Legal
Privacy Policy
Last updated: October 9, 2026
The short version
- Satsu is made in Europe. Your account data is stored in the European Union and protected by GDPR.
- We hold only what the service needs, such as your account email, your signal history, your subscription status and, if you allow alerts, your device's push token.
- No ads, no ad trackers, no third-party analytics. We never sell your data.
- If you connect Coinbase, we never see or hold your funds.
- You can delete your account in the app at any time, and ask us for a copy of your data.
Who we are
Satsu is run by K-MYSTIK SRL (company number BE0826745747), a company registered in the European Union. K-MYSTIK SRL is the data controller for the personal data described here. Contact: support@satsu.app.
What we hold, why, and on what legal basis
| Data | Why | Legal basis |
|---|---|---|
| Email address, password (stored only as a salted hash) or your Sign in with Apple identifier, account id | To create your account and sign you in; to send sign-in codes and account emails | Contract (Art. 6(1)(b)) |
| Signal history: signals viewed, accepted, declined or marked as bought and, for buys, the amount in euros and the Coinbase order reference | To show your history and portfolio | Contract |
| Push token for your device | To deliver signal alerts | Contract |
| Subscription status and App Store subscription events (plan, price, renewal dates and transaction ids). Payment details are handled by Apple; we never see your card or bank details. | To give you the right plan | Contract |
| Coinbase access tokens, only if you connect Coinbase; encrypted at rest | To place the buys you approve on your own Coinbase account | Contract, at your request |
| In-app counts, linked to your account (today only one: when the Premium screen opens, and from where). We count, we don't track: these stay on our EU servers, never go to a third party, and are never used for profiling or ads | To understand whether the app explains Premium clearly, and improve it | Legitimate interest (Art. 6(1)(f)); you can object at any time |
| Crash and performance reports, not linked to your account, with no screenshots and no personal details | To find and fix bugs | Legitimate interest |
| Technical logs: IP address, request time and status; security records such as sign-ins and deletion requests | To keep the service secure and prevent abuse | Legitimate interest |
| Messages you send us through the support form or by email | To answer you | Legitimate interest, or steps before a contract |
We don't collect your contacts, location, photos or anything else from your device beyond this list. We don't make automated decisions about you that have legal or similarly significant effects. Signals are the same for everyone on a plan and aren't based on your profile.
Where your data is stored
Your account data is stored and processed on servers in the European Union, protected by GDPR. Crash reports are also stored in the EU. Some providers keep copies outside the EU under EU safeguards: see transfers below.
Who helps us run Satsu
We use a small number of service providers (processors). Each acts only on our instructions, under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Google Cloud | Running the Satsu service | EU |
| Neon | Database | EU |
| Sentry | Crash reports | EU |
| Cloudflare | Hosting this website, running the support form, and spam protection on it (Turnstile) | Global network, see transfers |
| RevenueCat | Keeping your subscription status in sync with the App Store (receives your account id, not your email) | United States, see transfers |
| Resend | Sending sign-in codes and account emails, and forwarding messages from the support form | United States, see transfers |
Independent services you use with Satsu
Two services you use alongside Satsu are not our processors. They handle your data as independent companies under their own privacy terms:
| Service | What for |
|---|---|
| Apple | App Store billing, push notification delivery, Sign in with Apple |
| Coinbase | Only if you connect it: placing the buys you approve |
News headlines used to analyse market sentiment are processed by an AI provider. They contain no personal data about you.
Transfers outside the EU
Some providers process data in the United States. RevenueCat receives your account id, your App Store subscription transactions and the technical data any app connection carries (such as IP address and device model), never your email. Resend sends our emails from the EU, but it receives your email address, the emails we send you and the messages you send through the support form, and stores its records in the United States. Both transfers are protected by the European Commission's Standard Contractual Clauses, and Resend is also certified under the EU-US Data Privacy Framework. Cloudflare processes visitors' IP addresses on its global network, including the US, under Standard Contractual Clauses and the EU-US Data Privacy Framework.
How long we keep it
- Account data, signal history, push tokens, in-app counts and Coinbase tokens: as long as your account exists. When you delete your account, your account and the data linked to it are permanently erased after a 30-day grace period, except the records listed below.
- Sign-in codes and sessions: sign-in codes expire after 10 minutes and sessions after 30 days of inactivity; the expired records are erased with your account.
- Technical logs: up to 30 days.
- Crash reports: up to 90 days.
- Security and billing records that outlive a deleted account (for example, proof that it was deleted) keep no email or name: they are identified only by a former account number and, for billing, App Store transaction ids, and are kept only as long as needed to prove what happened or to meet legal obligations.
- Subscription records at RevenueCat are kept under RevenueCat's own retention terms.
- Support messages: up to 24 months after the conversation ends.
Website
satsu.app sets no tracking cookies and uses no trackers and no third-party analytics. Our fonts are served from our own site. The only third-party script is the spam check on the support form (Cloudflare Turnstile), which loads on that page only. Our hosting provider processes your IP address only to deliver the page and protect the site.
Push notifications
Signals reach you as push notifications. To deliver them, we store the push token Apple assigns to your device. The token identifies your device for notification delivery only. It doesn't reveal who you are. If you turn off notifications or delete your account, the token is no longer used and is removed.
Coinbase connection
Connecting Coinbase is optional and uses Coinbase's official OAuth flow. You sign in on Coinbase's own pages and we never see your Coinbase password.
- We never see or hold your funds. Purchases execute on your own Coinbase account, only when you tap to approve them.
- When you approve a buy, we read your Coinbase account list to find the portfolio holding your euro balance, and place the order there. We read it only when placing a buy you approve.
- The access tokens Coinbase issues are encrypted at rest on our side.
- You can disconnect at any time: in the app, or by revoking access from your Coinbase account settings. Disconnecting deletes the stored tokens.
Account deletion
You can delete your account directly in the app: Settings → Account → Delete account. Deletion is scheduled with a 30-day grace period. If you change your mind, sign back in within 30 days and the deletion is cancelled. After the grace period your account and the data linked to it are permanently erased, except the records described under "How long we keep it".
Your rights
Under the GDPR you can ask to access, correct, export or erase your data, and to restrict or object to its processing, including the in-app counts described above. Delete your account in the app, or email support@satsu.app from the address on your account. We'll answer within one month. You also have the right to lodge a complaint with a data protection authority, in particular the one in the EU country where you live or work.
Age
Satsu is for adults (18+). We don't knowingly collect data from children.
Changes to this policy
If we change this policy in a way that matters, we'll update the date above and tell you in the app or by email before it takes effect.
Contact
Questions about your data? Email us at support@satsu.app or use the support form.