Privacy Policy

This policy explains what personal data Gapbell collects, why, and what your rights are.

1. Who is responsible

The controller of your personal data is:

• Operator: Mykyta Melnyk
• Address: Warszawa, Mokotów, Poland
• Contact: n09958659@gmail.com

2. What we collect

• Account data. Your email address and, if you sign in with Google, GitHub or Discord, your name and profile picture from that provider. If you sign up with a password, we store only a salted hash of it, never the password itself.
• Subscription data. Whether you have a Pro subscription, its status and renewal date, and your Stripe customer ID. Card details are entered on Stripe's page and never reach us.
• Alerts. The alerts you create (symbols, price levels, keywords), the notifications they produce (kept for 30 days), and, if you turn them on, your browser's push subscription and whether you want alerts by email.
• Technical data. Your IP address and request details in server logs and for rate limiting, to keep the Service secure and running.
• Data on your device. Watchlists, saved screens and display preferences are stored in your browser, not on our servers.

3. Why we use it, and on what basis

• To create your account and provide the Service, including your subscription (performance of a contract).
• To check your alerts and notify you when they fire, in the app and by browser push (performance of a contract).
• To email you your alerts, only if you turn that on and confirm your address (your consent, which you can withdraw at any time from the alerts page or the link in each email).
• To keep the Service secure and prevent abuse (our legitimate interest).
• To keep accounting and tax records for payments (a legal obligation).

We do not sell your data, and we do not use it for advertising or profiling.

4. Who we share it with

These providers process data on our behalf, only to deliver the Service:

• Vercel, which hosts the Service.
• Neon, which hosts our database.
• Stripe, which processes payments and handles billing.
• Google, GitHub and Discord, only if you choose to sign in with them.
• The push service of your browser (for example Google, Apple, Mozilla or Microsoft), only if you turn on browser notifications; it relays the alert text to your device.
• Resend, which sends our emails (sign-up confirmations and, only if you turn them on, alert emails).

Some of these providers are based outside the European Economic Area. Where personal data is transferred there, it is protected by the safeguards these providers offer, such as standard contractual clauses.

5. Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or analytics cookies.

6. How long we keep it

Account data is kept until you delete your account. Payment records are kept for as long as accounting and tax law requires. Server logs are kept for a short period.

7. Your rights

Under the GDPR you can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interest. Contact us using the details above. You also have the right to complain to your data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).

8. Changes

We will update this page if our practices change and show the date at the top.