Privacy Policy

Effective: 19 October 2026

This policy explains how personal data is processed when you use the MMTC Pulse app for iPhone and Android (“App”), the website pulsebymmtc.com (“Website”) and our social media channels. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

• Controller
• Website
• Contact form
• App
• Screener
• Morning Brief
• Trade Coach
• Referral program (planned)
• Exchange & wallet connections
• Broker import
• Hyperliquid connection
• Notifications
• In-app purchases
• Social media
• Google / YouTube API data
• Service providers
• Retention & deletion
• Your rights
• Other

1. Controller

We are not required to appoint a data protection officer. For all privacy questions, please contact us at the address above.

2. Website

The Website is hosted by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) via Cloudflare Pages and Cloudflare Workers. When you visit the Website, Cloudflare automatically processes technical data that your browser transmits (IP address, date and time, requested page, browser type, operating system, referrer). This is necessary to deliver the Website and to protect it against attacks (legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure and working website). Cloudflare may process data in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework and additionally uses EU Standard Contractual Clauses.

The Website does not use cookies, analytics, advertising tools, external fonts or embedded third-party content. If you contact us by e-mail, we use your e-mail address and message only to answer your request (Art. 6(1)(b) or (f) GDPR).

2a. Contact form

If you use the contact form at pulsebymmtc.com/contact, we process your name, your e-mail address, the subject (optional) and your message in order to answer your request. To protect the form against abuse and spam, we additionally store a one-way hashed (SHA-256, with a daily changing salt) value derived from your IP address; the IP address itself is not stored. The data is stored with our backend provider Supabase (EU, see section 9), and we receive a short notification on our team devices containing your name and the beginning of your subject or message. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries and preventing abuse). We delete your data once your request has been resolved, at the latest after 6 months, unless statutory retention obligations apply.

3. App

3.1 Using the App without an account

Many features (market data, heatmap, news, market regime) work without an account. The App loads this public market information from our backend and from public data sources (e.g. Binance, CoinGecko, alternative.me and news feeds). These requests contain your IP address and device information technically required for the connection, but no account data.

3.2 Account (Sign in with Apple)

If you create an account, we use Sign in with Apple. We receive a unique user identifier and – depending on your choice – your e-mail address or an Apple private relay address, and optionally your name. We store your profile: display name, optional profile picture, language, selected interests and notification preferences, plan/subscription status. Legal basis: Art. 6(1)(b) GDPR (providing the service you requested).

3.3 Content you enter

Data you enter or import yourself is stored in your account so that it is available on your devices and for alerts: watchlists, price alarms and alert rules, trades (symbol, side, entry, size, leverage, targets, stop loss, results), your trade journal, and your holdings (coins, purchases and sales you enter manually or import from a CSV file, plus balances you correct by hand). From your holdings the App calculates values, profit and loss and the German one-year holding period; this is for orientation only and not tax advice. Legal basis: Art. 6(1)(b) GDPR. We use this data only to provide the App’s functions (e.g. portfolio view, trade coach, risk alerts) and never sell it.

3.4 Face ID, widgets and Live Activities

The optional app lock uses Face ID / Touch ID. Biometric data is processed exclusively by iOS on your device; we never receive it. Widgets and Live Activities display data that is already in the App.

3.5 No tracking

The App contains no third-party advertising networks and no third-party analytics or tracking SDKs, and does not track you across apps or websites.

3.5a Crash reports

If the App crashes or freezes, iOS (Apple MetricKit) can provide the App with an anonymous technical diagnostic report. The App sends this report to our backend: app version and build, iOS version, device model and the technical call stack. It contains no user ID, no device ID, no account data and no content you entered. We use these reports only to find and fix errors and keep them only as long as needed for that. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable app).

3.5c Anonymous usage statistics

To understand whether Pulse Pro is useful, the App sends a few anonymous events to our backend: when the Pro page is shown (and from where) and when a free trial or purchase is completed (product name only). We store only the event name, these few details, the app version and the app language – no user ID, no device ID, no IP address, no account data. The data cannot be linked to you and is used only in aggregate. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the App).

3.5b Live stream

The App can show our own YouTube live stream. Only when you open the player is the video loaded from YouTube (Google Ireland Ltd.) via the embedded YouTube player; YouTube then processes your IP address and device information under the Google Privacy Policy. To find the current stream, our backend reads our own public YouTube channel page; no data about you is sent for this. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.6 Android app

The Android version is distributed via Google Play (Google Ireland Ltd.). It currently works without an account: there is no sign-in, no trade journal and no exchange import on Android. The App loads public market data (prices, heatmap, liquidation levels, news, market regime) from our backend (Supabase, EU) and from public sources such as Binance. These requests technically contain your IP address and basic device information, but no account data. Your settings (language, watchlist) and price alerts are stored only locally on your device and are removed when you uninstall the App. For price alerts, the App checks public prices from Binance about every 15 minutes in the background and shows a local notification on your device; no push token is created and nothing is sent to us. You can allow or revoke notifications at any time in the Android settings. The Android app contains no advertising and no third-party analytics or tracking SDKs. Google may process data when you download and update the App via Google Play under its own privacy policy. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.7 Screener

