Privacy Policy

What we collect

• Account data: email address, name, and (if you sign in via Google or Facebook) the profile information those providers share with us — handled through Supabase Auth.
• App data: your watchlist, alert settings, display preferences, and locale — stored so the app works the way you left it.
• Payment data: if you subscribe, PayPal processes your payment details directly — we never see or store your card/bank information. We store only your subscription status and PayPal subscription ID.
• Usage data: standard server logs (IP address, request timestamps, error logs) for security and reliability, plus aggregate page-view analytics via Vercel Analytics (page, referrer, country-level location, device type) — it does not use cookies, does not assign you a persistent identifier, and cannot track you across other sites.

How we use it

To operate your account, remember your preferences, process your subscription, respond to support requests, and keep the Service secure. We do not sell your personal data.

Who we share it with

We use third-party processors to run the Service: Supabase (authentication and database hosting), PayPal (payment processing), Render (API hosting), and Vercel (web app hosting). Each processes data under its own privacy terms; we share only what's needed for them to provide their service to us. [A formal Data Processing Agreement with each processor, where required for EU user data, will be confirmed once our legal entity is registered.]

Cookies

The Service uses essential session cookies (via Supabase Auth) to keep you signed in — these aren't tracking cookies and can't be disabled without breaking login. If checkout is loaded, PayPal's own SDK may set its own cookies during that flow, governed by PayPal's privacy policy. Our analytics (Vercel Analytics, see "What we collect" above) is cookieless by design, so it doesn't require a cookie-consent banner — if we ever add an analytics or advertising tool that does use cookies, this section will be updated and a consent mechanism added before it loads.

Data retention

We keep your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we're required to keep certain records longer for legal, tax, or fraud-prevention purposes — in which case we keep only what's required, for only as long as required. Server logs used for security and reliability are retained for 90 days and then automatically deleted.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can export or delete your account data yourself at any time from Settings → Privacy & Data. For anything that self-service flow doesn't cover, email support@macroscope.app and we'll handle the request manually.

International transfers

Your account and app data (Supabase) is hosted in the EU (Ireland). The web app (Vercel) and API (Render) are hosted in the United States, so requests to load the app and its data pass through US infrastructure. Where personal data leaves the EU/EEA as a result, we rely on Standard Contractual Clauses with those processors as the transfer mechanism.

Children's privacy

The Service is not directed at children under 18. We don't knowingly collect data from children below that age.

Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated date.