Privacy Policy

1 · Scope and operator

This policy applies to BORSA: Stock News & Alerts, its web experience, mobile applications, account services, notifications, and membership features. BORSA 321 operates the service. Questions or privacy requests can be sent to contact@borsa321.com.

2 · Information we collect

• Account and authentication information — name, email address, email-verification status, password hash or Google sign-in account reference, account identifiers, verification records, session dates, session IP address, and user agent. BORSA never stores your plain-text password or Google password.
• Membership and purchase information — Apple or Stripe customer, product and transaction identifiers; subscription state; purchase and expiration dates; trial or offer status; and price and currency. Apple and Stripe process payment methods; BORSA does not receive or store full payment-card details.
• Personalization information — watchlist names and ticker symbols, alert topics and thresholds, notification preferences, quiet hours, timezone, and delivery history.
• Device and notification information — app version, platform, locale, timezone, and an encrypted push-notification token only after you choose to enable alerts. The token is used only to deliver BORSA notifications to that installation.
• Aggregate service usage — identifier-free visible-tab presence by coarse public section and one-minute totals for public page views and funnel-stage events. This statistical measurement is enabled by default and can be turned off at any time in Privacy Choices. For a public page view, BORSA keeps a sanitized canonical path with its query removed and a separate fixed landing-source category such as direct or unknown, search, social, newsletter, campaign, or referral. The browser reduces any referrer or campaign input to that category before sending it; BORSA does not keep the raw referrer, UTM value, search term, full URL, browser identifier, location, account, or individual journey in this aggregate lane.
• Detailed service usage — enabled by default and disabled at any time in Privacy Choices, BORSA also collects a pseudonymous reader identifier, first and last visit times, entry and current page, session and page-view counts, visible-tab reading duration, story opens, feed context, navigation and product actions, ticker taps, referral domain, campaign attribution, platform, locale, and user agent. If you later create or use an account, BORSA can associate that pseudonymous journey with the account to measure signup, trial, subscription, retention, and product quality. BORSA uses interaction data to improve the service and personal ranking, not to change newsroom sentiment, impact, confidence, or verification scores, and does not use it for cross-company tracking or behavioral advertising.
• Sponsored-placement interactions — in the native app, BORSA records when a paid placement is shown, tapped, opened, dismissed, or reaches its destination, together with the placement identifier and version, event time, and signed-in account identifier. BORSA uses this information to deliver and cap placements, preserve dismissals, prevent duplicate counting, and measure placement performance. BORSA does not use IDFA or combine this information with third-party data to track you across other companies’ apps or websites.
• Support and communications — the content and metadata you choose to send when contacting BORSA, plus delivery events for essential account-verification and password-recovery email.

3 · How information is used

• Create and secure accounts, verify identity, prevent abuse, and recover access.
• Verify App Store and web purchases, synchronize membership access, restore eligible Apple purchases, and respond to subscription events.
• Save watchlists and alert preferences, deliver requested notifications, apply quiet hours, and prevent duplicate alerts.
• Measure service reliability, readership, page engagement, acquisition, signup and subscription funnels, and feature performance without selling personal information or serving behaviorally targeted ads.
• Deliver sponsored placements, remember dismissals, limit repeat impressions, and measure placement impressions and interactions for advertisers without cross-app tracking.
• Answer support, privacy, billing, correction, copyright, and security requests.

4 · Newsroom AI and public-source data

Automated analysis can be incomplete or wrong. BORSA uses deterministic publishing rules and source checks around model output, but the resulting news and sentiment remain informational rather than individualized financial advice.

For narrated market reports, BORSA may send the shared report label and script—containing public market information and no member account or personalization data—to ElevenLabs or another configured audio provider to create synthetic speech and a reusable branded audio ident. The app labels this audio as AI-generated.

