WatchSignal - Privacy Policy
Effective date: 10 May 2026 Last updated: 12 October 2026 (rev. 4)
1. Who we are
WatchSignal is a mobile application ("App") developed and operated by Hazem ElSisy ("we", "us", "our").
Data controller identity
Hazem ElSisy (sole proprietor) is the data controller / business responsible for the personal information processed under this Policy across all jurisdictions.
| Jurisdiction | Role | Contact |
|---|---|---|
| EU / EEA (GDPR) | Data controller (Art. 4(7)) | privacy@watchsignal.ai |
| United States (CCPA/CPRA) | Business | privacy@watchsignal.ai |
| Brazil (LGPD) | Controller (Art. 5, VI) | privacy@watchsignal.ai |
United Kingdom: WatchSignal is not available to UK residents and does not knowingly process personal data of individuals in the United Kingdom. See Section 8.2.
Australia: WatchSignal is not available to Australian residents and does not knowingly process personal data of individuals in Australia. See Section 8.6.
Canada (including Quebec): WatchSignal is not available to Canadian residents and does not knowingly process personal data of individuals in Canada. See Section 8.4.
Privacy contact: privacy@watchsignal.ai General support: support@watchsignal.ai
2. Our privacy-first approach
WatchSignal is designed to process as little personal data as possible. The core functionality of the App (AI signal generation, portfolio tracking, watchlist management, price alerts, and market data) operates entirely on your device. Your portfolio data and trading activity are never transmitted to our servers or any third party. Your signal history stays on your device, with one exception: the short Morning Read summary described in Section 3.10.
The on-device AI model (ONNX Runtime) runs locally on your device. The market data you analyse and the model's inputs are not sent to any server. The model's outputs stay on your device, with two exceptions: the counts and the one item in the Morning Read summary described in Section 3.10, and, if you allow analytics, the signal direction and signal-strength band recorded in the analytics events described in Section 3.7. The model files are downloaded from Hugging Face; see Section 5.
From v1, WatchSignal requires Sign in with Apple to use the app. This allows us to sync your watchlist, preferences, and alerts across devices and to provide an in-app data export and deletion mechanism. See Section 3.1 for full details of what is collected at sign-in.
3. Information we collect
3.1 Account creation (Sign in with Apple)
Sign in with Apple is required to use WatchSignal. The app cannot be used anonymously at v1. When you tap "Continue with Apple", Apple's authentication service exchanges a cryptographic token with our server. We collect and store the following:
| Data element | Source | Purpose | Linked to you? |
|---|---|---|---|
Apple stable user identifier (sub) |
Apple ID token | Primary account key | Yes |
Our internal user_id (UUID) |
Generated by our server | Session management, sync | Yes |
| Apple-relayed email address | Apple (optional — you may hide it) | Account recovery, DSAR delivery | Yes, if provided |
| Device ID | Your device | Multi-device sign-out | Yes |
| Sign-in timestamp | Server clock | Security audit log | Yes |
What we do NOT collect from Apple: real email address, real name, phone number, date of birth, address, payment details (Apple handles billing directly), or any social profile data. Apple offers us name fields on first sign-in; we explicitly drop them — your real name never reaches our servers.
3.2 Display name (optional)
During onboarding, you may type a display name to personalise the app. This is entirely optional and skippable.
- We store only what you type. If you skip or leave it blank, no name is stored.
- Used only for greetings and personalisation within the app. Never shared, never used for marketing.
- Synced to our servers alongside your other preferences.
- You can edit or clear it any time in Settings → Profile.
3.3 Age verification
We require all users to be 18 or older (19+ in Korea per regional App Store rating).
- During onboarding, tapping "Continue with Apple" is accompanied by copy confirming you meet the minimum age. Tapping the button is your attestation.
- We record the timestamp of attestation; we do not collect or retain a birth year or birth date. The AgeGate (birth-year input) was removed in v1 — age attestation is bundled into the SIWA CTA.
3.4 What we sync
When you are signed in, the following data is uploaded to Cloudflare D1 (our server-side database):
- Watchlist tickers and group memberships
- Alert configurations (price thresholds, notification preferences)
- UI preferences and notification settings
- Signal favourites and onboarding state
- Optional display name (Section 3.2)
This data is stored encrypted at rest in Cloudflare D1 (region: EU, WEUR). It is never sold and never shared with third parties for marketing.