The Screener shows public market data (e.g. prices, trading volume, funding rates, open interest and liquidation levels) that our backend retrieves from the public market data interfaces of Binance, Bybit and OKX. This is general market data; no personal data is sent to these exchanges, and no exchange connection is needed. As with any request to our backend, your IP address and device information are technically processed for the connection (see 3.1). Legal basis: Art. 6(1)(f) GDPR.

3.8 Morning Brief

The Morning Brief is a push notification at around 8:00 your local time with a short market overview (and, for Pro users with open trades, a short status of these trades). For this we store your device’s time zone and your preference for the Morning Brief (on/off) together with your push settings (section 5), plus a short send log (recipient, day, text of the brief) so that it is sent only once per day. The Morning Brief is switched on by default for Pro users and off for everyone else. You can switch it off at any time in the App’s notification settings (opt-out) or revoke notifications in the iOS settings. Legal basis: Art. 6(1)(a) GDPR (notification consent via iOS) and Art. 6(1)(b) GDPR.

3.9 Trade Coach

The Trade Coach looks for patterns in your own trades (e.g. results by time, setup or holding period) and shows you hints. The analysis runs on your device using the trades in your journal; the results are not sent to us or to third parties. On supported devices you can optionally have the hints worded by Apple Intelligence; this uses Apple’s on-device model, so your trade data does not leave your device for this. The Trade Coach is for self-reflection only and is not investment advice. Legal basis: Art. 6(1)(b) GDPR.

3.10 Referral program (planned – currently not active)

Status: The referral program is planned but currently not active. At the moment no referral codes are generated, shared or redeemed, and no referral data is processed. The following describes the processing that will apply once the program is switched on; we will update this policy beforehand if anything changes.

When you sign in, our server generates a personal referral code for your account: 7 random characters (created with a cryptographic random generator, not derived from your account or device). We store it in our database together with your account ID. You can share it directly or as an invitation link (pulsebymmtc.com/app?ref=…). The invitation page only displays the code; it sets no cookies and stores nothing beyond the technical access data described in section 2.

If you enter a friend’s code, we check it on our server and store a redemption record: which code was redeemed, by which account (as friend), whose code it was (as inviter), when, and which Apple offer code was assigned to the friend and to the inviter (each offer code can only be assigned once). The inviter receives a push notification that a reward is available. To prevent abuse, we log each redemption attempt (account ID, time, success) and limit the number of attempts per account (rate limiting); these attempt entries are deleted automatically after 7 days. The offer code itself is redeemed in the App Store; Apple processes this under its own privacy policy, and we do not receive your payment details.

When you delete your account, your personal referral code is deleted. Redemption records in which you appear are not deleted but de-linked: the reference to your account is removed, while the redeemed code and the assigned Apple offer codes are kept, so that each offer code is used only once and rewards can be accounted for. Legal basis: Art. 6(1)(b) GDPR, for abuse prevention and the remaining redemption records Art. 6(1)(f) GDPR.

4. Exchange and wallet connections (optional)

If you connect an exchange (currently Binance, Bybit, Phemex, Bitget, Bitunix, Pionex, OKX, Kraken, Bitvavo, Bitpanda or Coinbase), you provide a read-only API key (for OKX also the API passphrase, which is stored encrypted like the secret). The key secret is stored encrypted in our backend’s secure key vault, is never sent back to the App and is used only for read requests: your trades and open positions, your balances (including Earn, futures margin and trading-bot accounts), running trading bots (type, pair, invested amount, profit) and your spot purchase, sale, deposit and withdrawal history, which we import into your journal and holdings. We store the exchange name, a short hint of the key (e.g. the last characters), the sync status, the imported trades, balances and transactions. We never place orders, start or stop bots, transfer or withdraw funds. Please only use keys without trading, transfer or withdrawal permissions. You can disconnect at any time; the stored key is then deleted. Legal basis: Art. 6(1)(b) GDPR.

Wallet addresses: You can add public BTC, ETH or SOL wallet addresses. We store the address, an optional label and the last known balance. To read the balance, the public address is sent to public blockchain services (mempool.space for Bitcoin, public Ethereum and Solana RPC nodes). We never ask for private keys or seed phrases. You can remove an address at any time. Legal basis: Art. 6(1)(b) GDPR.

