Privacy Policy
What personal data Flightdeck handles, why, and what you can do about it. Short, because we collect little.
Who is responsible
EASYTECH, 2 rue de la Libération, 74000 Annecy, France (RCS Annecy 943 638 387) is the data controller. Contact for anything about your data: contact@easytech-agency.net. We have not appointed a data protection officer; this address reaches the person responsible.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, sign-in method (emailed sign-in link, Google or password), account ID. If you use Google sign-in: your name and profile picture as sent by Google (we do not use them). | Creating your account and signing you in; service and billing emails. | Performing our contract with you |
| The email address you type to start your trial, and the plan you pick. | Opening your Stripe checkout with that address, then creating your account from the completed checkout and emailing you the link that signs you in. If you leave checkout without finishing, no account is created. | Steps taken at your request before a contract; then the contract |
| Your answers to the questions before checkout, if you give them: the markets you trade, how you follow market news, and, depending on the version of the questions you were shown, how long you have been trading or which scheduled releases matter to you and how much explanation you want. We also keep which version you were shown: we compare two versions of these questions, drawn at random when you arrive and carried in the page address, not in a cookie. They travel with your Stripe checkout and are stored with your account. | Setting up your cockpit on the markets and releases you picked, understanding our audience as a whole (for example, how many subscribers are new to trading), and learning which version of the questions works better. | Contract (your markets); our legitimate interest in understanding who uses Flightdeck and improving how we present it (the other answers, which are optional) |
| Your watchlist (the assets you picked). | Showing your cockpit the way you set it up, on all your devices. | Contract |
| Your alert settings: which alerts you want (important news, spikes, releases, drifts), on which markets, quiet hours, how many notifications an hour, your time zone, and whether you want the morning brief and the evening recap by email. If you turn on notifications on a device: the push address your browser gives us for that device and a short device name (for example "iPhone · Safari"). A record of the alerts we sent you over the last 48 hours, and the alerts waiting for your next grouped email. | Sending you only the alerts and emails you turned on, never twice, within your limits and outside your quiet hours. | Contract (features you turn on). Each can be turned off at any time in your alert settings, and each email has its own unsubscribe link. |
| Subscription status, plan, renewal date, Stripe customer ID. | Opening or closing access; support. | Contract |
| Billing details you give Stripe at checkout (name, address, VAT number, card). We receive your name, address, VAT number and the card's last four digits and brand, never the full card number. | Taking payment, invoices, VAT. | Contract; legal obligation (accounting and tax) |
| If you arrived by clicking one of our ads on Facebook or Instagram: the click identifier Meta adds to the link (fbclid), which steps you took on our site (viewed the home page, clicked Start, gave your email to start a trial, signed in, opened checkout), and whether you started a trial or paid, with the amount. | Telling Meta which of our ads led to a visit, a trial or a subscription, so our advertising budget goes to the ads that work. | Our legitimate interest in measuring our advertising. You can object at any time (see Your rights). |
| Technical logs: IP address, browser, time and address of requests. | Security, debugging, preventing abuse. | Our legitimate interest in running a secure service |
| Emails you send us. | Answering you. | Legitimate interest / contract |
We do not put advertising or analytics trackers on our pages, we do not sell data, and we do not profile you. The one exception is described above: if you came from one of our Meta ads, our server tells Meta when you view the home page, click Start, give your email to start a trial, sign in and open checkout (identified only by that click identifier, never by your email), and, once each, that you started a trial and that you paid (identified by that click identifier and a scrambled (hashed) version of our internal account number). No email, no name, no browsing history. The news analysis works on public headlines only: no personal data is sent to the AI model.
Cookies and local storage
Flightdeck sets no advertising or analytics cookies. Signing in stores a session in your browser's local storage (Firebase Authentication); it is strictly necessary to keep you signed in, so it does not require consent. Stripe sets its own cookies on its checkout and billing pages to prevent fraud.
If you turn on notifications, your browser installs a small script from our site (a service worker) whose only job is to show our notifications and open the cockpit when you tap one. It stores nothing about you and does not see the pages you visit. It is needed for the feature you asked for, so it does not require separate consent; turning notifications off in your alert settings or your browser stops it.
Who processes data for us
- Google Cloud / Firebase (Google Ireland Limited): hosting, database, authentication, logs. Data is stored in the United States.
- Stripe (Stripe Payments Europe, Limited, Ireland): payments, invoices, tax calculation, fraud prevention.
- Resend (United States): delivers the emails we send you (the welcome email and sign-in links). It receives your email address and the content of those emails, and nothing else.
- Resend, as above, also delivers the alert emails, the morning brief and the evening recap you turn on.
- Your browser's push service (Google Firebase Cloud Messaging for Chrome, Edge and Android, Apple Push Notification service for Safari, Mozilla Push Service for Firefox, or Microsoft Windows Push Notification Services): delivers notifications to the devices you turned on. Each notification is encrypted for your device, so the push service cannot read it; it sees your device's push address, the time and the size of the message.
- Meta (Meta Platforms Ireland Limited): only for people who arrived from one of our Meta ads, the conversion events described above.
- Binance: when the cockpit is open, your browser connects directly to Binance's public price stream to show live crypto prices, so Binance sees your IP address. No account data is sent.
Some of these providers process data in the United States. Those transfers rely on the EU-US Data Privacy Framework and, where needed, the European Commission's standard contractual clauses.
How long we keep it
- Account, watchlist and onboarding answers: for as long as your account exists, then deleted within 30 days of closure.
- Sign-in links: we keep only a scrambled (hashed) form of each link, deleted automatically once it expires (1 hour, or 7 days for the link in the welcome email).
- Invoices and payment records: 10 years, as French accounting law requires.
- Technical logs: up to 12 months.
- Alert settings: for as long as your account exists. Device push addresses: until you turn notifications off, or the push service tells us the address no longer works. The record of alerts sent: 48 hours; alerts waiting for a grouped email: at most 18 hours.
- Support emails: up to 3 years after our last exchange.
Your rights
You can ask us for a copy of your data, to correct it, delete it, restrict or object to its use, or receive it in a portable format, and you can give instructions about what happens to it after your death. Write to contact@easytech-agency.net: we answer within one month. To delete your account and its data, send that request from the account's email address. If you believe we mishandle your data you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of your country.
Security
Traffic is encrypted (HTTPS only). The cockpit's data and your settings are protected by access rules enforced in the database, payment details never touch our servers, and secrets are kept in a managed secret store.
Children
Flightdeck is for adults. We do not knowingly collect data from anyone under 18.
Changes
If this policy changes in a way that matters, we will tell you by email before it applies.