3.5 Automatically generated referral identifiers
The App's referral attribution system uses two randomly generated identifiers (UUIDs):
- Install ID — a random UUID tied to your installation, used solely for referral attribution
- Referral User ID — a random UUID used to associate your referral code in our referral system
These identifiers do not contain your Apple ID, name or email. If you are signed in, your referral code and stats are also linked to your account's user ID so rewards can be credited and the records can be erased on request.
When someone opens a referral link, we keep a click record for 7 days to attribute the install: a randomly generated click ID, the referral code and the referrer's Referral User ID, the IP address and user agent, and a timestamp. This record is deleted automatically after 7 days.
3.6 Information sent to third-party services
When you use the App, the following data is sent to external services to retrieve market data and content:
| Data sent | Recipient | Purpose |
|---|---|---|
| Ticker symbol (e.g., "AAPL") | Yahoo Finance (query1.finance.yahoo.com, query2.finance.yahoo.com) |
Fetching price data, candle history, options data, news |
| Ticker symbol + subreddit name | Reddit (www.reddit.com) |
Fetching social sentiment posts |
Important: Ticker symbols are market identifiers, not personal data. They do not identify you as an individual. We do not transmit your portfolio composition, position sizes, cost basis, or any financial account information to these services.
3.7 Analytics data
We use PostHog (PostHog, Inc.) to collect usage analytics that help us understand how the App is used and improve its features. Analytics stay off until you allow them during onboarding. PostHog is configured as follows:
- Hosted on PostHog EU Cloud (data centres in Germany, within the EEA) — no data is transferred outside the EEA for analytics purposes
- IP anonymisation is enabled — your IP address is truncated before storage
- Session recording is disabled — we do not record your screen or keystrokes
- If you allow analytics, events are linked to your WatchSignal account ID (a random identifier we generate at sign-in; it is not your Apple ID, name or email). This lets us count users accurately and erase your analytics data when you ask. Events do not include the contents of your portfolio or watchlist, your name or your email address
- Ticker symbols, portfolio holdings, and financial data are never included in analytics events
The analytics data we collect includes: screen views, feature interactions (e.g., "chart opened", "alert created", "signal generated", which records the signal direction, Bullish, Neutral or Bearish, and its signal-strength band, and "morning read built", which records whether the read was daily or weekly, what started it, how long it took, how many stocks it covered and how many reads changed), app version, device type, and operating system.
You choose whether to allow analytics during onboarding and can change your choice at any time in Settings → Privacy & Data. When you opt out, all future analytics collection stops immediately and the locally stored analytics identifier (PostHog distinct ID) is deleted from your device. If you later opt back in, a new identifier is generated and linked to your account ID again.
3.8 Crash reporting and performance monitoring
We use Sentry (Functional Software, Inc. d/b/a Sentry) to capture crash reports and performance traces that help us identify and fix app issues. Sentry is initialised on every app launch.
Sentry receives:
- Device type and model
- Operating system version
- App version
- Crash stack traces and error messages
- Performance spans and transaction timings
- Breadcrumb events (URLs are stripped before transmission)
- A persistent anonymous UUID stored on-device (
@sentry:anon_user_id) — randomly generated at first launch, not linked to your identity
Sentry does NOT receive: Portfolio data, ticker symbols, watchlist entries, user-entered text, or your IP address (IP anonymisation is enabled in our Sentry configuration).
- Data location: EU (Frankfurt region) for EEA users — confirmed via Sentry project data residency settings
- Privacy Policy: https://sentry.io/privacy/
- DPA: https://sentry.io/legal/dpa/ — a Data Processing Agreement is in place with Sentry
3.9 Subscription management
We use RevenueCat (RevenueCat, Inc.) to manage in-app subscriptions and trial periods. RevenueCat receives:
- Your WatchSignal
user_id(the authenticated identifier from Section 3.1) — used as the RevenueCat App User ID - Subscription status and purchase history
- App Store receipt data
This data is necessary to verify and manage your subscription entitlements across devices.
- Data location: United States (AWS). Transfers are covered by the EU Standard Contractual Clauses described in Section 6
- Privacy Policy: https://www.revenuecat.com/privacy
- DPA: A Data Processing Agreement is in place with RevenueCat, executed via the RevenueCat dashboard → Settings → Privacy
3.10 Push notifications and server-side alerts
If you enable push notifications (price alerts, signal change alerts, earnings reminders, daily briefings or the Morning Read, breaking news), the App registers a device token with Apple Push Notification Service.
