Privacy Policy

Administrator announcements may contain a title, text, image and a destination in the app, a dedicated page or an external HTTPS site. They may be scheduled, and their technical history is retained to verify delivery or support a deliberate resend. They depend on the App announcements setting and system permission. Portfolio summaries, calendar reminders and Premium reminders each have their own setting. Images may be downloaded from Firebase Storage. A delivery status does not prove individual viewing.
Voluntary problem reports contain category, title, free-text description, app version, language and guest/signed-in status. You may attach one optional JPEG, PNG or WebP photo of up to 2 MB; it is kept in private Firebase Storage and can be viewed by authorized administrators. The app does not request general access to your gallery: only the selected photo is sent. Reports do not automatically attach your account ID or portfolio. Avoid passwords, account numbers and private financial information in both text and images; crop the image where needed. Text and the photo may contain personal data you add. An administrator notification may show the title, but not the photo.
Reports and any attached photos are no longer accessible through support after 48 hours and become eligible for erasure. They are removed in batches during hourly cleanup, or earlier by an administrator. Processing relies on our legitimate interest in support and reliability. Because reports are not linked to your account, deleting it cannot automatically locate them; contact us with the report reference or identifying details to exercise your rights.

Local data, security and providers

Preferences, caches, quizzes, analyses and widget data may remain in app storage. PDF or CSV exports and asset-page images are created on request and passed to the sharing system or saved locally; choose recipients carefully. Widgets and notifications may expose amounts on the home or lock screen. Account deletion does not erase files you exported elsewhere.
A stable technical identifier (Android ID or a random identifier in the iOS keychain) supports trials, quotas, recovery backups and deduplicated counting of devices that installed and opened the app, and may survive reinstallation. For this counter Android also reports whether Google Play installed the app; an unknown source is never treated as Google Play. The server retains only an irreversible fingerprint, platform, source, and first/last observation dates. This is not an advertising ID and does not track navigation. Snapshots, operation journals, preferences and consent records remain with the account until their or the account’s deletion. Payment records held by Google or Apple follow their own obligations.
Firebase Crashlytics and Google Cloud technical logs diagnose errors and abuse. Retention depends on the service and its configuration; information needed for an incident is used only to handle it. Accounting records actually held by the publisher are retained under applicable statutory duties, separately from routine app use. Contact us for applicable details and safeguards.
Apple, IPinfo, Google and logo, image or article hosts may process technical data outside the EEA. Direct logo and content services include All Invest View and jsDelivr. Requests concern selected images or sources, not intentional portfolio uploads. Transfer safeguards depend on the provider and applicable agreement, such as standard contractual clauses or an applicable adequacy decision; one provider’s certification does not automatically cover others.

Screenshot import

Portfolio or watchlist screenshot import: 2 successful generations per day per account across all plans; 20 for server-authorized administrator accounts. This quota is shared across portfolios and watchlists. Resets at midnight, Paris time. Basic and legacy discovery offers: 1 screenshot per generation; Premium subscription, code or new launch offer with AI: up to 5. An analysis detecting assets uses one generation, even without final import. Errors and empty results do not use a generation; abuse protection: 6 attempts per day, 60 for administrators. Changing portfolios, watchlists or plans does not reset the quota. Review companies and exchanges before confirmation; for portfolios, also review quantities, average costs and currencies. A watchlist imports only assets to track, without quantities or average costs. No trading order is placed.
Optional feature with explicit consent. Google ML Kit detects sensitive text locally. Review masks and cropping before upload; automatic detection can miss data. Only prepared images are sent through our server to Google Gemini to extract positions. Do not send account numbers or balances.
The app and our server do not retain screenshots after analysis or log images or extracted content. Temporary copies are removed after the flow; gallery originals remain intact. To resume after closing the app, extracted results are temporarily saved to your account: accessible for 24 hours, then removed by hourly cleanup, or immediately upon confirmation. Only confirmed positions are added to your portfolio.
The provider may temporarily retain data for security under its terms: https://ai.google.dev/gemini-api/terms. This feature does not promise zero provider retention. Provider processing terms also apply and are distinct from retention within our app.
Consent date and version, usage counters and technical import receipts are linked to your account and removed with account deletion. You can decline and enter positions manually. Contact us to withdraw consent or exercise your rights. No trading orders are placed.

Weekly wealth history

Tracking starts after synchronization once valuation is available, including on Basic and with the app closed. All holdings in retained portfolios are tracked, including locked holdings. Snapshots are scheduled every Saturday at 8 am (Paris) during the first three months of tracking on both Basic and Premium, then monthly. Changing plans does not restart this period. Month-end snapshots are retained. Basic includes numerical results for one two-month discovery period per account, then curves only without numerical results. Premium retains results, corrections and exports. Starting a new tracking period archives the selected snapshots without restarting discovery or collection cadence. Past history and missing points are not reconstructed.
Ending Premium does not delete snapshots or stop collection. Data remains private and follows account retention and deletion rules. Resetting a chart does not disable collection. No access to the phone, bank or broker account and no sending of these data to AI are required.

AI search, criteria and financial scores

On request, selected filters (sector, country, yield, dividend years, score range and sorting) and candidate stocks’ public financial data are sent to Google Gemini. This search does not send your portfolio, email or free text to the model. Google Search may verify public information.
Our servers use your account ID to check Premium, record acceptance version and date and enforce quotas. Counters, a device fingerprint and a technical criteria signature control generation, separately from model inputs and without ad targeting.
You may decline AI search and continue using other features. Stopping requests stops new transmissions; contact us to withdraw consent and request deletion. Withdrawal does not affect earlier lawful processing.
Gemini terms allow technical security processing. For Google Search grounding, Google states that prompts, context and outputs are retained for 30 days to provide the service. This is not zero-retention processing. See https://ai.google.dev/gemini-api/terms.
Acceptance records remain with the account. Search receipts carry a two-day validity expiry, not a guarantee of immediate deletion; deletion is handled through account management and rights requests. Scores and results do not place trades or make automated decisions with legal effects on you.

Notifications, news and calendar reminders

Firebase Cloud Messaging uses an installation notification token associated with your account, active-device state and preferences. It is not your telephone number.
A reminder stores account ID, symbol, event type, same-day or previous-day choice, enabled state and update time. Delivery records prevent duplicates; the server checks that the asset is still followed.
Reminder settings and delivery records remain until deleted. Disabling stops delivery without automatically erasing settings; request erasure through our contact. News preferences link followed assets to requested notifications.
Notifications may show an asset, headline, available image or event date on your lock screen. Hide Android or iOS previews if needed. External articles and images may disclose technical connection data to their hosts.
Processing provides configured alerts under the service contract, subject to system permission. Disable notifications in the app and Android or iOS without deleting your account.
To respect your choices and retain evidence of them, the app may store with your account the current status and changes of optional permissions or consent choices: system and in-app notifications, usage statistics, crash reports, product-news emails, Google UMP advertising choices, iOS tracking, and AI features that require agreement. Each record contains the purpose, decision (granted, denied, provisional or not yet determined), server date, technical choice version, source, platform, language and an irreversible device fingerprint. The raw device identifier and notification token are not included in this consent register.
These records are used only to apply and demonstrate your choices, calculate aggregate authorized-device counts and avoid asking for the same decision unnecessarily. They do not prove that a notification was displayed or read. Refusals made before the app version introducing this register cannot be reconstructed retroactively. The register remains linked to the account while it exists and is deleted with the account data; you may also exercise your rights through the contact provided.

Technical data and additional providers

Firebase Analytics may measure first opens, sessions, app versions, device categories, approximate country and viewed app sections only after you agree to usage statistics. No searched ticker, portfolio, financial amount, email address or account identifier is intentionally included in custom events. Native collection is disabled before your choice and after withdrawal; data already received remains subject to Google Analytics retention settings.
Firebase Crashlytics may receive error traces, app version, device and system characteristics and a technical installation identifier to diagnose crashes. This differs from aggregate audience counters. In versions offering a Crash reports choice, sending requires your separate consent, changeable in Settings > Privacy. Without consent or after withdrawal, new reports are stopped and pending on-device reports are deleted when the choice is applied. Withdrawal does not delete reports already received. Older versions still use the automatic reporting described here; contact us to exercise your rights.
IPinfo may receive your IP address to determine a country code for regional restrictions, separately from the configured country in audience totals. No GPS position is obtained. A regional flag may be associated with your account.
Purchase verification processes product references, a purchase token sent to Google Play, its fingerprint and subscription dates or status. We do not receive payment-card numbers.
Company logos and external YouTube, Google Play and source links use third-party services. Direct device requests may disclose IP addresses and technical data under their policies; portfolios are not intentionally sent to display a logo.
On Android installed from Google Play, the Google Play update component processes device metadata, the installed app version and installed modules or asset packs to determine whether an update is available and its size. The publisher receives only the availability state needed for the banner. Closing the banner stores the dismissed version locally until another version is offered or app data is cleared.
Google Fonts may supply interface fonts. When a font is not already available locally or cached, a request to Google may disclose the IP address and technical connection data; no portfolio data is sent.
Authorized administrators and necessary processors may access data for support, security and service delivery. Firebase rules separate user accounts without removing authorized administrative access.

