, a chart image. The output is informational market information, such as a Long, Hold, or Short reading with supporting explanation.

This is not automated decision-making about a natural person that produces legal or similarly significant effects. Chart Scanner Ai does not use the analysis to grant credit, conclude a contract about you, or otherwise decide on your person.

Onboarding answers are stored locally and are not used to create a server-side profile.

20. Cookies

Chart Scanner Ai does not use advertising cookies or a first-party analytics cookie system on the website.

Cloudflare, which hosts the website, may process technically necessary connection and security data as part of providing hosting and security. Those mechanisms are distinct from advertising or tracking cookies used for marketing.

Third-party news sites or other websites you open may set their own cookies. Those cookies are governed by the policies of those websites.

21. Changes

We may update this Privacy Policy if the app, website, providers, or applicable law change. The current version will be published at https://chartscannerai.com/privacy and, where included, in the app. The “Last updated” date at the top will change when a revision is published.

22. Contact

Questions about this Privacy Policy or about personal data can be sent to:

Julin Münz Wieselweg 26 76228 Karlsruhe Germany

Email: support@chartscannerai.com.