To deliver server-side alerts, your push device token, device ID, and your alert configurations (ticker symbols, price thresholds, and notification preferences) are transmitted to our Cloudflare Workers backend and stored in Cloudflare KV (key-value storage). The device token expires 90 days after it was last refreshed. The alert configuration record is kept while the device stays registered to your account. It is deleted when you delete your data or your account from that device, an hourly clean-up deletes it after you sign out on that device, and in any other case it is deleted after 180 days without contact from the device.
This data is used solely to deliver the push notifications you have configured. It is linked to your authenticated account.
Morning Read. The Morning Read is available in App version 2.0 and later. The App builds it on your device. Each time it builds one, the App sends our Cloudflare Workers backend a short summary. We store this summary against your account ID and use it to put the real counts in your Morning Read notification. It holds the market date of the read, whether it is a daily or a weekly read, how many stocks it covers, how many reads changed, and the times it was built and received. The stored summary holds no stock symbols, prices or signal values. We keep it for 4 days after the App last uploaded it. If you chose to be told only when a read changes, the App still sends the summary, but we send no Morning Read notification from it.
The upload can also name one stock whose read changed, with the direction and strength of that read. Our server checks that this item is well formed and then discards it. It is not written to storage or logs and it is not used in any notification.
To send the Morning Read at the right time, we keep three settings with your device's notification preferences: how often you want it (every morning, weekly, or only when a read changes), your delivery time and your time zone. You choose how often when you set up the App. At present the delivery time is 7:30 am in your time zone. If you used the daily briefing in an earlier version of the App, the App carries that setting over: on becomes every morning, off becomes only when a read changes.
On every US market day (and on Mondays if you chose weekly), about 30 minutes before your delivery time, we send your device a silent background notification through the Apple Push Notification service so that the App can build the read. It shows nothing on screen. It contains a message type, the market date and a marker that it came from our server. We send it whichever option you chose. If you chose every morning, we then send one visible notification at your delivery time on each US market day; if you chose weekly, on Mondays. It also goes through Apple. Its text can include how many reads changed and how many stocks the read covers. It also carries the market date, a send time and the labels that open the Morning Read in the App. It contains no stock symbols, prices or account ID.
For each device we also keep a record that the silent notification was sent for a given day (kept for 3 days) and that the Morning Read notification was sent for a given read (kept for 7 days). We use these records only to avoid sending either one twice.
You can revoke push notification access at any time in your device's Settings. When you disable notifications, your device token is no longer refreshed and will expire from our systems within 90 days.
We keep a delivery log for 30 days. It has an entry for each notification we send or try to send, including silent ones, and for each time your device registers its push token or syncs its alert settings. An entry holds the event, the time, the platform, the notification type, the first 8 characters of your device ID, the stock symbol when the notification is about one stock, the error reason when a send fails, and counts such as the retry attempt or the number of alerts synced. If a send fails, we keep a retry record holding your device ID and the notification content for up to 1 hour so that we can try again. To limit how many notifications a device receives, we also keep rate-limit counters against your device ID or account ID for up to 24 hours, records against your device ID that a given notification was already sent for up to 90 days, and notifications held back during your quiet hours for up to 24 hours.
3.11 Information we do NOT collect
We explicitly do not collect:
- Your real email address (Apple relay only, and only if Apple provides it)
- Your real name (Apple name fields are explicitly dropped at sign-in)
- Your phone number, location/GPS data, contacts or address book
- Your camera, microphone, or photos
- Your browsing history outside the App
- Your financial account credentials
- Any biometric data
- Your birth year or date of birth (age attestation is a timestamp only, no DOB stored)
- Your IP address, except in referral click records (Section 3.5), which are deleted after 7 days. Apart from the delivery log described in Section 3.10 and the auth audit log described in Section 7, we do not log other API requests on our own servers.
