Privacy Policy

1. Who is responsible

The controller of your personal data is individual entrepreneur Emil Gasimov, Shafayat Mehdiyev 97, Baku, the Republic of Azerbaijan. Privacy requests go to support@sonarcast.app.

2. What we store

An account holds only what the service needs to work:

• your email address and whether it has been confirmed;
• a bcrypt hash of your password — never the password itself. Accounts created through Google or Telegram have no password at all, only the provider identifier they signed in with;
• optionally a display name and avatar, if your sign-in provider supplied them;
• your Telegram user and chat identifier, if you connect Telegram for notifications;
• your plan, trial and subscription dates, and the payment records behind them;
• your settings: interface language, theme, coin-card layout, the coins you put "in work" and your notification preferences;
• per active session: the IP address and browser user-agent it was opened from, plus a hash of the refresh token — this is what lets you see and revoke your sessions.

3. What we do not do

We do not sell or rent personal data, and we do not run advertising on the site.

Our own visit statistics are collected without cookies and nothing is stored in your browser: which page was opened, where you came from, how long you stayed and which button you chose in the cookie banner. While you are signed out it is fully anonymous — we do not know who you are. Once you sign in, views of the service pages are linked to your account, so we can see which features are used and what is broken.

The only cookies set are the ones the service needs to function: sign-in, session and security, plus your chosen interface language.

With your consent, visits are also counted by Yandex Metrica — the service sets its own cookies. Without consent it does not load; you can withdraw through the "Cookie" button in the footer.

4. Why we process it

To give you access to the account and the plan you paid for; to send the notices you asked for (Guardian alerts, alerts from your own rules, reports) and the ones the service must send (email confirmation, password reset, subscription expiry); to take payment; to keep accounts secure; and to keep the service working.

5. Processors we use

These providers process data on our behalf, each for a single purpose:

• CryptoCloud — payment in USDT. Receives what is needed to issue and confirm an invoice; we never see or store your wallet keys.
• Resend — delivery of service email. Receives your email address and the message.
• Telegram — delivery of notifications, if you connect it. Receives your chat identifier and the message text.
• Google — sign-in, if you use it. We receive the account identifier and email address you consent to share.
• Anthropic (and, as a fallback, OpenRouter) — generation of the narrative text. Receives the market facts our own engine has already computed; account identifiers are not part of that context. Chat messages you type yourself are sent as you wrote them.
• Market data providers (Binance, Bybit, OKX, CoinGlass, CoinGecko) receive no personal data at all — we request public market data from them, not anything about you.

6. YouTube API Services

Sonarcast publishes its own educational videos to YouTube channels it owns, using YouTube API Services. If you watch or interact with that content on YouTube, the YouTube Terms of Service (https://www.youtube.com/t/terms) apply, and Google processes data under the Google Privacy Policy (https://policies.google.com/privacy).

The publishing tool is used only by the Sonarcast team. It uploads videos to our own channels and reads the statistics of those videos (views, likes, comments, privacy status) and of our channels (subscriber count) for internal statistics. These statistics are refreshed every few hours and deleted after 30 days. It does not access, collect, store or share data about YouTube viewers or any other YouTube users, and it places no cookies or trackers on YouTube.

Access to a channel is granted once by its owner through Google sign-in and is stored only on our server. It can be revoked at any time on the Google account permissions page (https://myaccount.google.com/permissions), after which the tool can no longer reach the channel. Questions go to support@sonarcast.app.

7. TikTok

Sonarcast publishes its own educational videos to TikTok accounts it owns, using the TikTok Login Kit and Content Posting API. If you watch or interact with that content on TikTok, the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service) apply, and TikTok processes data under the TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy).

The publishing tool is used only by the Sonarcast team and is not offered to other TikTok users. When an account owner connects one of our accounts, the tool reads only that account's identifier and display name, to confirm the right account was connected. It does not access followers, videos, messages or any other data about TikTok users, and it does not collect, sell or share such data.

Every video is reviewed by a person before it is posted. Access tokens are stored only on our server and used only to upload and publish our own videos and to check the status of each post. The owner can revoke access at any time in the TikTok app settings, under the permissions for apps and services, after which the tool can no longer reach the account. Questions go to support@sonarcast.app.

8. How long we keep it

Account data is kept while the account exists. Sessions expire on their own and are removed. Payment records are kept for as long as accounting and tax rules in the Republic of Azerbaijan require, even after an account is deleted.

Ask us to delete your account and we delete the account and its settings; what remains is only what the law requires us to retain.

9. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete the account, or object to a particular use. Write to support@sonarcast.app from the address the account uses and we will answer within 30 days.

Notification settings, connected channels and active sessions can also be changed by you at any time in the account settings.

10. Security

Passwords are stored only as bcrypt hashes. Access tokens are short-lived and refresh tokens are stored hashed, so a database copy does not hand over live sessions. Traffic runs over HTTPS.

No system is perfectly secure. If a breach ever affects your data, we will tell affected account holders by email.

11. Changes

When this policy changes, the date at the top of the page changes with it. Material changes are announced to account holders by email.