Fillometry Privacy Policy
Effective date: 18 October 2026 · Applies to: the Fillometry iOS app and this website, fillometry.com.
This policy describes what Fillometry actually does with data — not what a template says an app might do. Where a feature is optional, it says so and tells you where the switch is.
In plain words
- Your journal stays on your phone. Broker statements you import, your trades, notes, tags and prices are stored on your device. We do not upload them and we cannot see them.
- There is no account. You never sign up or log in to use the app.
- Optional usage analytics sends anonymous app events to TelemetryDeck, and subscription checks use Apple and RevenueCat. If you choose to connect eToro, your device requests your history directly from eToro; if you link by signing in with eToro, the sign-in itself passes through a small Fillometry service that keeps nothing (section 3.4). Written insights in the current beta are generated on your device; no trading statistics are sent to an AI service.
- We do not sell data, show advertising, or track you across other apps or websites.
- Fillometry is record-keeping and analytics. It is not investment, financial, tax or legal advice, and it does not execute trades.
1. Who is responsible
The data controller for the app and this website is FireWater S.R.L., Cluj-Napoca, Romania. For anything in this policy, write to info@fillometry.com.
2. What stays on your device
Fillometry is a local-first app. The following is stored only on your device, in the app’s own storage, and is never transmitted to us:
- Broker statements and CSV files you choose to import, and the trades and executions read from them.
- Trades you enter by hand.
- Your notes, setup tags and planned risk on any trade.
- Prices you enter for open positions.
- Import history, saved CSV column mappings, your journal’s base currency and app settings.
- If you connect an eToro account (optional): the API keys you enter or, if you sign in with eToro, the sign-in tokens eToro issues, stored in the iOS Keychain on this device only, marked as non-synchronising, so they are not copied to iCloud or other devices.
- A random identifier the app generates for anonymous analytics (see section 3.2), and a record of which one-time in-app milestones have already been counted.
You control this data completely. You can export an exact copy of your journal from the app at any time. Deleting the app deletes everything above, including the analytics identifier. Your own device backups (iCloud or computer) may include the app’s data under Apple’s backup terms, which you control in iOS settings.
3. What leaves your device, and why
3.1 Written insights in the current beta
Fillometry shows observations about your past trading using on-device calculations. The current beta has no remote insights service configured. Your trading statistics are not sent to Fillometry servers or Anthropic to produce these observations, including when the “Allow AI-written insights” setting is on. The observations remain available offline.
Before enabling a remote insights service in a future version, we will update this policy and explain the data involved and your choices in the app.
3.2 Anonymous usage analytics (optional)
To learn which parts of the app are actually used, the app sends anonymous usage events to TelemetryDeck, an analytics service based in Germany whose servers are in the European Union.
What is sent: the name of an event from a fixed list (for example “an import completed” or “a breakdown was opened”), with coarse categories where relevant (for example the kind of breakdown, or a trade-count band such as “10 to 49”); your app version and build, iOS version, device model, language, and whether the build came from TestFlight or the App Store; and a random identifier created by the app on first launch. That identifier is not your Apple ID, not the advertising identifier, and not tied to anything else; the analytics library hashes it before sending, and deleting the app ends it.
What is never sent: ticker symbols, amounts, profit or loss, notes, tag names, file names, broker names, purchase details, or any personal identifier. The app’s event model cannot express these values, so they cannot be sent even by mistake.
Apple’s App Store privacy label describes this as “Product Interaction” and “Device ID”, used for analytics, not linked to your identity, and not used for tracking. We do not use App Tracking Transparency because no tracking takes place.
Your control: Settings → Privacy & intelligence → Share anonymous app usage. It is on by default during the beta. When off, nothing further is sent — not even an “opted out” event.
Lawful basis: our legitimate interest (Art. 6(1)(f)) in understanding whether the app works for the people using it, balanced by the minimal, anonymous data involved and an in-app switch to stop it at any time.
3.3 Subscriptions
Paid features are sold as subscriptions through Apple’s App Store. Apple handles payment; we never see your card, billing address or Apple ID. To know whether a subscription is active, the app uses RevenueCat, which receives the App Store purchase receipt and an anonymous app-user identifier it generates, and keeps a record of your subscription status and purchase history. Apple’s privacy label lists this as “Purchase History”, used for app functionality and analytics, not linked to your identity.
Lawful basis: performance of a contract (Art. 6(1)(b)) — checking that a subscription you bought is active.
3.4 Connecting an eToro account (optional)
If you choose to connect an eToro account, the app requests your closed trading history directly from eToro’s servers, from your device, over HTTPS. This traffic goes between your phone and eToro; it does not pass through us. The app can only read history; it cannot place, change or close trades. eToro’s handling of your account is governed by eToro’s own privacy policy. You can link your account in one of two ways:
- With API keys. The keys you enter are stored only in your device’s Keychain (see section 2) and are deleted when you disconnect.
- By signing in with eToro. You sign in on eToro’s own page, so your eToro password never reaches us. eToro then issues the app sign-in tokens, which are stored only in your device’s Keychain (see section 2). eToro’s sign-in requires Fillometry to present a credential of its own, which cannot be kept safely inside a phone app, so three requests pass through a small Fillometry service hosted by Cloudflare: exchanging the one-time sign-in code for tokens, renewing them, and ending the sign-in. The service adds Fillometry’s credential, passes each request to eToro and eToro’s answer back to your phone, and stores and logs nothing. When you disconnect, the app deletes the tokens and asks eToro to end the sign-in.
