Privacy Policy

We collect the following categories of information when you use Dappy:

Usage & App Data:

• Trading pairs you select and monitor
• Alert configurations (upper bound, lower bound, step size)
• Notification history associated with your account
• Device push token required to deliver notifications
• Time zone and locale settings

Technical & Analytics Data:

• Device type, operating system version, and app version
• IP address (used for security and fraud prevention only)
• Crash reports and error logs via anonymous crash reporting tools
• Aggregated usage statistics collected via Firebase Analytics (no personal identifiers)

What We Do Not Collect:

• Financial account credentials or brokerage data
• Precise location data beyond your IP-derived country
• Data from your device contacts, camera, or microphone
• Data used to build advertising profiles about you across other apps or websites

Advertising Data:

The free plan offers an optional rewarded video ad that grants one extra notification. Ads are supplied by Google AdMob. When an ad is requested, AdMob receives:

• A mobile advertising identifier (Android Advertising ID, or Apple's identifier for vendors on iOS)
• Device and app information such as device model, operating system version, and app version
• Coarse, IP-derived location (country level)
• Ad interaction events, such as whether an ad was watched to completion

We request non-personalised ads only. Ads are selected from the context and coarse location rather than from a profile of your interests or your activity in other apps. Watching an ad is entirely optional; declining it changes nothing about how the app works, and paid plans are never shown ads.

We use the information we collect for the following purposes:

We do not sell your data to third parties, and we do not build advertising profiles about you. Advertising is limited to the optional rewarded ad described above, which requests non-personalised ads only.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Firebase (Google LLC): Used for analytics, push notification delivery via FCM, authentication, and hosting. Data is processed under Google's Data Processing Terms.
• Google AdMob (Google LLC): Used only to serve the optional rewarded ad on the free plan, and to confirm to us that an ad was genuinely watched so the extra notification can be credited. AdMob receives an advertising identifier, device and app information, and coarse location. We request non-personalised ads only. Data is processed under Google's Data Processing Terms.
• Apple Push Notification service (APNs): Used to deliver notifications to iOS devices. Only your device token and the notification payload are transmitted.
• Subscription Processors: In-app purchases are handled entirely by Apple App Store and Google Play. We receive only anonymised purchase confirmation receipts.
• Legal Requirements: We may disclose data if required by applicable law, court order, or governmental authority.
• Business Transfers: In the event of a merger or acquisition, user data may be transferred with advance notice provided to users.

We retain your data for as long as your account is active or as needed to provide you with the service.

• Account data is retained for the lifetime of your account. Upon account deletion, personal data is permanently removed within 30 days.
• Alert and notification history is retained for up to 12 months on active accounts.
• Crash logs and error data are automatically deleted after 90 days.
• Aggregated analytics data (no personal identifiers) may be retained indefinitely for product improvement.
• Financial/subscription records may be retained for up to 7 years to comply with applicable accounting and tax laws.

We take reasonable and appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction.

• All data in transit is encrypted using TLS 1.2 or higher
• Passwords are stored using industry-standard bcrypt hashing — plaintext passwords are never stored
• Push notification device tokens are stored in encrypted form
• Access to production systems is restricted to authorised personnel only
• Firebase Security Rules enforce data access control at the database level

No method of electronic transmission or storage is 100% secure. While we use commercially acceptable means to protect your data, we cannot guarantee absolute security.

Dappy integrates with the following third-party services. Each has its own privacy policy which we encourage you to review:

Advertising consent in the EEA and UK: Where required, we ask for your consent before any ad is requested, using Google's User Messaging Platform. You can change or withdraw that choice at any time from Settings → Ad Privacy Settings inside the app. Until consent has been gathered, no ad is requested.

We use the Binance public market data API in read-only mode for price feeds. We do not share any user data with Binance, and we do not facilitate any trading activity. Dappy is not affiliated with or endorsed by Binance.

Dappy is not directed at children under the age of 13 years (or 16 years in the European Economic Area). We do not knowingly collect personal information from children, and we do not knowingly serve advertising to them.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@dappyapp.com. If we become aware that we have collected data from a child without verifiable parental consent, we will take steps to delete that information promptly.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data ("right to be forgotten")
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request that we restrict processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent, withdraw it at any time

If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

Push notifications are the core feature of Dappy. Here is exactly how they work with respect to your data:

• On install, you will be asked to grant push notification permission. You can deny or revoke this permission at any time in your device Settings.
• If permission is granted, your device generates a unique device token provided by Apple APNs or Google FCM. This token is stored on our servers associated with your account.
• When a price alert triggers, our server sends a notification payload containing only the pair name and price to the notification service for delivery to your device.
• The device token does not personally identify you and changes periodically. It is used solely for notification delivery.
• You can disable push notifications at any time in your device Settings or within the app via Settings → Notifications. This will not affect your active alert configurations.

Dappy may process and store data on servers located outside your country of residence, including in the United States (Firebase/Google infrastructure).

When we transfer data outside the EEA, we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries with an adequacy decision from the European Commission
• Google's data processing terms, which include appropriate international transfer mechanisms

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page with an updated "Last Updated" date
• Sending an in-app notification or email if the changes are significant

We will give you at least 14 days' notice before material changes take effect. Your continued use of Dappy after changes are posted constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: