Privacy Policy

1. What we collect

Account: your email address and a password, stored as a hash by our authentication provider. At signup we record the country your request came from. Our application does not store the network address; our hosting and sign-in providers keep their own short-lived request logs.

Portfolio: the holdings and transactions you enter, import or sync, the public wallet addresses you add, and the read-only exchange grant you authorize, which is stored encrypted.

Strategy: your targets, thresholds, limits and contribution plan, and every version you save.

Results: the health scores, alerts, summaries and review records computed from the two items above, kept so that each result can be traced to the inputs it came from.

Plan: your plan and subscription status. Card details go to our payment processor and never reach our systems.

Preferences: your notification settings, your onboarding answers and when you last opened the app.

Product events: a short list of steps such as confirming your email, finishing onboarding and opening the checkout page, each with its time.

Error records: when something fails on our side, the error text is recorded, and it can include your account identifier.

2. Cookies and browser storage

Session cookies keep you signed in. They are necessary for the app to work.

One attribution cookie, iso_first_touch, records how you arrived on your initial visit: campaign tags in the link, the host of the referring site and the page you landed on. It holds no identifier, it is readable only by our server, it lasts 90 days, and it is deleted when you confirm your email. It is not set for visitors in the European Economic Area, the United Kingdom or Switzerland.

While you connect an exchange account, a short-lived cookie carries that sign-in handshake. It is necessary for the connection and is removed when the handshake ends.

Your theme choice and a few layout choices are kept in your browser's storage and are not sent to us.

We use no third-party analytics script and no advertising cookie.

3. How we use it

To provide the service: computing your scores, alerts and summaries from your own holdings and targets.

To send the emails you have switched on, and the account emails needed to confirm your address or reset your password.

To find and fix faults, and to understand in aggregate how people reach and start using the app.

If you opt in, your holdings are included in anonymized, aggregated statistics. Nothing that identifies you is published, and you can opt out in Settings at any time.

4. Language-model summaries

When a summary is written with a language model, the provider of that model receives the figures the summary is written from: percentages, scores and counts from your portfolio, the alert sentences recorded for it, the names you gave your allocations and the symbols of the assets you hold. It receives no prices, no amounts in any currency, and neither your email address nor your account identifier.

You can turn these summaries off in Settings; summaries are then written from fixed wording and nothing is sent.

5. Service providers

We use a small number of providers to run Isocron, and each receives only what its task needs: Supabase (database and sign-in), Vercel (hosting), Inngest (scheduled jobs), Stripe (payments), Resend (email), Anthropic (language-model summaries), CoinStats (reading the public wallet addresses you add), Coinbase (when you connect a Coinbase account) CoinGecko (reference prices; it receives no user data) and Discord (fault alerts to our own team; it receives a shortened error text with identifiers removed).

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. How long we keep it

We keep your data for as long as your account exists. Recorded score history is trimmed on a schedule that depends on your plan.

When you delete your account, your data is removed as described in the next section.

7. Your choices and rights

See and export: your holdings and transactions download as CSV files, and your diagnostic report as a Markdown file, from the Portfolio page on plans that include them. You can also ask us for a copy by email.

Correct: you can edit your holdings, targets and settings in the app.

Delete: Settings has a Delete account control. It works at once and cannot be undone. It removes your account, holdings, connections, targets, scores, alerts, summaries, review records, email records and product events, cancels an active subscription, and removes your account identifier and email address from our error records.

What remains after deletion: invoices and payment records held by our payment processor as tax and accounting law requires, and the symbol and name of any unlisted asset you created, which sit in a shared asset list with no link to you.

Emails: every digest and alert email carries a link that stops it, and Settings has the same switches.

California residents have the right to know what personal information we collect, to have it corrected, to have it deleted, and not to be treated differently for using these rights. We do not sell or share personal information as those terms are defined in California law.

To use any of these rights by email, write to support@isocron.io from the address on your account. We answer within 45 days.

8. Where data is processed

Your data is processed in the United States and in the other countries where our service providers operate.

9. Children

Isocron is not for anyone under 18, and we do not knowingly collect their data.

10. Changes and contact

When this policy changes, the new version is posted here with its date.

Questions about privacy: support@isocron.io.