Data we collect

When the Optional usage statistics consent mode is enabled, activity, stock-view and navigation measurements remain disabled until you agree. You may accept or refuse on first opening, then change this choice in Settings > Privacy. Refusing does not limit features. Withdrawal stops those new measurements without erasing data already received. Minimal unique-installation and online-presence counting remains separate: it uses only a pseudonymous technical fingerprint and a temporary marker under the legitimate interest of maintaining a reliable service, without tracking viewed pages or portfolio content. This choice is separate from advertising and crash diagnostics. The publisher can globally disable usage statistics and/or crash reports in compatible versions. When both are disabled, their optional prompt is hidden. This setting is fetched at launch, on resume and periodically while online; it does not erase previously received data.
Google or Apple sign-in: Firebase Authentication receives a provider identifier, your email address and your name when provided. Apple may supply a private relay address. Voluntarily linking Google and Apple keeps the same Firebase account and portfolios; it does not automatically merge two existing accounts.
From the fifth app opening, an account with a verified email address may accept or refuse optional emails about important updates and app news. The first four openings perform no server lookup for this choice. The answer, date, consent version, language and configured country are stored with the account; the address remains managed by Firebase Authentication and is not copied into that document. Refusal does not limit any feature, and the choice can be changed under Settings > Privacy.
We store data you create, including portfolios, watchlists, alerts, widget preferences, wealth tracking, cash flows and recent searches.
Guest mode also creates a technical Firebase account. Portfolio and watchlist recovery copies may be stored on Firebase, so guest mode is not exclusively local. Google or Apple sign-in enables synchronization between devices using the same account.
Viewed assets may be counted to produce an aggregated ranking of the 20 most viewed stocks over the last 48 hours. It does not publish your identity or portfolio content. Legacy daily counters are purged after seven days. Accepted view events are retained for a rolling 30-day comparison window and then cleaned up; only the aggregate ranking is published.
Anonymous daily counters may measure use of the five main sections, Premium features and total session duration. They contain no UID, email, installation ID, viewed symbol, search or portfolio data.
Aggregate audience totals may include a country code determined server-side from an IP address sent to IPinfo, with the device region as a fallback. This is not GPS location. Aggregate counters do not store the raw IP address, but IPinfo processes it to return the country.
The online-device count uses a cryptographic fingerprint derived from a stable technical device identifier and a temporary connection marker in Firebase Realtime Database (hosted in Belgium). While the app is visible in the foreground, the marker indicates Android, iOS or other, the app version and build number, and its server timestamp is refreshed every 30 seconds. It is removed when the app leaves the foreground or the server detects a disconnection; any marker not refreshed for more than 90 seconds is ignored. This is pseudonymous, not strictly anonymous; it contains no email, portfolio, viewed page or ticker.
To prevent AI quotas from being reset by signing out or changing accounts, a stable technical device identifier is converted into a cryptographic fingerprint before a daily counter is stored. The raw identifier is not retained on our servers, the fingerprint is not used for advertising or navigation tracking, and expired device counters are deleted after seven days.
Market, news, dividend, chart, classification and offline-pack data may be cached on your device or backend to display saved information quickly and reduce repeated provider calls.
Premium payments are handled by Google Play or Apple App Store, depending on the store used. Verification processes the product, Google purchase token or Apple transaction identifier, its fingerprint, subscription status and expiry dates. We do not receive payment-card numbers. Switching devices does not move subscription management to a different store.
We do not request GPS location or contacts. We do not freely browse your gallery or files: the app processes screenshots you voluntarily select and files you choose to import or export. Prepared screenshots are transmitted as described under Screenshot import.

Why we collect this data

To provide portfolios, watchlists, alerts, performance calculations, widgets, wealth history and synchronization across your devices.
To display relevant stock and portfolio news, improve data availability and avoid unnecessary repeated API calls.
To enforce Basic and Premium limits, verify purchases or Premium codes, prevent abuse, secure backend access and improve app reliability.
To send Wall Street Apps news and important-update emails only after explicit opt-in. This channel is not used to share contact details with advertising partners.

