Privacy Policy

Last updated: August 15, 2026

Margin Call (the "Service") treats your personal data as important and has established this policy to comply with applicable data protection law. It explains what personal data the Service collects, why, how long it is kept, and what rights you have.

1. Data we collect

• Required (when you sign in with Google): email address and the Google account identifier.
• Optional: watchlists, holdings, transactions, exit strategies and other investment data you enter yourself.
• Collected automatically: a device identifier (device_id, stored in localStorage rather than a cookie), IP address, browser User-Agent, access time and pages visited — for service quality and security.

2. Why we use it

• Sign-in, account identification, and syncing your data (watchlists, portfolio) across devices.
• Migrating data between devices and holding temporary data while signed out.
• Usage statistics and product improvement.
• Security — blocking abnormal access and malicious bots.
• Serving ads (Google AdSense and Google AdMob — see section 4).

3. How long we keep it

Data you enter while signed in with a Google account is kept until you delete your account. You can permanently delete your account and all of your data (watchlists, portfolio, exit strategies, settings and the sign-in account itself) at any time from Profile > Delete account and data in the app or on the web. Deletion takes effect on the server immediately and cannot be undone. Anonymous data from signed-out use is keyed to the device identifier (device_id) and is deleted automatically after at most 12 months. Security logs (IP and access records) are kept for at most 6 months for incident response.

4. Advertising and third parties

The Service shows ads through Google AdSense on the web and Google AdMob in the mobile app. Google may use cookies and advertising identifiers to serve ads relevant to your interests; Google's own privacy policy applies to that processing. You can turn off personalised ads in Google Ad Settings.

The Service calls public third-party APIs to assemble market data while you use it. No information that identifies you individually is sent in those calls.

5. Data sent externally for AI analysis

When you run an AI analysis, the data listed below is sent to Google Gemini (Google LLC) for processing. It is sent only if you have explicitly consented before running the feature, and you can withdraw that consent at any time under Profile > AI data transfer.

• Names and quantities of the securities you hold or watch.
• Position details such as average cost and invested amount.
• Public market data (prices, fundamentals) for the securities you look up.

This data is sent only when you run an AI analysis yourself. Account identifiers such as your name or email address are never sent.

6. International transfer of personal data

To operate the Service we entrust processing to the providers listed below, which means your personal data is stored and processed outside your country. Each provider may use the data only for the purpose it was entrusted with. If you would rather your data were not transferred, you can use the Service without signing in, or delete your account and all data at any time from Profile > Delete account and data.

• Supabase, Inc. (United States) — account authentication and database. Stored in: India (Mumbai). Data transferred: email address, Google account identifier, name and profile image, the investment data you enter, IP and access logs, device identifier. When and how: transmitted over the network as you use the Service. Retention: as set out in section 3.
• Vercel, Inc. (United States) — web and app hosting and content delivery. Processed in: South Korea (Seoul) and CDN edge locations worldwide. Data transferred: IP address, User-Agent, request path and other access logs.
• Functional Software, Inc. (Sentry) (United States) — error monitoring. Data transferred: technical context captured when an error occurs. It is configured not to send account identifiers such as your name or email address.
• Google LLC (United States) — push notification delivery (device push token), advertising (advertising identifiers and cookies — see section 4), and AI analysis (see section 5).

7. Your rights

You may exercise the following rights over your personal data at any time.

• Request access to, correction of, or deletion of your personal data.
• Request that processing be suspended.
• Delete your account and all data permanently and immediately via Profile > Delete account and data.

For anything beyond in-app deletion, contact us at the address below and we will act without undue delay.

8. Technical safeguards

• HTTPS encryption end to end.
• Per-user data isolation via Supabase Row Level Security.
• Automatic blocking of malicious bots and abnormal access (User-Agent filtering, IP blocking, rate limiting).
• Six security headers (CSP, HSTS, X-Frame-Options and others) applied by default.

9. Cookies

Besides the cookies required to keep you signed in, the Service may use Google AdSense advertising cookies and Google Analytics cookies. You can refuse cookies in your browser settings; some features may then be limited.

10. Contact

For privacy enquiries or to exercise your rights, write to kyd3534@gmail.com.

11. Changes to this policy

If this policy changes, we will post notice on this page at least 7 days before the change takes effect. Material changes (new categories of data, expanded purposes) will also be notified separately in advance.