Privacy Policy

1. What information do we collect?

Personal information you disclose to us

We collect personal information you choose to give us or that is necessary to operate the Services. This can include account and profile details (such as name, email, and authentication credentials or tokens), communications you send us, waitlist or newsletter sign-ups, and support requests. For mobile apps, app stores and our subscription partner may process payments; we do not receive your full payment card number for those purchases—see "Who will your information be shared with?" below. What we collect depends on which Service you use and your settings. You should provide accurate information and update it when it changes.

Information automatically collected

We automatically collect certain technical and usage data when you use the Services, such as IP address, device or browser type, operating system, language, approximate location derived from IP, referring URLs, timestamps, diagnostic logs, and how you interact with the Services. We use this data to run, secure, debug, and improve the Services, including fraud and abuse prevention. We use cookies and similar technologies where needed (for example, to keep you signed in). Our product analytics run on a self-hosted analytics stack so routine usage analytics are not sent to a third-party analytics SaaS for that purpose.

Push notification tokens

If you turn on notifications in our mobile app, we store a push notification token for that device, along with the platform (iOS or Android), the device time zone, and when the token was last seen. The token is issued by Apple or Google through the Expo push service and identifies the device rather than you personally, but we store it against your account so we send only what you asked for. We use it solely to deliver notifications you have enabled — never for advertising or for tracking you across other apps or websites. Turning notifications off in the app deletes the stored tokens for your account; signing out deletes the token for that device. Tokens the platform reports as no longer valid are deleted automatically.

Information collected from other sources

If you sign in or link an account through a third-party identity provider (for example Apple or Google), we may receive profile or identifier information that provider shares with us according to your settings and their terms. App stores and subscription platforms may also send us limited purchase or entitlement information needed to provide paid features.

2. How do we use your information?

We process personal data on bases such as performing our contract with you, legitimate interests (for example security and product improvement), legal obligation, and consent where required. We use the information we collect to: provide, operate, and maintain the Services (including SSO, APIs, websites, and apps); authenticate users and prevent fraud or abuse; send transactional and service messages; send marketing communications when you have agreed to receive them (you can unsubscribe as described below); send push notifications to your device where you have switched them on in the app (you can switch them off again at any time); analyze how the Services are used (including through our self-hosted analytics); monitor errors and performance; comply with law and enforce our terms; and communicate with you about updates or support. In mobile apps that include advertising, third-party ad networks such as Google AdMob may show ads; those providers may collect or use device or advertising identifiers under their own policies. We do not sell your personal information. We do not use your personal data or user content to train general-purpose AI models; data is used to provide and improve the Services as described here.

3. Will your information be shared with anyone?

We share personal data when you consent, when needed to provide the Services, when we use subprocessors described in this policy, or when the law requires it. Legal bases can include contract, legitimate interests, legal obligation, and consent. We may disclose information: to service providers who process data on our instructions (hosting, email, database, monitoring, subscriptions, ads in apps, etc.); to comply with law, legal process, or government requests; to protect rights, safety, and security; in connection with a merger, acquisition, or sale of assets (with notice where required); and with professional advisers where appropriate. We do not sell your personal information. Mobile apps that use Google AdMob expose limited data to Google for ad delivery and measurement under Google's terms; you can review Google's ads settings and your device's privacy controls for advertising. Unless described in this policy, we do not share your information with third parties for their own marketing.

4. Who will your information be shared with?

We use the following categories of recipients (specific providers may change; we will update this policy for material changes). We enter into appropriate data processing terms where required by law. Many providers operate globally; when data is transferred outside the UK, EEA, or your country, we rely on lawful transfer mechanisms (such as Standard Contractual Clauses or adequacy decisions) as applicable.

• Cloudflare — edge network, hosting, security, and related infrastructure for much of our stack; may process IP addresses, request metadata, TLS information, and similar technical data.
• PlanetScale — managed database hosting for application and account data.
• PostHog — product analytics; usage events and related metrics, processed on PostHog’s EU infrastructure. We do not enable session recording.
• Sentry — error and performance monitoring; diagnostic events may include identifiers, device data, IP address, or stack traces depending on configuration and the incident.
• MailerLite — newsletter and marketing email lists (e.g. email, name as you provide).
• Postmark — transactional email delivery (e.g. sign-in or service notices); we are phasing this provider out over time in favor of other delivery channels.
• RevenueCat — subscription status and entitlements for in-app purchases; payment card data is processed by Apple or Google (not by us directly).
• Google AdMob — advertising in apps such as Classical Forecast (and potentially other apps we publish); Google may process advertising IDs and related technical data under its policies.
• Apple App Store / Google Play — app distribution, updates, and in-app purchase processing according to their terms.

5. Do we use cookies and other tracking technologies?

We use cookies and similar technologies where needed to operate the Services—for example to maintain sign-in sessions for SSO and the website, remember preferences, and protect against abuse. You can control cookies through your browser settings; disabling essential cookies may break parts of the Services.

6. How long do we keep your information?

We keep your information for as long as necessary to fulfill the purposes outlined in this privacy policy unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). No purpose in this policy will require us keeping your personal information for longer than 90 days past the termination of the user's account. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. Some records may be kept longer where law requires (for example accounting, tax, or regulatory obligations).

7. How do we keep your information safe?

We use technical and organizational measures designed to protect personal data, including encryption in transit (HTTPS/TLS) where appropriate, access controls, and vendor security practices. No method of transmission or storage is completely secure; use the Services only on devices and networks you trust.

8. What are your privacy rights?

In some regions, such as the European Economic Area, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time. In some regions (like the European Economic Area), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws. If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal. If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

Account Information

If you would at any time like to review or change the information in your account, you can log into your account settings and update your user account. If you would like to terminate your account, you can contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.

Opting out of email marketing

You can unsubscribe from our marketing email list at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided below. You will be removed from the marketing email list – however, we will still need to send you service-related emails that are necessary for the administration and use of your account. To otherwise opt-out, you may: – Note your preferences when you register an account with the Services. – Access your account settings and update preferences. – Contact us using the contact information provided.

Opting out of push notifications

Push notifications are off unless you turn them on. You can switch them off at any time in the app under Settings, which stops the notifications and deletes the push tokens stored for your account. You can also revoke permission in your device's own system settings; the app will reflect that the next time you open it and will remove the stored token for that device.

9. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

10. Do California residents have specific privacy rights?

CA Civil Code § 1798.83, also known as the "California Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below. If you are under 18 years of age, reside in California, and have a registered account with the Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from our systems

11. Do we make updates to this policy?

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.