4. How we use your information
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
Apple sub, user_id, relay email, device ID |
Account management, cross-device sync, session security | Consent (Art. 6(1)(a)) — you consent when you tap "Continue with Apple" |
| Display name (optional) | Personalisation within the app | Consent (Art. 6(1)(a)) — you provide this voluntarily during onboarding |
| Age attestation timestamp | Compliance with 18+ requirement, COPPA and GDPR children's data rules | Consent (Art. 6(1)(a)) + Legal obligation (Art. 6(1)(c)) |
| Watchlist, alerts, preferences (synced to D1) | Cross-device sync, data portability | Consent (Art. 6(1)(a)) — bundled with sign-in consent |
| Referral identifiers, referral click records (IP, user agent), anti-fraud markers | Referral programme: to credit you for referrals and attribute installs | Legitimate interests (Art. 6(1)(f)) |
| Ticker symbols sent to Yahoo Finance | Displaying real-time price data, charts, and news in-app | Performance of contract / App functionality (Art. 6(1)(b)) |
| Ticker symbols sent to Reddit | Displaying social sentiment content in-app | Performance of contract / App functionality (Art. 6(1)(b)) |
| Usage analytics (screen views, feature interactions, device/OS info, linked to your account ID) | Understanding how users interact with the App; improving features and fixing performance issues | Consent (Art. 6(1)(a)); you choose "Allow analytics" during onboarding and can withdraw in Settings → Privacy & Data |
| Sentry anonymous UUID, device type, OS version, app version, crash traces | Identifying and fixing crashes and performance issues | Legitimate interests (Art. 6(1)(f)) |
user_id, subscription status, purchase history (via RevenueCat) |
Verifying and managing in-app subscription entitlements | Performance of contract (Art. 6(1)(b)) |
| Push device token, device ID, alert configurations and notification settings, Morning Read summary and delivery records (Section 3.10) | Delivering the notifications you turned on, including the Morning Read | Performance of contract / App functionality (Art. 6(1)(b)) |
Users in Brazil (LGPD, Law No. 13.709/2018): the same bases apply under LGPD Art. 7: consent is Art. 7, I; legal obligation is Art. 7, II; performance of contract is Art. 7, V; legitimate interests is Art. 7, IX.
We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects on you.
5. Data sharing and disclosure
We do not sell your personal data. We do not share your personal data with advertisers or data brokers.
We may disclose information only in the following limited circumstances:
- Service providers: Our auth service and sync data are hosted on Cloudflare Workers and Cloudflare D1 (Cloudflare, Inc., USA). Cloudflare acts as a data processor on our behalf and processes only the data described in Section 3. Cloudflare's Customer Data Processing Addendum applies to our use of its services.
- Third-party market data: Yahoo Finance and Reddit receive ticker symbol queries from your device directly (client-side API calls). These services operate under their own privacy policies.
- AI model files: The App downloads its on-device AI model files from Hugging Face (Hugging Face, Inc., USA) and its content delivery network at first launch and when a model is updated. Like any web download, the request carries your device's IP address and the app's user agent. We send no account identifier with it, and Hugging Face handles the request under its own privacy policy. The model then runs entirely on your device.
- Analytics processor: PostHog, Inc. (EU Cloud, hosted in Germany, within the EEA) processes usage analytics, linked to your account ID, on our behalf. A Data Processing Agreement is in place.
- Crash reporting processor: Sentry (Functional Software, Inc. d/b/a Sentry, USA) processes crash reports and performance data on our behalf. A Data Processing Agreement is in place.
- Subscription management processor: RevenueCat, Inc. (USA) processes subscription and purchase data on our behalf. A Data Processing Agreement is in place.
- Push notification delivery: Apple Inc. (USA) delivers our notifications through the Apple Push Notification service. For each notification we send, Apple receives your device token and the notification content (a title and body, or a silent wake with nothing to show). Apple acts as an independent controller under its own privacy policy. We send Apple no account identifier.
- Legal requirements: We may disclose information if required by applicable law, court order, or government request, or to protect the rights, property, or safety of us, our users, or the public.
6. International data transfers
Your sync data (watchlist, alerts, preferences) is stored in Cloudflare D1 with the storage region set to WEUR (Western Europe). For other service providers located in the United States:
- Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with our US-based service providers (Sentry, RevenueCat, Cloudflare), supplemented by additional technical and organisational measures (TOMs) appropriate to each transfer. PostHog is hosted on PostHog EU Cloud in Germany; analytics data is not transferred outside the EEA.
- Data minimisation: We minimise the personal data shared with service providers. Analytics data is linked only to your account ID and does not include your name, email, ticker symbols or portfolio values. Crash reports contain only technical stack trace data and an anonymous device UUID.
Our current sub-processors, their server locations, and applicable transfer mechanisms are listed in our Sub-Processor List, available at watchsignal.ai/sub-processors/.
7. Data retention
On-device data (portfolio, watchlist, alerts, signal history, settings): Retained on your device until you delete the App or clear its data.