Legal basis for each processing activity

Performance of the contract (providing the service and subscription): account management, portfolios, watchlists, alerts, cross-device synchronization, the performance and wealth history you generate, and verification of Basic / Premium entitlements and Premium codes.
Your consent: personalized advertising through Google UMP and sending selected holdings or criteria to Google Gemini for an analysis or AI search. You can withdraw these consents at any time. Optional usage measurement and optional product-news emails also rely on consent.
Our legitimate interest: app security and abuse prevention (authentication and device fingerprints for AI quotas), strictly aggregated audience measurement, caching of shared financial data, and the aggregated ranking of the most viewed stocks.
Compliance with legal obligations: keeping payment-related records and responding to rights requests.

How data is stored and protected

Account data is stored using Google Firebase services with access controls. Sensitive local data uses platform-provided protected storage when applicable.
A recovery copy of the current portfolio and watchlist state is kept in private device storage and Firebase, including guest mode. It is scoped to the Firebase account and a device identifier pseudonymized on the server; this identifier alone never grants account access. Edits and deletions, including an emptied list, are reflected in the current copy after synchronization. The main copy does not retain a permanent history of every version; an older guest copy may nevertheless remain locally for manual recovery. The server copy follows account deletion; a change not yet synchronized may not be recoverable after reinstalling.
Firebase Authentication, access rules and server-side validation restrict access. App Check enforcement is not currently required by the backend; it is not presented as a guaranteed protection. No system can guarantee absolute security.
Language-specific news and content caches are separated so French translated content is not reused as English content.
The advanced-news feed is built from a shared pseudonymized registry of public stock symbols recently searched or present in portfolios and watchlists across the user base. It stores no user identity or portfolio association in that registry. Opening the feed reads the shared cache and does not launch a provider search for that user. For the same language, the server selection is common to Android and iOS devices; an offline local cache may temporarily lag until the next synchronization.

International transfers outside the European Economic Area

Some providers process data from the United States, in particular Google (Firebase, Firebase Authentication, Google Cloud, Google Cloud Translation, Google Gemini, Google AdMob, Google Play and Google Fonts), Twelve Data, OpenAI and MyMemory.
These transfers rely on GDPR safeguards: Google LLC is certified under the EU–US Data Privacy Framework and, failing that, the European Commission’s Standard Contractual Clauses apply.
Public sources are not intentionally sent your identity or portfolio but may process technical connection data. Locations and subprocessors depend on provider terms; a European source does not guarantee that all processing stays in the EEA.
Each provider also applies its own privacy policy to the technical request data it receives.

Data controller and intended audience

The controller of the personal data described below is Nicolas Stordeur, sole trader (French micro-enterprise) trading as "Wall Street Apps", 6 allée des Ormes, 10300 Sainte-Savine, France, publisher of the app "Wall Street: Stock Market & Shares" (legal notice: https://mon-app-finance-504c6.web.app/en/legal-notice/).
For any question about your data or to exercise your rights, contact contact@wallstreetapps.fr.
Contact the controller directly at the address above to exercise your rights. This information does not prejudge whether a Data Protection Officer may need to be appointed as processing evolves.
The app is intended for adults and is not directed to persons under 18. It does not knowingly collect data from a minor; if you believe a minor has provided us data, contact us for its deletion.

Third-party services

The app uses Google services including Firebase, Firebase Analytics, Google Sign-In, Google Play Billing, Google Play Core for Android app updates, Google Fonts, AdMob and consent tools.
Twelve Data provides market prices, security search, histories, fundamentals according to coverage, cryptocurrencies and a server-side WebSocket feed for a limited set of securities. It receives only the requested ticker and exchange, never your identity, email address or portfolio contents.
SEC EDGAR may provide US-company financial information and receives only a ticker or CIK. AMF / info-financiere.gouv.fr may provide French issuer documents and receives only an ISIN, company name or ticker. Neither service receives your identity, email address or portfolio.
GDELT, official public company feeds and Google News (as a fallback) provide financial news. Requests contain only relevant company names or symbols, never your identity.
Google Cloud Translation and DeepL may translate public news text into French. Google Cloud Translation may also translate a French-language headline selected for the shared English feed. They receive only public text, never your identity.
The European Central Bank, the Federal Reserve Bank of St. Louis (FRED) and Frankfurter.dev provide public interest-rate, commodity or foreign-exchange data; no personal data is intentionally sent.
OpenAI may translate public company profiles and structure public geographic-revenue disclosures. MyMemory may provide fallback translation of public news headlines. They receive neither your identity, email address nor portfolio contents.
Each provider processes technical request data under its own privacy terms. AdMob may display ads in ad-supported versions, including during discovery access periods with ads, but ads are removed for paid Premium subscribers.
Where required, Google UMP lets users consent, refuse consent or manage individual purposes. Refusing consent does not block access to the app and may result in non-personalized, limited or technical-only ads when permitted by the recorded choices and applicable law. Advertising choices can be changed later under Settings > Privacy whenever the privacy-options entry point is required.

