Fillometry Privacy Policy
Effective date: 14 September 2026 · Applies to: the Fillometry iOS app and this website, fillometry.com.
This policy describes what Fillometry actually does with data — not what a template says an app might do. Where a feature is optional, it says so and tells you where the switch is.
In plain words
- Your journal stays on your phone. Broker statements you import, your trades, notes, tags and prices are stored on your device. We do not upload them and we cannot see them.
- There is no account. You never sign up or log in to use the app.
- Three optional features contact a server, and each sends only what it needs: written insights (aggregated statistics about your closed trades), anonymous usage analytics (which screens were reached — never what was in them), and subscriptions (handled by Apple).
- We do not sell data, show advertising, or track you across other apps or websites.
- Fillometry is record-keeping and analytics. It is not investment, financial, tax or legal advice, and it does not execute trades.
1. Who is responsible
The data controller for the app and this website is FireWater S.R.L., Cluj-Napoca, Romania. For anything in this policy, write to [email protected].
2. What stays on your device
Fillometry is a local-first app. The following is stored only on your device, in the app’s own storage, and is never transmitted to us:
- Broker statements and CSV files you choose to import, and the trades and executions read from them.
- Trades you enter by hand.
- Your notes, setup tags and planned risk on any trade.
- Prices you enter for open positions.
- Import history, saved CSV column mappings, your journal’s base currency and app settings.
- If you connect an eToro account (optional): the API keys you enter, stored in the iOS Keychain on this device only, marked as non-synchronising, so they are not copied to iCloud or other devices.
- A random identifier the app generates for anonymous analytics (see section 3.2), and a record of which one-time in-app milestones have already been counted.
You control this data completely. You can export an exact copy of your journal from the app at any time. Deleting the app deletes everything above, including the analytics identifier. Your own device backups (iCloud or computer) may include the app’s data under Apple’s backup terms, which you control in iOS settings.
3. What leaves your device, and why
3.1 Written insights (optional)
The app can show short written observations about your own past trading. To produce them it sends a small set of aggregated statistics about your closed trades over an encrypted connection (HTTPS) to our insights service, which uses the Anthropic API to phrase the observations.
What is sent: the number of closed trades, win rate, expectancy, profit factor and maximum drawdown, and the same figures broken down by ticker symbol, weekday and trading session, together with your journal’s currency code.
What is never sent: individual trades or fills, quantities, prices, dates, fees, your notes or tags, account numbers, broker names, your name, email, device identifiers, or any other identifier. The request carries no account or user ID because there is none.
Storage: the statistics are processed to generate the response and are not stored as a record of your trading. Our service and Anthropic’s API may keep ordinary short-term technical logs (such as the requesting IP address, used to limit abuse) for no longer than 30 days. Anthropic does not use data sent through its API to train its models.
Your control: Settings → Privacy & intelligence → Allow AI-written insights. It is on by default; when off, the app produces the same observations on the device and nothing is sent.
Lawful basis: consent (GDPR Art. 6(1)(a)), which you give by leaving the setting on and withdraw by turning it off. Withdrawing does not affect the app in any other way.
3.2 Anonymous usage analytics (optional)
To learn which parts of the app are actually used, the app sends anonymous usage events to TelemetryDeck, an analytics service based in Germany whose servers are in the European Union.
What is sent: the name of an event from a fixed list (for example “an import completed” or “a breakdown was opened”), with coarse categories where relevant (for example the kind of breakdown, or a trade-count band such as “10 to 49”); your app version and build, iOS version, device model, language, and whether the build came from TestFlight or the App Store; and a random identifier created by the app on first launch. That identifier is not your Apple ID, not the advertising identifier, and not tied to anything else; the analytics library hashes it before sending, and deleting the app ends it.
What is never sent: ticker symbols, amounts, profit or loss, notes, tag names, file names, broker names, purchase details, or any personal identifier. The app’s event model cannot express these values, so they cannot be sent even by mistake.
Apple’s App Store privacy label describes this as “Product Interaction” and “Device ID”, used for analytics, not linked to your identity, and not used for tracking. We do not use App Tracking Transparency because no tracking takes place.
Your control: Settings → Privacy & intelligence → Share anonymous app usage. It is on by default during the beta. When off, nothing further is sent — not even an “opted out” event.
Lawful basis: our legitimate interest (Art. 6(1)(f)) in understanding whether the app works for the people using it, balanced by the minimal, anonymous data involved and an in-app switch to stop it at any time.
3.3 Subscriptions
Paid features are sold as subscriptions through Apple’s App Store. Apple handles payment; we never see your card, billing address or Apple ID. To know whether a subscription is active, the app uses RevenueCat, which receives the App Store purchase receipt and an anonymous app-user identifier it generates, and keeps a record of your subscription status and purchase history. Apple’s privacy label lists this as “Purchase History”, used for app functionality and analytics, not linked to your identity.
Lawful basis: performance of a contract (Art. 6(1)(b)) — checking that a subscription you bought is active.