Authenticated account data (Section 3.1 — user record, sync tables):
- Active accounts: retained indefinitely while you keep using the app.
- Deleted accounts: 30-day soft-delete grace period. During this period your data is preserved but inaccessible, and you can recover your account by emailing me@hazemelsisy.com. After 30 days, a hard-wipe permanently deletes all server-side data.
Signal generation audit log: Retained on-device for a minimum of 5 years per MiFID II Article 25 / EU AI Act Article 12 logging guidance. Cannot be deleted by users.
Analytics data (PostHog): Events retained for 1 year by default on PostHog EU Cloud. You may request deletion at any time.
Referral data:
- Referral code, referral stats, and the link to your account: kept for up to 1 year after they were last updated, and removed sooner when you use Delete My Data or send us an emailed request.
- Install attribution records: pseudonymous, not linked to an account on our servers, deletable from your device through Delete My Data, and expire after 1 year.
- Click records (Section 3.5): kept for 7 days, then deleted automatically.
- Anti-fraud markers (a one-way hash of the account ID plus timestamps, used to stop the same account being rewarded as referred more than once and to cap referrer rewards): kept until the account itself is deleted, then removed (the reward cap record expires sooner, 1 year after the last reward). This is based on our legitimate interest in fraud prevention (GDPR Art. 6(1)(f), Recital 47). If you ask us to erase only these markers while your account exists, we decline, because preventing referral fraud is an overriding legitimate ground (Art. 17(1)(c), Art. 21(1)).
Morning Read data (Section 3.10):
- Summary: kept for 4 days after the App last uploaded it, then deleted automatically. Delete My Data deletes it. If you delete your account, it expires within 4 days and is also covered by the hard-wipe.
- Per-device records that a silent notification or a Morning Read notification was sent: kept for 3 days and 7 days, then deleted automatically.
- How often you want the Morning Read, your delivery time and your time zone: kept with your device's notification preferences (Section 3.10) and deleted with them. How often you want it is also part of your synced preferences, which are kept until you delete your data or your account.
Auth audit log: Retained for 90 days, including for deleted accounts.
8. Your rights
8.1 EEA users (EU GDPR)
If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation (EU) 2016/679:
- Right of access (Art. 15): use Settings → Privacy & Data → Export My Data in the App. Returns JSON, within seconds, of your account record, your synced data and your stored Morning Read summary from our servers, and the personal data the App keeps on your device. It does not include the delivery log, the retry, rate-limit and sent records described in Section 3.10, your push device token and its device settings record, or the past Morning Reads kept only on your device, which you can read in the App.
- Right to rectification (Art. 16) — contact privacy@watchsignal.ai to request correction of inaccurate data. Display name can be edited directly in Settings → Profile.
- Right to erasure (Art. 17): use Settings → Account → Delete Account in the App. 30-day soft-delete grace period applies; hard-wipe occurs automatically after. Using Delete My Data in Settings → Privacy & Data also removes your referral code, referral stats and the link to your account, clears the install attribution record on your device, and, if you are signed in, asks PostHog and RevenueCat to erase the data they have for your account. If you send us an emailed erasure request instead, please send it from your account's email address and, where available, include your referral code, so we can find the referral records.
- Right to restriction (Art. 18) — contact privacy@watchsignal.ai.
- Right to data portability (Art. 20): use Settings → Privacy & Data → Export My Data. Returns structured JSON.
- Right to object (Art. 21): to processing based on legitimate interests (crash reporting, referral).
- Right to withdraw consent — where processing is based on consent (sign-in, sync, analytics), you may withdraw at any time. Sign-out or account deletion withdraws sync consent.
- Right to lodge a complaint — with your national supervisory authority (see Section 8.7 below).
To exercise any of these rights, contact us at privacy@watchsignal.ai. We will acknowledge within 3 business days and respond in full within 30 days.
8.2 United Kingdom — App not available to UK residents
WatchSignal is not available to residents of the United Kingdom and does not solicit UK customers. The App has been withdrawn from the UK App Store, and the marketing website is not directed at UK consumers. We do not knowingly collect, process, or transfer personal data of individuals in the United Kingdom.
