4tune Privacy Policy
This policy describes how 4tune handles your data. It is written to be accurate and specific to how 4tune actually works, not generic boilerplate — where something is an estimate, a limitation, or a place your data genuinely does travel, it says so.
Who is responsible for your data
4tune is built and operated by Pavlos Panagitsas, an individual developer based in Cyprus. For the purposes of the General Data Protection Regulation (GDPR), that means he is the data controller for the limited personal data described under "The alerts service" below.
Contact for any privacy question or request: 4tune.tracker@gmail.com.
[If and when 4tune is incorporated, replace the controller named above with the company's registered name, registration number and registered address, and update the "Last updated" date. Do not name a company here before it legally exists.]
The short version
Your exchange and brokerage API keys never leave your own device. They are stored by your browser or your phone's keychain and are sent only to the platform they belong to. There is no 4tune account, no login, and no copy of your keys, balances or holdings anywhere but your own device.
4tune does operate one small server, and only for one purpose: sending you a price alert. It holds the minimum needed to do that — a random identifier for your phone, a push notification token, and the alert rules you created (for example, "tell me when BTC goes above $80,000"). It holds no API keys, no balances, no holdings, no name and no email address.
No analytics. No advertising. No trackers. No data brokers. Nothing is sold, and nothing is shared beyond the specific services listed below that are needed to make the product work.
The three parts of 4tune
This policy covers all three, because they store data differently:
-
The Chrome extension — runs entirely in your browser.
Storage is Chrome's own
chrome.storage.local. - The mobile app (iPhone and Android) — runs entirely on your phone. Keys are stored in the operating system's secure keychain (iOS Keychain / Android Keystore).
- The 4tune alerts service — the only server. It exists so a price alert can reach you when the app is closed, which is impossible to do from the phone alone.
What is stored on your own device
None of the following is ever transmitted to 4tune. It is readable only by the extension or the app on your own device, and it is deleted when you uninstall them.
| Data | Where | Why |
|---|---|---|
| API keys and secrets for each platform you connect | Extension: chrome.storage.localApp: OS keychain |
To ask that platform for your own balance, on your behalf |
| A market-data key you choose to add (Finnhub) | App: OS keychain | To show stock and ETF prices without connecting a broker |
| Cached balances, positions, fees and profit/loss | Your device only | So the app and dashboard can show your portfolio without refetching constantly |
| Daily portfolio value snapshots (up to 365 days) | Extension: your device only | To draw the performance chart |
| Deposits and withdrawals you record yourself | Extension: your device only | So money you paid in isn't mistaken for a loss on the performance chart |
| Your watchlist | App: your device only | To keep the assets you pinned |
| Preferences — theme, display currency, refresh interval | Your device only | To remember your settings between sessions |
| A random device identifier and a device secret | App: OS keychain | So the alerts service can tell your phone apart from someone else's, without knowing who you are |
Neither the extension nor the app reads your browsing history, your bookmarks, your other tabs, your contacts, your photos or your location. The extension's permissions are scoped to the API addresses of the platforms it connects to and nothing else; it cannot read or change other websites.
The alerts service — the one place data reaches a server
If you create a price alert in the app, your phone sends the alert rule to 4tune's alerts service so that it can keep watching the price while your app is closed. This is the only part of 4tune that stores anything about you outside your own device. Here is the complete list — it is the actual database schema, not a summary:
| Stored | What it is | Why |
|---|---|---|
| Device identifier | A random value your phone generates on first launch. It is not your phone's serial number, advertising ID or any identifier assigned by Apple or Google. | To attach your alerts to your phone |
| Hash of your device secret | A SHA-256 hash. The secret itself stays in your phone's keychain and is never stored by us. | So nobody else can edit or read your alerts, even with a copy of the database |
| Push notification token | An address issued by Expo/Apple/Google that lets a notification reach your device. | To deliver the alert |
| Platform | Either "ios" or "android". | To route the notification correctly |
| Your alert rules | Asset (e.g. BTC), currency, type (price or % move), direction, threshold, whether it repeats, whether it's on, when it last fired. | To know what to watch for |
| Alert history | Each time an alert fires: the asset, the price at the time, the threshold and the timestamp. Kept for 30 days, then deleted automatically. | So you can see what fired while you were away |
| First seen / last seen timestamps | Dates only. | To clean up devices that no longer exist |
What the alerts service never receives: any API key or secret for any exchange or broker; your balances, holdings, positions, trades or profit and loss; your name, email address, date of birth or payment details; your location; your contacts; any advertising identifier. There is deliberately no column in the database for an API key, and the service has no code that could accept one.
An alert rule does reveal which assets you are interested in, and the notification text itself names the asset and price. Treat that as the honest limit of what the service knows about you.
Cloudflare, which hosts the service, processes the network address (IP) of incoming requests as part of delivering and protecting it, as any web host does. 4tune does not log, store or analyse IP addresses.