5 · Service providers and disclosure

BORSA shares only the information needed to operate the service with providers acting on its behalf, including Cloudflare for edge delivery and security; Railway for application hosting and PostgreSQL infrastructure; Apple for StoreKit purchases and push delivery; Google for account sign-in when you choose it and for website measurement, including cookieless measurement pings when analytics storage is denied; Stripe for web checkout, subscription billing and its customer billing portal; BORSA’s B3 Mail service (or a configured fallback such as Resend) for essential account email; OpenRouter and routed model providers for public-news analysis; and ElevenLabs or another configured audio provider for shared report narration and branding audio. Cloudflare necessarily receives ordinary request metadata such as the requested URL, IP address, user agent, and any referrer supplied by the browser to deliver and protect the site. Identifier-free aggregate requests forward to Railway only the validated page, event, and fixed source categories described here; BORSA does not add visitor metadata or a raw referrer to that aggregate record. Those providers process information under their own agreements and applicable law.

BORSA may also disclose information when reasonably necessary to comply with law, protect users or the service, investigate fraud or security incidents, or complete a corporate transaction subject to appropriate safeguards. BORSA does not sell personal information.

6 · Cookies, local storage, and tracking

BORSA uses secure account cookies and local browser storage for functional choices such as color theme. Identifier-free first-party aggregate measurement is enabled by default without an analytics choice: a visible public page sends a coarse section presence signal counted only in the current two-minute window, and page-view or funnel-stage events are added to one-minute totals used only within a rolling 24-hour window. Public page totals keep only a sanitized canonical path with its query removed; source totals use a separate fixed landing-source category derived in the browser, never the raw referrer, UTM value, search term, or full URL. These bounded rotating totals use no browser identifier and include no location, account, or individual journey. You can object free of charge in Privacy Choices; BORSA then stores only a non-identifying preference cookie to stop these aggregate signals on that browser. Google Analytics measurement, including its analytics cookies, is enabled by default, as are BORSA’s pseudonymous reader cookie and detailed first-party product journeys; each can be disabled at any time in Privacy Choices. While analytics is disabled the Google tag runs with analytics storage denied and sends only cookieless measurement pings. Google signals and advertising features remain disabled, and BORSA does not send Google your BORSA email, password, payment details, or private market preferences. If you disable analytics, BORSA removes its reader identifier, stops future detailed journeys, and returns Google analytics storage to denied; clear BORSA site data to remove existing Google Analytics cookies and local preferences. Google Analytics is not embedded in the native iOS app. BORSA does not use IDFA or sell data for behavioral advertising.

7 · Retention and security

Account-linked data is kept while your account is active and as needed to provide the service. Authentication sessions normally expire after 30 days. Verification and abuse-prevention records are kept only as operationally necessary. Identifier-free visible-tab counters rotate out after about two minutes, and identifier-free page, source, and funnel totals rotate out within 24 hours. Because no account or browser identifier is attached, BORSA cannot retrieve one person’s contribution from those counters. After account deletion, BORSA deletes account-linked watchlists, preferences, notification devices, sessions, and membership records, except limited billing, fraud-prevention, security, tax, dispute, or legal records that must be retained. Deidentified or aggregated readership statistics may remain where separately described.

BORSA uses encryption in transit, restricted production access, hashed credentials and tokens, and provider receipt verification. No service can guarantee absolute security; report a suspected issue to contact@borsa321.com.

8 · Your choices and account deletion

• Change BORSA alert preferences in Account and change system notification permission in iOS Settings.
• Manage or cancel an Apple subscription through Apple’s subscription settings. Deleting a BORSA account does not automatically cancel billing managed by Apple.
• Manage or cancel a web subscription through the secure Stripe billing portal linked from BORSA Account. Deleting a BORSA account does not automatically cancel an external active billing agreement; manage billing before deletion.
• Initiate permanent account deletion from BORSA Account settings. Read the account-deletion guide before proceeding.
• Request access, correction, or deletion of information by contacting contact@borsa321.com. BORSA may need to verify your identity before completing a request.

9 · International use, children, and changes

BORSA and its providers may process information in the United States and other countries where they operate. The service is not directed to children under 13, and BORSA does not knowingly collect personal information from children under 13. Users must be old enough to form a binding agreement or use the service with a parent or guardian where required.

BORSA may update this policy as the product or law changes. The effective date and version above identify the current policy; material changes will be communicated through the app, website, or account email when appropriate.