If you are a UK resident and believe we hold personal data about you in error, contact privacy@watchsignal.ai and we will investigate and, where appropriate, delete that data. UK residents retain the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8.3 California users (CCPA / CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (Cal. Civ. Code 1798.100 et seq.) as amended by the California Privacy Rights Act:
- Right to know — what personal information we collect, use, disclose, or sell
- Right to delete — use Settings → Account → Delete Account or contact privacy@watchsignal.ai
- Right to correct — inaccurate personal information
- Right to opt out of the sale or sharing of your personal information
- Right to limit the use of sensitive personal information
- Right to non-discrimination — for exercising your privacy rights
We do not sell or share your personal information within the meaning of the CCPA/CPRA.
Categories of personal information collected (CCPA 1798.100(b)):
| CCPA Category | Examples | Collected? | Source | Purpose | Disclosed to |
|---|---|---|---|---|---|
| A. Identifiers | Apple sub, user_id, relay email, device ID |
Yes | Apple / app-generated | Account management, sync | Cloudflare (processor) |
| B. Personal information (Cal. Civ. Code 1798.80(e)) | Display name (optional) | Only if provided | User-entered | Personalisation | Cloudflare (processor) |
| D. Commercial information | Purchase receipts, subscription status | Yes | App Store | Subscription management | RevenueCat (processor) |
| F. Internet or network activity | Screen views, feature interactions (linked to account ID) | Yes (opt-in) | App usage | Analytics | PostHog (processor) |
| G. Geolocation data | None | No | — | — | — |
| K. Inferences | AI signal outputs about stocks, not about you; kept on your device except the Morning Read summary counts in Section 3.10 | On-device, plus the summary counts | AI model | Signal generation, Morning Read delivery | Cloudflare (processor): the summary counts, which are stored, and one item that is received and discarded |
Authorised agents: You may designate an authorised agent to submit requests on your behalf.
Global Privacy Control (GPC): WatchSignal honours the Global Privacy Control signal on watchsignal.ai.
To submit a CCPA request, contact us at privacy@watchsignal.ai. We respond within 45 days (extendable by 45 days with notice). We will verify your identity using your authenticated account.
8.4 Canada — App not available to Canadian residents
WatchSignal is not available to residents of Canada and does not solicit Canadian customers. The App has been withdrawn from the Canadian App Store. We do not knowingly collect, process, or transfer personal data of individuals in Canada (including Quebec).
If you are a Canadian resident and believe we hold personal data about you in error, contact privacy@watchsignal.ai. Canadian residents retain the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or with the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca for Quebec residents.
8.5 Brazil (LGPD)
If you are in Brazil, the Lei Geral de Proteção de Dados (Law No. 13.709/2018) gives you the rights in Art. 18: confirmation that we process your data and access to it (items I and II; use Settings → Privacy & Data → Export My Data), correction (III; contact us, or edit your display name in Settings → Profile), anonymisation, blocking or deletion of unnecessary or excessive data (IV), portability (V; Export My Data), deletion of data processed on the basis of consent (VI; Settings → Account → Delete Account), information about the entities we share data with (VII; see Section 5 and our sub-processors page), information about your option to refuse consent and its consequences (VIII; sign-in is required to use the App), and withdrawal of consent (IX; sign-out, account deletion, or the analytics toggle in Settings → Privacy & Data). You may also petition the Autoridade Nacional de Proteção de Dados (ANPD) about your data (Art. 18 §1). We answer confirmation and access requests within 15 days (Art. 19, II) and all other requests within 30 days, free of charge (Art. 18 §5). As a small-scale processing agent under ANPD Resolution CD/ANPD No. 2/2022 we have not appointed a data protection officer (encarregado); privacy@watchsignal.ai is our contact channel under that resolution. International transfers described in Section 6 are made under LGPD Art. 33.
8.6 Australia — App not available to Australian residents
WatchSignal is not available to residents of Australia and does not solicit Australian customers. The App has been withdrawn from the Australian App Store. We do not knowingly collect, process, or transfer personal data of individuals in Australia.
