Privacy
What is stored, why, who else is involved and how to get rid of it.
Who is responsible
- Controller
- Ferran Martínez Casellas, who develops and runs Arvenyx.
- Contact
- info@arvenyx.es
- Where the data lives
- On a Hetzner Online server in Helsinki (Finland), inside the European Union.
What is stored
- Your account
- Email, name and password, of which only a hash is kept, and whether you've confirmed the email. If you turn on two-step verification, its secret, encrypted.
- Your portfolio
- Positions, trades, risk limits, price alerts, notes, wallet addresses, suitability test answers, scripts, chart drawings and symbol lists. It is the product: without it there is nothing to calculate.
- Exchange keys
- If you connect an exchange, its API key, encrypted with a key kept outside the database. We recommend read-only keys: withdrawal permission is never needed.
- Settings
- Language, currency, theme and, if you add one, your Telegram bot token.
- Sign-up form and iPhone beta
- Name, email, intended use, message, language and IP address, the latter to prevent abuse of the form. They are deleted with the account.
- Server logs
- The web server records the IP address of each request, for security (detecting and stopping attacks and abuse). The logs are deleted after 14 days at most.
- Device notifications
- If you turn them on, the notification address of your browser or iPhone.
- App usage
- Which screens are opened and which errors happen, counted per day. No IP address, no name and no external analytics service.
- Feedback
- The text you send us with the Feedback button, and the screenshot if you add one.
- Cookies
- Just one: the session cookie, signed, to know it is you. It is strictly necessary to sign in. No analytics, advertising or third-party cookies.
What is NOT done
- Your data is not sold or handed over, nor aggregated to be resold.
- There is no advertising, no pixels, no Google Analytics and no browser fingerprinting.
- No broker password and no wallet private key or recovery phrase is ever stored.
- Files you upload to import are read and not kept.
Who else is involved
- Prices and public data: the server requests them from Yahoo Finance, the SEC, the US House of Representatives, ForexFactory, CoinGecko, DexScreener, GeckoTerminal and the exchanges, by symbol or document, never by your name.
- Live prices: the website and the apps connect directly to the public market-data streams of Binance, Bybit, OKX, Coinbase, MEXC, Gate, Bitvavo, Bitget and Yahoo, which see your IP address like any website you visit.
- Wallets: the server looks up the public addresses you add on the blockchains' public APIs (blockstream.info, mempool.space and publicnode) to get their balance.
- Importing a screenshot: if you use this feature, the image is sent to Anthropic (Claude) to read the positions.
- Funds that match your profile: when AI is available, the public data of the funds that pass the filter and your profile level (1 to 7) are sent to Anthropic (Claude), with no personal or portfolio data.
- Notifications: they are delivered by Apple (on iPhone) or by your browser's service. The message only says an alert went off, not which asset or price.
- Telegram: if you turn on Telegram alerts, the messages go through it.
- Webhook: if you set one, each alert (symbol, price and note) is sent to the address you choose.
- Sign-ups and feedback: when you sign up, your name, email, intended use and message reach the controller by Telegram and email; feedback, by Telegram.
- Confirmation email: the link to confirm your email is sent from the arvenyx.es mailbox, hosted by SW Hosting (Spain).
- iPhone beta: TestFlight is an Apple service with its own privacy policy.
Why and for how long
Your account and portfolio are processed to provide the service you ask for when you sign up and accept the terms (performance of a contract, Article 6(1)(b) GDPR), and kept until you delete the account. An account that isn't confirmed within 7 days deletes itself, along with the sign-up form data.
App usage, errors, server logs and the sign-up form's IP address are processed on the basis of legitimate interest (keeping it working, secure and free of abuse; Article 6(1)(f) GDPR). Usage and errors are deleted after 400 days; server logs after 14 days at most. Feedback and the sign-up form data are kept until you delete the account. Notifications and Telegram only if you turn them on (consent, Article 6(1)(a) GDPR), and you can turn them off whenever you like.
Every day an encrypted backup of the data is made; it is kept for 14 days and then deleted.
Your rights
You can delete your account yourself, from Settings › Account, on the web and in the app: it is deleted straight away, along with your portfolio, connections and keys. From the same place on the web you can download all your data in a file (“Download your data”).
You can request access to, correction, deletion and portability of your data, and object to its processing, by writing to info@arvenyx.es. Delete means delete: no copy is kept just in case, and the backups that still contain it are gone within 14 days at most.
If you believe they are not handled properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Last updated: 18 October 2026.