3.4 Connecting an eToro account (optional)
If you choose to connect an eToro account, the app uses the API keys you enter to request your closed trading history directly from eToro’s servers, from your device, over HTTPS. This traffic goes between your phone and eToro; it does not pass through us. The keys are stored only in your device’s Keychain (see section 2) and are deleted when you disconnect. The app can only read history; it cannot place, change or close trades. eToro’s handling of your account is governed by eToro’s own privacy policy.
Lawful basis: consent, given when you connect and withdrawn when you disconnect.
3.5 Beta feedback (optional)
During the beta the app offers a feedback button. It opens your own email app with a draft addressed to us; nothing is sent unless you send it. The draft includes the app version, iOS version, device family (for example “iPhone”) and whether the build is from TestFlight — shown to you before sending. It never includes your journal, statements or the anonymous analytics identifier. Whatever you write, and your email address, reach us as ordinary email and are kept for as long as needed to act on the feedback and for the duration of the beta.
Lawful basis: our legitimate interest in fixing problems you report, and your choice to send the message.
4. This website
Early-access list. If you enter your email on fillometry.com, we store the address, the time you submitted it and the fact that you ticked the consent box, in our website’s database. We use it for one purpose: to tell you about the private beta and early access. We do not add you to any other list or share the address. You can ask to be removed at any time by writing to the address in section 1, and we will delete the entry. Entries are kept until you ask us to remove you or until 12 months after the beta list closes, whichever is sooner. Lawful basis: consent (Art. 6(1)(a)).
Cookies. This site sets no analytics, advertising or tracking cookies and uses no tracking pixels. The site is served through Cloudflare, which may set strictly necessary security cookies to protect the site from automated abuse; these do not require consent under the ePrivacy rules.
Hosting and server logs. The site is hosted by Bluehost (Newfold Digital) in the United States and delivered through Cloudflare. Like any web server, they may record your IP address, browser type and the pages requested in short-term technical logs for security and operation. We do not use these logs to identify visitors.
5. Who processes data on our behalf
| Provider | What for | What they receive | Where |
|---|---|---|---|
| Anthropic, PBC | Phrasing written insights (section 3.1) | Aggregated trading statistics; no identifiers | United States |
| TelemetryDeck GmbH | Anonymous usage analytics (3.2) | Event names, app/device metadata, hashed random identifier | Germany (EU) |
| RevenueCat, Inc. | Subscription status (3.3) | App Store receipt, anonymous app-user ID, purchase history | United States |
| Apple Inc. | App distribution, payment, TestFlight | Purchase and App Store data under Apple’s own terms | Ireland / United States |
| Bluehost (Newfold Digital) and Cloudflare, Inc. | Hosting and delivering this website (4) | Early-access signups (Bluehost); connection data and security cookies (Cloudflare) | United States (Cloudflare also operates EU data centres) |
eToro is not our processor: if you connect an account, your device talks to eToro directly on your instruction.
6. Transfers outside the EU
Anthropic, RevenueCat, Bluehost and Cloudflare are based in the United States. Transfers to them rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses included in each provider’s data processing terms. The data involved is minimal by design — see the table above — and in the case of insights and analytics contains no identifier that could be linked back to you.
7. How long we keep things
- Your journal: on your device, for as long as you keep it. Deleting the app deletes it.
- Insights requests: not stored as a record; short-term technical logs only (section 3.1).
- Usage analytics: held by TelemetryDeck as anonymous aggregate statistics; the identifier cannot be traced back to you and ends when you delete the app.
- Subscription records: held by RevenueCat and Apple for the life of the subscription and as long as required for accounting and consumer-law purposes.
- Beta feedback emails: for the duration of the beta and as long as needed to act on them.
- Early-access signups: until you ask to be removed, or 12 months after the beta list closes.
8. Your rights
Under the GDPR you can ask us to access, correct, delete or export the personal data we hold about you, to restrict or object to its processing, and you can withdraw any consent at any time. Because your journal lives on your device and we hold no account for you, most of these you can do yourself in the app — export it, edit it, or delete the app. For the early-access list and feedback emails, write to [email protected] from the address concerned and we will act within one month.
You also have the right to complain to a supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may instead contact the authority in your own EU country.
9. Children
Fillometry is a tool for people who trade and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Security
Everything the app sends travels over HTTPS. Broker API keys live only in the iOS Keychain. The app never embeds server secrets, and the insights service accepts only the aggregated fields described above. Because your journal is never uploaded, the most important safeguard is your own device: use a passcode and keep iOS up to date.
11. Not advice
Fillometry records and analyses your own past trades. Nothing in the app, in its written insights, or on this website is investment, financial, tax or legal advice, or a recommendation to buy or sell anything. The app does not execute trades or place orders with any broker. Past performance is not an indication of future results.
12. Changes to this policy
If we change what the app or website does with data, we will update this page and the effective date at the top. For a change that matters to you — a new kind of data, a new purpose, or a new provider — we will also say so inside the app before it takes effect. The current version is always at fillometry.com/privacy.
13. Contact
FireWater S.R.L. · Cluj-Napoca, Romania · [email protected]