If you are an Australian resident and believe we hold personal data about you in error, contact privacy@watchsignal.ai. Australian residents retain the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
8.7 Supervisory authority contacts
| Jurisdiction | Authority | Website | Phone |
|---|---|---|---|
| France | CNIL | cnil.fr | +33 1 53 73 22 22 |
| Germany | BfDI | bfdi.bund.de | +49 228 997799-0 |
| Ireland | Data Protection Commission | dataprotection.ie | +353 57 868 4800 |
| Netherlands | Autoriteit Persoonsgegevens | autoriteitpersoonsgegevens.nl | +31 70 888 85 00 |
| Spain | AEPD | aepd.es | +34 901 100 099 |
| Italy | Garante | garanteprivacy.it | +39 06 69677 1 |
| Belgium | APD/GBA | autoriteprotectiondonnees.be | +32 2 274 48 00 |
| Brazil | ANPD | gov.br/anpd | - |
| United States (California) | California Attorney General | oag.ca.gov | — |
8.8 All users — DSAR flow
Because every WatchSignal user is authenticated (there is no anonymous mode), the data subject access request (DSAR) process is simple:
- Export your data: Settings → Privacy & Data → Export My Data. Returns a JSON file of the data described in Section 8.1 instantly (rate-limited to 1 export per 24 hours).
- Delete your account: Settings → Account → Delete Account — starts the 30-day soft-delete. After 30 days, all server-side data is hard-wiped automatically.
- Contact us: For requests that cannot be self-served (rectification, restriction, portability to a third-party system), contact privacy@watchsignal.ai with subject "DSAR — [right you are exercising]". We will verify your identity using your authenticated account.
9. Children's privacy
WatchSignal is not directed at, intended for, or available to any user under the age of 18. Our Terms of Service require users to be at least 18 years of age. We do not knowingly collect, process, or retain personal data of any user under the age of 18.
Age attestation: The app displays age-requirement language alongside the "Continue with Apple" button. Tapping the button is the user's attestation that they meet the minimum age requirement. We record the timestamp of this attestation only — no birth year or date of birth is captured or stored.
If you believe a person under 18 has provided us with personal data, please contact us at privacy@watchsignal.ai and we will promptly investigate and, where appropriate, delete that data and the associated account.
10. Security
We implement appropriate technical and organisational measures to protect personal data:
- Session JWTs (HS256, 15-minute TTL) and one-time-use refresh tokens (30-day sliding window) are stored in the iOS Keychain with
AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLYaccessibility — they cannot be synced via iCloud or extracted without device passcode. - Server-side data is stored in Cloudflare D1 (EU region), which is encrypted at rest.
- All API traffic is encrypted in transit via HTTPS/TLS.
No method of transmission or storage is 100% secure. If you become aware of any security issue, please contact us immediately at support@watchsignal.ai.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where required by law, by providing more prominent notice (such as an in-app notification).
Your continued use of the App after changes become effective constitutes your acceptance of the updated Policy.
12. Contact us
For any privacy-related questions, requests, or complaints:
Hazem ElSisy Privacy: privacy@watchsignal.ai Support: support@watchsignal.ai
13. Change log
| Version | Date | Changes |
|---|---|---|
| rev. 1 | 10 May 2026 | Initial Privacy Policy. |
| rev. 2 | 28 September 2026 | Added referral click-record detail and retention (7 days), a referral data retention breakdown including the anti-fraud reward-cap record, and referral erasure detail for Delete My Data (including PostHog/RevenueCat) and emailed requests. |
| rev. 3 | 28 September 2026 | Added Brazil (LGPD): controller row, LGPD legal bases, Section 8.5 rights, and the ANPD contact. Reworded the analytics example to describe the signal direction. Corrected the in-app path for Export My Data, Delete My Data, and the analytics toggle to Settings → Privacy & Data. Corrected the analytics description: events are linked to the account ID (pseudonymous, not anonymous) and collected on the basis of consent. Named Hugging Face as the source of model file downloads. Removed PostHog from the US transfer list in Section 6. Added Cloudflare's Data Processing Addendum and stated that RevenueCat transfers rely on the Standard Contractual Clauses. |
| rev. 4 | 12 October 2026 | Added the Morning Read to Section 3.10: the summary the App uploads, the one item that is sent and discarded, the delivery settings, the silent background notification, the visible notification and the per-device sent records. Added Morning Read retention to Section 7. Reworded Section 2 to name the Morning Read summary and the analytics events as the exceptions to on-device processing. Added the push delivery log, the retry record, the rate-limit counters and the quiet-hours queue to Section 3.10 and corrected the retention of the alert configuration record (it has no 90-day expiry). Added a push delivery row to Section 4, the Apple Push Notification service to Section 5, the Morning Read analytics event to Section 3.7 (and clarified what analytics events do not include) and the Morning Read counts to the CCPA inferences row. Corrected what Export My Data includes in Sections 8.1 and 8.8. Noted the delivery log and the auth audit log as exceptions in Section 3.11. |
This Privacy Policy applies to WatchSignal for iOS.