Privacy Policy

1. Controller

Maximilian Hues, Kümmellstraße, 20249 Hamburg, Germany. Contact: info@casepit.com. See the Imprint.

2. What we process

• Account data — email address, username, name, country, optional phone number and birthday, join date, avatar.
• Content you create — posts, comments, votes, polls, messages, communities you join, people you follow, watchlists, and reports you file.
• Private messages — stored on our database so they can be delivered and shown to both participants. They are not end-to-end encrypted, so we could technically access them; we do not read them, and they are never sent to any third-party service for analysis — the only automatic check runs on your device against a word list. Both participants can report a conversation.
• Portfolio data you choose to add— verified positions and trades. Positions you set to “public” are visible to other members; private ones are not. If you verify a trade with a brokerage screenshot, the screenshot is analyzed automatically and is not stored — only the extracted trade details (symbol, side, price, date) are kept.
• Subscription data— if you buy CasePit Pro, whether your account is entitled to it, and the subscription’s status. Card details never reach us: on the website they are handled by Stripe, in the iOS app by Apple.
• Push tokens — if you turn on notifications, the push token your device issues, its platform, and which filers you asked to be alerted about, so the alert can be delivered.
• Technical data — the data our hosting and infrastructure providers process to deliver the service (IP address, device information, timestamps).

3. Why, and on what legal basis

• To provide the service you signed up for — accounts, feeds, communities, messaging, verification (Art. 6 (1) (b) GDPR).
• To keep the platform safe and lawful — moderation, report handling, abuse prevention (Art. 6 (1) (b) and (f) GDPR; where applicable, (c)).
• Anything based on consent, such as optional features you explicitly enable, can be withdrawn at any time (Art. 6 (1) (a) GDPR).

4. Processors and recipients

• Google Firebase (Google Ireland Ltd.) — authentication, database, and file storage.
• Google Gemini via Firebase AI Logic (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) — three automated uses: analysis of a brokerage screenshot you submit for trade verification (the image is sent once and not stored by us); generation of AI summaries from public market data (no personal data is sent); and a second-stage check of a post or comment that our on-device filter has flagged as possibly hateful or harassing (only the flagged text is sent, without your name or account). The Gemini API has two service tiers with different data terms: on the paid tier Google does not use inputs to improve its models and retains them only transiently for abuse prevention; on the unpaid tier Google may use inputs and outputs to improve its products, including human review. We state which tier this service runs on here, and update this paragraph when it changes: currently the unpaid tier. Until we move to the paid tier, do not include anything in a post, comment or screenshot you would not want reviewed by Google. Legal basis: Art. 6 (1) (b) GDPR for verification and summaries you request, Art. 6 (1) (f) for moderation (keeping the community safe).
• Vercel (Vercel Inc.) — hosting of this website. Vercel processes your IP address to deliver pages; its cookieless page-view and performance statistics run only after you have consented in the privacy settings.
• Render (Render Services, Inc., 525 Brannan Street, San Francisco, CA 94107, USA) — hosting of our market-data backend. It receives the ticker symbols you look up and your IP address in order to answer; it does not receive your account.
• Stripe (Stripe Payments Europe Ltd.) — payment processing and subscription management for CasePit Pro bought on this website. Stripe is the controller for the payment data it collects and holds it under its own privacy policy; we receive only your subscription status.
• Apple — CasePit Pro bought inside the iOS app is an App Store purchase. Apple is your contractual partner for it and processes the payment under its own terms; we learn only that your account is entitled to Pro.
• Firebase Cloud Messaging and Apple Push Notification service — delivery of the push notifications you enable.
• Market data and media providers — stock quotes and news are fetched from third parties, and GIF search is provided by GIPHY (Giphy, Inc., a Meta Platforms company, USA — certified under the EU–U.S. Data Privacy Framework); your search terms reach those providers.

Transfers outside the EU

Google Ireland Ltd. and Stripe Payments Europe Ltd. are our contractual partners in the EU; where they route processing to affiliates in the United States, it is covered by their EU–U.S. Data Privacy Framework certification (Google LLC, Stripe Inc.) and, as a fallback, the EU standard contractual clauses they incorporate into their data processing terms. Vercel Inc. is a U.S. company certified under the EU–U.S. Data Privacy Framework; its data processing addendum, which we have accepted, additionally incorporates the standard contractual clauses. Render Services, Inc. is a U.S. company whose data processing addendum, which we have accepted, relies on the EU standard contractual clauses (Art. 46 (2) (c) GDPR). Copies of the clauses are available from the providers or from us on request.

5. Advertising

Parts of the service carry promotional slots, always labelled as such. They come in two kinds, and only one of them involves anyone else.

• Our own promotions — cards advertising CasePit Pro or our own communities. They are ordinary parts of the page: no cookies, no tracking, no third party, and nothing about you is used to select them.
• Third-party advertising — if and when we show it, it is delivered by Google (AdSense), which sets cookies or comparable identifiers on your device and receives your IP address and interaction data as an independent controller. This happens only if you consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), asked through a consent manager before anything loads. Decline, or simply never answer, and no advertising code is loaded at all — you keep seeing our own promotions instead.

You can withdraw consent at any time with effect for the future, through the same consent manager. CasePit Pro removes every promotional slot, ours included.

6. How long we keep data

• Account and content — until you delete them or your account. Deleting your account removes your profile, your public profile page, your posts and comments, your votes, your watchlists, your positions, your conversations, and your push tokens.
• Reports and moderation decisions — six months after the decision, which is the period in which the decision can be appealed. Where a report concerns suspected market abuse we may keep it longer if the law requires us to.
• Push tokens — until you turn notifications off, sign out, or the token stops being valid.
• Billing records — accounting records relating to a Pro subscription are subject to statutory retention periods under German commercial and tax law (up to ten years, § 147 AO, § 257 HGB) and are held for that period by us and by the payment provider.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR). Where processing rests on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR) — that does not affect processing carried out before the withdrawal. You also have the right to lodge a complaint with a data-protection supervisory authority. To exercise your rights, contact info@casepit.com.

8. No automated decision-making

We do not make automated decisions about you that have legal or similarly significant effects. Scores and badges shown in the app describe stocks and content, not creditworthiness or your person. Moderation decisions — removing content, restricting an account — are taken by a person, and the notice you receive about one states whether any automated means were used in detecting the content.