Privacy Policy

1. Controller

[Full legal name of the operator], [Street and house number], [Postal code and city], Germany. Contact: [contact email address]. See the Imprint.

2. What we process

• Account data — email address, username, name, country, optional phone number and birthday, join date, avatar.
• Content you create — posts, comments, votes, polls, messages, communities you join, people you follow, watchlists, and reports you file.
• Portfolio data you choose to add— verified positions and trades. Positions you set to “public” are visible to other members; private ones are not. If you verify a trade with a brokerage screenshot, the screenshot is analyzed automatically and is not stored — only the extracted trade details (symbol, side, price, date) are kept.
• Subscription data— if you buy CasePit Pro, whether your account is entitled to it, and the subscription’s status. Card details never reach us: on the website they are handled by Stripe, in the iOS app by Apple.
• Push tokens — if you turn on notifications, the push token your device issues, its platform, and which filers you asked to be alerted about, so the alert can be delivered.
• Technical data — the data our hosting and infrastructure providers process to deliver the service (IP address, device information, timestamps).

3. Why, and on what legal basis

• To provide the service you signed up for — accounts, feeds, communities, messaging, verification (Art. 6 (1) (b) GDPR).
• To keep the platform safe and lawful — moderation, report handling, abuse prevention (Art. 6 (1) (b) and (f) GDPR; where applicable, (c)).
• Anything based on consent, such as optional features you explicitly enable, can be withdrawn at any time (Art. 6 (1) (a) GDPR).

4. Processors and recipients

• Google Firebase (Google Ireland Ltd.) — authentication, database, and file storage.
• Google Gemini API — automated analysis of brokerage screenshots you submit for trade verification, and generation of AI summaries from public market data.
• Render — hosting of our market-data backend.
• Stripe (Stripe Payments Europe Ltd.) — payment processing and subscription management for CasePit Pro bought on this website. Stripe is the controller for the payment data it collects and holds it under its own privacy policy; we receive only your subscription status.
• Apple — CasePit Pro bought inside the iOS app is an App Store purchase. Apple is your contractual partner for it and processes the payment under its own terms; we learn only that your account is entitled to Pro.
• Firebase Cloud Messaging and Apple Push Notification service — delivery of the push notifications you enable.
• Market data and media providers — stock quotes, news, and GIF search (Tenor) are fetched from third parties; your search terms reach those providers.

Some providers process data in the United States. Transfers rely on the EU–U.S. Data Privacy Framework and/or EU standard contractual clauses.

5. Advertising

Parts of the service carry promotional slots, always labelled as such. They come in two kinds, and only one of them involves anyone else.

• Our own promotions — cards advertising CasePit Pro or our own communities. They are ordinary parts of the page: no cookies, no tracking, no third party, and nothing about you is used to select them.
• Third-party advertising — if and when we show it, it is delivered by Google (AdSense), which sets cookies or comparable identifiers on your device and receives your IP address and interaction data as an independent controller. This happens only if you consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), asked through a consent manager before anything loads. Decline, or simply never answer, and no advertising code is loaded at all — you keep seeing our own promotions instead.

You can withdraw consent at any time with effect for the future, through the same consent manager. CasePit Pro removes every promotional slot, ours included.

6. How long we keep data

• Account and content — until you delete them or your account. Deleting your account removes your profile, your public profile page, your posts and comments, your votes, your watchlists, your positions, your conversations, and your push tokens.
• Reports and moderation decisions — six months after the decision, which is the period in which the decision can be appealed. Where a report concerns suspected market abuse we may keep it longer if the law requires us to.
• Push tokens — until you turn notifications off, sign out, or the token stops being valid.
• Billing records — accounting records relating to a Pro subscription are subject to statutory retention periods under German commercial and tax law (up to ten years, § 147 AO, § 257 HGB) and are held for that period by us and by the payment provider.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR). Where processing rests on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR) — that does not affect processing carried out before the withdrawal. You also have the right to lodge a complaint with a data-protection supervisory authority. To exercise your rights, contact [contact email address].

8. No automated decision-making

We do not make automated decisions about you that have legal or similarly significant effects. Scores and badges shown in the app describe stocks and content, not creditworthiness or your person. Moderation decisions — removing content, restricting an account — are taken by a person, and the notice you receive about one states whether any automated means were used in detecting the content.