Lawful basis: consent, given when you connect and withdrawn when you disconnect.
3.5 Beta feedback (optional)
During the beta the app offers a feedback button. It opens your own email app with a draft addressed to us; nothing is sent unless you send it. The draft includes the app version, iOS version, device family (for example “iPhone”) and whether the build is from TestFlight — shown to you before sending. It never includes your journal, statements or the anonymous analytics identifier. Whatever you write, and your email address, reach us as ordinary email and are kept for as long as needed to act on the feedback and for the duration of the beta.
Lawful basis: our legitimate interest in fixing problems you report, and your choice to send the message.
4. This website
Early-access list. If you enter your email on fillometry.com, we store the address, the time you submitted it and the fact that you ticked the consent box, in our website’s database. We use it for one purpose: to tell you about the private beta and early access. We do not add you to any other list or share the address. You can ask to be removed at any time by writing to the address in section 1, and we will delete the entry. Entries are kept until you ask us to remove you or until 12 months after the beta list closes, whichever is sooner. Lawful basis: consent (Art. 6(1)(a)).
Cookies. This site sets no analytics, advertising or tracking cookies and uses no tracking pixels. The site is served through Cloudflare, which may set strictly necessary security cookies to protect the site from automated abuse; these do not require consent under the ePrivacy rules.
Hosting and server logs. The site is hosted by Bluehost (Newfold Digital) in the United States and delivered through Cloudflare. Like any web server, they may record your IP address, browser type and the pages requested in short-term technical logs for security and operation. We do not use these logs to identify visitors.
5. Who processes data on our behalf
| Provider | What for | What they receive | Where |
|---|---|---|---|
| TelemetryDeck GmbH | Anonymous usage analytics (3.2) | Event names, app/device metadata, hashed random identifier | Germany (EU) |
| RevenueCat, Inc. | Subscription status (3.3) | App Store receipt, anonymous app-user ID, purchase history | United States |
| Apple Inc. | App distribution, payment, TestFlight | Purchase and App Store data under Apple’s own terms | Ireland / United States |
| Bluehost (Newfold Digital) and Cloudflare, Inc. | Hosting and delivering this website (4) | Early-access signups (Bluehost); connection data and security cookies (Cloudflare) | United States (Cloudflare also operates EU data centres) |
| Cloudflare, Inc. | Our eToro sign-in service (3.4) | The one-time sign-in code and sign-in tokens, with your IP address, which our service passes to eToro and does not keep | United States (Cloudflare also operates EU data centres) |
eToro is not our processor: if you connect an account, your device talks to eToro directly on your instruction, and our sign-in service only relays the sign-in to eToro.
6. Transfers outside the EU
RevenueCat, Bluehost and Cloudflare are based in the United States. Transfers to them rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses included in each provider’s data processing terms. The data involved is minimal by design — see the table above — and in the case of analytics contains no identifier that could be linked back to you.
7. How long we keep things
- Your journal: on your device, for as long as you keep it. Deleting the app deletes it.
- Written insights: generated on your device in the current beta; no remote insights requests are sent.
- eToro sign-in: our sign-in service keeps none of what passes through it; each request is passed to eToro and its answer back to your phone as it happens.
- Usage analytics: held by TelemetryDeck as anonymous aggregate statistics; the identifier cannot be traced back to you and ends when you delete the app.
- Subscription records: held by RevenueCat and Apple for the life of the subscription and as long as required for accounting and consumer-law purposes.
- Beta feedback emails: for the duration of the beta and as long as needed to act on them.
- Early-access signups: until you ask to be removed, or 12 months after the beta list closes.
8. Your rights
Under the GDPR you can ask us to access, correct, delete or export the personal data we hold about you, to restrict or object to its processing, and you can withdraw any consent at any time. Because your journal lives on your device and we hold no account for you, most of these you can do yourself in the app — export it, edit it, or delete the app. For the early-access list and feedback emails, write to info@fillometry.com from the address concerned and we will act within one month.
You also have the right to complain to a supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may instead contact the authority in your own EU country.
9. Children
Fillometry is a tool for people who trade and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Security
Everything the app sends travels over HTTPS. Broker API keys and sign-in tokens live only in the iOS Keychain. The app never embeds server secrets; Fillometry’s eToro credential is held by our sign-in service, never in the app. Remote insights are disabled in the current beta. Because your journal is never uploaded, the most important safeguard is your own device: use a passcode and keep iOS up to date.
11. Not advice
Fillometry records and analyses your own past trades. Nothing in the app, in its written insights, or on this website is investment, financial, tax or legal advice, or a recommendation to buy or sell anything. The app does not execute trades or place orders with any broker. Past performance is not an indication of future results.
12. Changes to this policy
If we change what the app or website does with data, we will update this page and the effective date at the top. For a change that matters to you — a new kind of data, a new purpose, or a new provider — we will also say so inside the app before it takes effect. The current version is always at fillometry.com/privacy.
13. Contact
FireWater S.R.L. · Cluj-Napoca, Romania · info@fillometry.com