Who your data reaches, and why
| Service | What reaches it | Why |
|---|---|---|
| Platforms you connect — Trading 212, Alpaca, Binance, Kraken, Kraken Futures, OKX | Your own API key for that platform, and the read request it authenticates. Sent directly from your device to them. | Because you asked 4tune to show that account. Each platform's own privacy policy governs what it does with the request. |
| Finnhub — only if you add a key | Your own Finnhub key and the ticker you are looking at, directly from your phone. | To show stock and ETF prices without a broker account |
| Binance public market data | Nothing about you. Public price requests, with no key and no account, made both by the app and by the alerts service. | Crypto prices and the live price stream |
| Frankfurter (European Central Bank reference rates) | Currency codes only — for example "USD to EUR". No personal or financial data. | To show your totals in your chosen currency |
| Cloudflare | Hosts the alerts service and its database, and so processes everything in the alerts table above, on 4tune's instructions. | To run the alerts service |
| Expo, then Apple (APNs) or Google (FCM) | Your push token and the text of the notification — which names the asset and price. | Because this is the only route by which a notification can reach a phone |
| Vercel | Hosts 4tune-tracker.com. Standard web server logs for page visits; the website itself sets no cookies and runs no analytics. | To serve this website |
That is the complete list. Your data is not sold, rented, or shared for advertising, profiling or any interest-based purpose, and no human — including the developer — reads it.
For the Chrome extension specifically, 4tune complies with the Chrome Web Store's Limited Use requirements: data the extension can access is used only to provide the portfolio-tracking features described here and in its store listing, and for no other purpose.
Legal bases for processing (GDPR Article 6)
- Performance of a contract — running the alerts service you asked for. Without a device identifier and a push token, a price alert cannot be delivered.
- Legitimate interests — keeping the service secure and available, preventing abuse, and removing data for devices that no longer exist.
Data stored on your own device is not processed by 4tune at all, so no legal basis arises for it. Creating an alert is entirely optional; if you never create one, nothing about you ever reaches the alerts service.
Transfers outside the EEA
Cloudflare, Expo, Apple, Google and Vercel are United States companies and may process data outside the European Economic Area. Where that happens, it is covered by those providers' own transfer safeguards, typically the European Commission's Standard Contractual Clauses and, for certified providers, the EU–US Data Privacy Framework. The data involved is limited to what is listed in the alerts table above.
How long data is kept
- On your device: until you remove it, disconnect the platform, or uninstall. Uninstalling deletes everything.
- Alert history on the server: 30 days, then deleted automatically.
- Alert rules: until you delete the alert.
- Your device record: until you ask for it to be deleted, or it is cleaned up as inactive.
Your rights
Under the GDPR you have the right to access your personal data, correct it, have it erased, restrict or object to its processing, and receive it in a portable form.
For anything stored on your own device, these rights are already entirely in your hands — you can view, change or delete it through the extension or the app, and uninstalling removes all of it at once. There is no account to close and no request to send, because no copy exists anywhere else.
For the alerts service: deleting an alert in the app removes that rule, and clearing your history removes those events. To have your device record and everything attached to it erased completely, email 4tune.tracker@gmail.com from any address with your device identifier — Settings in the app shows it — and it will be deleted. No proof of identity is requested, because the service holds nothing that could identify you to begin with.
If you believe your data has been handled improperly, you have the right to complain to a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy). You may also complain to the authority in your own country of residence.
Security
- All communication, in every part of 4tune, uses HTTPS.
- API keys are held in storage designed for the purpose — Chrome's extension storage, and on phones the operating system keychain, which is hardware-backed on most modern devices.
- 4tune's setup guide recommends creating read-only keys everywhere, with trading and withdrawal permissions disabled. This limits what could go wrong even in the worst case, and it is the single most effective thing you can do to protect yourself.
- The alerts service stores only a hash of your device secret, so a copy of the database would not let anyone impersonate your device.
- Because no server holds API keys, there is no central store of credentials that could be breached the way a conventional service's could. The realistic risk is the security of your own device, as it is for anything else stored on it.
- No system is perfectly secure, and nothing here is a guarantee against every possible attack.
Children
4tune is not intended for anyone under 18, or under the age of legal majority where that is higher. It is not directed at children, and data is not knowingly collected from them. If you believe a child has used the alerts service, contact the address above and the record will be deleted.
App store disclosures
Apple's App Privacy label and Google Play's Data safety section for the 4tune app declare the same thing this policy does: an identifier (the device identifier and push token) is collected for app functionality only; it is not linked to your identity, and it is not used for tracking across apps or websites. If the app ever collected anything more, both the store listings and this page would be updated before that version shipped.
Changes to this policy
If this policy changes, the "Last updated" date above changes with it. Because 4tune has no accounts and no email list, there is no way to notify you directly — check this page, or the version notes on the store listings. If a change ever materially widened what is collected, it would be announced in the app itself, not only here.
Contact
This policy is a draft prepared with AI assistance, written from 4tune's actual source code, permissions and database schema. It is not legal advice. Because 4tune handles financial API credentials, serves users in the EU under the GDPR, and will be distributed through the Chrome Web Store, the App Store and Google Play, have a qualified lawyer review it before it is published or submitted — in particular the controller identity, the legal bases, and the international transfer section.