Cobalt Flow — Privacy Policy

Last updated: August 4, 2026

Data controller: Cobalt Software E-mail: destek@cobaltsw.com Web: https://cobaltsw.com

This Privacy Policy explains what data we process when you use the Cobalt Flow mobile app (the "App"), why we process it, where we transfer it, and your rights. This policy is prepared under Turkey's Personal Data Protection Law No. 6698 ("KVKK"); for users in the European Economic Area, GDPR provisions are taken into account to the extent applicable.

1. Data we collect

Cobalt Flow requires no account or sign-up; we do not ask for your name, e-mail, or password. The data we process is limited:

Data	Purpose	Where stored
Push token (FCM token)	Send signal/alert notifications while the app is closed	Our server (token only)
Your watchlist (symbol + timeframe)	Generate crossover alerts for your chosen instruments	Our server (tied to the push token)
Language preference	Serve content in your language	On your device + sent to server
Device manufacturer	Only to show a notification-setup guide on devices with aggressive battery management	Processed on-device only, not stored
IP address	Security: preventing abuse/DDoS, API security, and rate limiting	Temporarily in server logs
Subscription status	Determine ad-free access	Managed by the App Store / Google Play
Advertising identifier and ad-interaction data (only for non-subscribers who see ads)	Serve/measure ads via Google AdMob; personalize them with your consent	Processed by Google AdMob

Data on our server is matched to randomly generated push tokens; it is not linked to directly identifying information such as name, surname, or e-mail.

Data we do NOT process: name, e-mail, phone, address, ID number, location, contacts, financial account/card data, health data. You do not enter payment details in the App.

2. Local storage (instead of cookies)

The App stores your language preference and some in-app settings in your device's local storage (Android SharedPreferences / iOS UserDefaults). These are not advertising or tracking cookies and do not leave your device.

3. Why we process data (legal bases)

Performance of a contract: providing the notification and watchlist service.
Legitimate interest: security (DDoS/abuse prevention, API security, rate limiting) and service quality.
Consent: push notifications, when you grant notification permission.

4. International data transfer

The servers of the third-party infrastructure providers we use (in particular Google Firebase, Google AdMob and RevenueCat) may be located outside Turkey. Therefore, to provide the service, data such as the push token, subscription status/anonymous user identifier, advertising identifier and IP address may be transferred to the countries where these providers are located. This transfer is carried out within the framework of lawful bases compliant with applicable legislation and under the KVKK/GDPR-compliant safeguards of the relevant providers.

5. Third-party services

Google Firebase Cloud Messaging — delivers push notifications (push token).
Market/data providers — price and macro data (e.g. Binance, MetaTrader bridge, CoinGecko, FRED, CFTC, Stooq, alternative.me). The App is designed not to send personal data that identifies the user to these providers; only general market data is fetched.
Anthropic (Claude AI) — generates economic-calendar commentary. Only public economic data (event name, released value) is sent; no user-identifying personal data is sent.
App Store / Google Play — subscription and payment handling.
RevenueCat — verifying subscription status and recognising it across devices. It processes the purchase/subscription information received from the store together with an anonymous user identifier generated for this purpose; no name, e-mail or payment card details are sent. Its servers are located abroad (see Section 4).

Advertising (Google AdMob): the App offers free, ad-supported access and shows ads via Google AdMob. To serve, measure and (with your consent) personalize ads, AdMob may process your device advertising identifier (Android Advertising ID / iOS IDFA) and general device/ad-interaction data.

Consent (UMP): in the European Economic Area / United Kingdom your consent is requested before ads via Google's consent mechanism; you can change your choice anytime under "Ad & privacy preferences" in the menu.
iOS App Tracking Transparency (ATT): on iOS, a separate system permission is requested to use your advertising identifier; if you decline, only non-personalized ads are shown.
Ad-free option: with the "Ad-free" subscription no ads are shown and no data is sent to AdMob for this purpose. How Google uses data in ads: https://policies.google.com/technologies/ads Analytics: the App uses Google Firebase Analytics to understand usage habits and improve the service. Data collected: in-app interactions (screens/features opened), device/app-instance ID, and approximate location (country/city) derived from IP. This data is processed under a pseudonymous (anonymous) ID and is not linked to your name, email or identity. Processing is performed by Google and its servers may be located abroad (see Section 4). Dedicated crash-tracking tools (Crashlytics, Sentry) are not used.

6. Data retention

IP logs: approximately 7 days (for security), then deleted.
Push token: kept while you use the App.
Your watchlist: kept until you delete it (or disable all alerts).
Payment data: not stored by us (see Section 8).

7. Deletion and notification permission

If you turn off all alerts in the App, the related token and watchlist record are removed from the system.
When you uninstall the App, your token becomes inactive and is permanently deleted from our server during periodic system cleanups.
You can turn off notification permission at any time in your device settings; doing so stops processing related to push notifications.
For deletion requests: destek@cobaltsw.com.

8. Payments

Subscriptions and payments are handled entirely by the App Store and Google Play. Your payment details are never seen or stored by us.

9. Data security

All data transfer is carried out encrypted via HTTPS/TLS (flow.cobaltsw.com). Our server is protected by an API key and rate limiting. No system is 100% secure, but we apply reasonable technical and organizational measures to protect data.

10. Financial notice

The analyses, "Flow" indicator outputs, analytical alerts, and AI commentary in the App are for informational purposes only and do not constitute investment advice. Past performance is not a guarantee of future results. All financial decisions are entirely your own. For details, see our separate Disclaimer (Not Investment Advice) document.

11. Children's privacy

The App is not designed for children and does not knowingly collect data from children.

12. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request its correction/deletion, and to object to processing. You may submit your requests to destek@cobaltsw.com or by the other methods specified in the legislation (registered e-mail (KEP), wet-signed petition, etc.).

Users located in the European Economic Area may also exercise their rights under the GDPR to the extent applicable.

13. Changes

We may update this policy from time to time. We will notify you within the App of material changes. The current version is always available on this page.

14. Contact

Cobalt Software E-mail: destek@cobaltsw.com Web: https://cobaltsw.com Country: Türkiye