Retention

Account data is retained while your account is active and as needed to provide synchronization, purchase verification, legal compliance and fraud prevention.
After Premium ends, additional portfolios and watchlists remain saved and locked until Premium is reactivated, without automatic deletion caused by a plan change. Assets above the Basic ten-asset limit in the main portfolio and main watchlist remain saved without an automatic deletion deadline, appear greyed and locked below accessible assets, and can be manually deleted or unlocked by reactivating Premium.
Cached market and news data may remain locally or on the backend to improve speed and reduce provider calls. You can clear app data by uninstalling or using available deletion controls.
The local preference recording that a proposed Google Play version was dismissed remains until another version is offered, app data is cleared or the app is uninstalled. Google applies its own fixed retention rules to technical update-service data.
Aggregated anonymous usage counters cannot reasonably be linked back to an individual user and are retained for no more than 31 days.
Strictly anonymous Firebase accounts may be purged after 30 days of inactivity only if they have no Premium record and no retained portfolios, watchlists or recovery copies. Google and Apple accounts and accounts containing those data are excluded from inactivity purging. User-requested deletion remains available.

Your rights

Subject to GDPR conditions, rights include access, correction, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent. We normally respond within one month, extendable by two months with an explanation for complex requests. Proportionate identity evidence may be requested if reasonable doubt exists.
Account data is needed for synchronization. AI and notifications are optional; refusing advertising consent does not block free features. Contact us for details of recipients and applicable transfer safeguards.
Depending on applicable law, you may request access, correction, export, restriction or deletion of personal data associated with your account.
You can request full account deletion or deletion of selected data through the links provided in the app.
For Google or Apple accounts, a deletion request blocks normal app use. The Firebase account and active data are removed after a 30-day grace period by the daily cleanup. Signing back into the same account during that period allows cancellation. Apple may require a new authorization after revocation. Cloud recovery copies follow account deletion. Files already exported to other apps remain under your or the recipient’s control.
Deleting the app account does not cancel a Google Play or Apple App Store subscription. Cancel separately in the original store to prevent renewal: https://play.google.com/store/account/subscriptions or https://apps.apple.com/account/subscriptions. Account deletion does not require prior subscription cancellation.
A strictly anonymous Firebase account can be deleted immediately from Settings together with its server and local data. The app then creates a new empty technical account if it continues to be used.
You may change notification, advertising consent and language settings at any time where available.
United States residents: depending on your state law, you may request to know, correct or delete personal data about you, and we will not treat you differently for exercising those rights. We do not sell your personal data. Serving personalized ads through Google may be considered "sharing" for cross-context behavioral advertising: you can opt out ("Do Not Sell or Share My Personal Information") from Settings > Privacy, without this blocking the app.

Additional information for your country

France, Belgium and Luxembourg: the GDPR applies as provided by law. You may lodge a complaint with the data-protection authority where you live, including the CNIL in France, the Data Protection Authority in Belgium or the CNPD in Luxembourg. Optional trackers and measurements are enabled only after the offered choice where consent is required.
Switzerland: where the Federal Act on Data Protection (FADP) applies, you may request the information provided by that law and seek correction or deletion under the applicable conditions. The providers and destination countries are described in this policy. A transfer to a country without recognized adequate protection relies on a recognized safeguard or a statutory exception.
Canada and Quebec: the contact below also receives requests addressed to the person in charge of protecting personal information. Consent for optional processing is requested in understandable terms. Where Quebec law applies, a project involving personal information being communicated outside Quebec is subject to the required assessment and contractual safeguards before implementation.
Monaco: where Monaco Law No. 1.565 on personal-data protection applies, you may exercise its rights with the controller and lodge a complaint with the Autorité de Protection des Données Personnelles (APDP). International transfers remain subject to the safeguards required by that law.
United States: state-law information and the right to opt out of advertising sale or sharing appear under “Your rights”. Technical availability of the app in a country does not by itself determine which law applies to a person.

Counting views and countries

Account activity and administrator statistics

Publisher announcements and problem reports