4a. Broker import (optional)

You can import the transaction export (CSV) from your broker, e.g. Trade Republic. The file is read on your device. Only entries that concern securities and crypto are sent to our backend: security identifier (ISIN) and name, number of shares, price, amount, fees, taxes, date and the broker’s transaction ID. Cash transfers, card payments, IBANs and names of counterparties stay on your device and are never sent to us. We do not log in to your broker account and never place orders. If you enter a savings plan, we store the security, amount and execution day to estimate your holdings until your next import. You can delete imported data at any time. Legal basis: Art. 6(1)(b) GDPR.

4b. Hyperliquid connection (optional)

You can connect a Hyperliquid account by entering only your public wallet address – no API key, no private key and no signature. We store the address and use it to read your balances, open positions and trades from Hyperliquid’s public info interface (api.hyperliquid.xyz) for your holdings and journal. The connection is read-only: we cannot place orders or move funds. Please note that this data is publicly visible on Hyperliquid anyway. You can disconnect at any time in the App; the stored address is then deleted and no further data is retrieved. Legal basis: Art. 6(1)(b) GDPR.

5. Notifications

If you allow notifications, we store a push token of your device (plus app version, device model and selected alert categories) to send price, liquidation, news and trade alerts via the Apple Push Notification service (APNs) operated by Apple. Legal basis: Art. 6(1)(a) GDPR (your consent via iOS). You can revoke this at any time in the iOS settings.

6. In-app purchases

Subscriptions and purchases are processed exclusively by Apple via the App Store. We do not receive your payment details. We receive and store information about the purchased plan, its status and expiry date in order to unlock features (Art. 6(1)(b) GDPR). Apple’s privacy policy applies to the payment process.

7. Social media

We operate accounts on Instagram (@mmtc.pulse; Meta Platforms Ireland Ltd.), Facebook (Meta Platforms Ireland Ltd.), YouTube (@mmtcpulse; Google Ireland Ltd.), X (@PulsebyMMTC; Twitter International Unlimited Company, Ireland), Telegram (t.me/MMTCPuls; Telegram Messenger Inc.) and Discord (Discord Netherlands B.V.). When you visit these profiles, the respective platform processes your data under its own privacy policy. For Instagram and Facebook page insights, we are jointly responsible with Meta (Art. 26 GDPR); Meta provides the Page Insights Addendum.

Automated replies: We use the official Instagram API to publish our own posts and to reply to comments under our posts. When you comment, we process your username, the comment text and its ID to post a public reply. If you comment a keyword such as “MAP”, we send you one private message with the requested link. We keep a short log of these actions (comment ID, username, action, time) for up to 90 days to avoid duplicate replies. Legal basis: Art. 6(1)(f) GDPR (our interest in answering our community) and, for the requested message, Art. 6(1)(b) GDPR. We also read aggregated post statistics (reach, likes, views).

X (formerly Twitter): We use the official X API to publish our own posts and to reply to posts that mention our account or reply to our posts. For this we process the post ID, the author ID, the language and the text of such posts. We reply at most once per person per day and keep a short log (post ID, author ID, action, time) for up to 90 days to avoid duplicate replies. Legal basis: Art. 6(1)(f) GDPR (our interest in answering our community). You can object at any time (see below).

We use the official YouTube interface only to publish our own videos to our own channel; we do not access data of viewers through these interfaces.

8. Google / YouTube API data

Pulse uses the YouTube Data API solely to upload our own short videos to our own YouTube channel. The OAuth access is limited to that channel. Pulse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube’s Terms of Service and the Google Privacy Policy apply. Access can be revoked at any time via the Google security settings.

9. Service providers and transfers

• Supabase (Supabase Inc., USA) – database, authentication and server functions. Our project is hosted in the EU (Ireland, AWS eu-west-1). A data processing agreement including EU Standard Contractual Clauses is in place.
• Cloudflare (Cloudflare, Inc., USA) – Website hosting and security.
• Apple (Apple Distribution International Ltd., Ireland) – Sign in with Apple, App Store, push notifications.
• Google (Google Ireland Ltd., Ireland) – distribution of the Android app via Google Play.

Where data is transferred to the USA, this is based on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 45, 46 GDPR). We do not sell personal data and do not share it with third parties for advertising.

10. Retention and deletion

We store account data and content for as long as your account exists. You can delete your account directly in the App (in your profile settings) or by e-mail; your profile, trades, holdings, imported transactions, alerts, push tokens and notification settings (incl. Morning Brief), wallet addresses, your Hyperliquid address, exchange keys and your personal referral code are then deleted, unless statutory retention obligations apply; referral redemption records are kept without the link to your account (see section 3.10). Server logs are deleted after a short period (usually within 30 days). Records of purchases may be kept as required by commercial and tax law.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Other

We do not use automated decision-making within the meaning of Art. 22 GDPR. The App is intended for users aged 16 and over (16+) and is not directed at children under 16. Providing data is voluntary; without an account, some features (sync, alerts, trades) are not available. We may update this policy when our services change; the current version is always available on this page.