SafuTrading · Crypto Whales Sonar
Crypto Whales Sonar — Privacy Policy
The app and this policy
Effective 8 September 2026; last updated 15 October 2026. Crypto Whales Sonar (formerly Whale Sonar and Follow the Whales; Google Play package com.whalesonar.app) is a mobile market analytics app published on Google Play by MB "Makery" (company code 307770736, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania). MB "Makery" also runs the app's service under the SafuTrading name at safutrading.com and is the controller for the personal data described in this policy. This policy covers the app and its mobile API, including review builds. The SafuTrading website has a separate privacy and cookie policy.
Contact the publisher at support@developers911.com, the privacy team at legal@safutrading.com or app support at support@safutrading.com. The app provides market information, not a wallet or exchange: it does not ask for wallet seed phrases, hold your crypto, execute trades or mine crypto on your device.
Account and authentication data
If you sign in with email, we process your email address, a verification-code hash, expiry and attempt records, and a security hash derived from your IP address for rate limiting. The code is sent through Resend. Codes expire after 10 minutes; expiration is not the same as deletion of the related security record.
Where Google or Apple sign-in is enabled, we receive the provider identifier and verified email information needed to authenticate you. We do not receive your Google or Apple password. Sign-in availability can differ between app builds.
We store a mobile account identifier, a random billing identifier, account email and any existing account display name, session hashes and session timestamps. The session token is held using the phone’s secure storage. Server sessions expire after 30 days unless ended earlier. Signing out ends the current app session; it does not delete your account.
Alerts, device details and local storage
When you enable notifications, we process your Expo push token, device platform, device name or model, app version, alert selections and alert delivery/history records. Expo and Firebase Cloud Messaging help deliver Android notifications. Notification permission is optional and can be changed in the phone’s settings. You can mute alerts or unregister this phone through the app.
Onboarding progress, interface preferences and related local state are stored on the device. Secure session tokens use secure storage; preferences use app storage. This native storage is not permission for advertising tracking.
API requests expose technical information such as IP address and request timestamps to our hosting infrastructure. We use technical and error records to protect the service and diagnose failures. We do not request precise location, contacts, photos, microphone access or wallet private keys for chart viewing.
Subscriptions and purchase information
When store billing is enabled, Google Play processes Android payments. We do not receive the full payment card details entered into Google Play. We receive information needed to verify and restore access, including product and plan identifiers, store or transaction references, purchase status, renewal/expiry information and entitlement events.
Configured production builds use Superwall to display subscription offers and coordinate purchases. The app sends it a random billing user ID and membership attributes. Its SDK also processes device/app, paywall interaction and transaction information. Superwall also works out your approximate location (country, region, city and time zone) from your device's IP address; the app never asks for location permission and does not use GPS. We use this approximate location only for statistics about where the membership offer is seen and bought, not for advertising. Review builds with billing disabled do not start a purchase or the yearly plan's free trial.
Why we use data and who receives it
When you agree to the Terms in the app, we record which version you agreed to and when, the app's random install number, the app version and your IP address in scrambled form; once you sign in, the same version and time are stored on your account. To limit how often an action can be repeated (for example asking for sign-in codes), we keep counters next to a scrambled form of your IP address, email or install number.
We use data to authenticate accounts, provide charts and alerts, manage subscriptions, restore purchases, respond to support and deletion requests, prevent abuse and meet legal obligations. Essential account processing supports the service you request; security processing supports our legitimate interest in protecting it. Where consent is required for optional processing, we ask before that processing begins and allow withdrawal.
Relevant providers include hosting and database infrastructure, Resend for authentication email, Expo/Firebase for app infrastructure and notification delivery, Google Play for Android billing, enabled sign-in providers, and Superwall for configured subscription flows. They receive the data needed for their respective functions. Support correspondence is processed through our support email service. We may disclose limited information where legally required or necessary to address fraud or security incidents.
We do not sell personal information or use the app to serve targeted advertising. Providers may process data outside your country. Where data protection law requires safeguards for international transfers, those safeguards apply to the relevant provider arrangement.
How long we keep data
These are the periods our systems actually apply. Where nothing deletes a record automatically, we say so. You can ask legal@safutrading.com to delete such a record; we will, unless we must keep it (for example a purchase record needed for tax), and then we tell you why.
Your account: your email address, any display name and the dates you joined and last signed in are kept while the account exists. We do not delete inactive accounts automatically.
Email sign-in codes: a code works once, expires after 10 minutes and stops working after 5 wrong tries. The record of each code we send (your email address, the code and your IP address in scrambled form, the number of tries and the times) is not deleted automatically, not when the code expires and not when you delete your account. Deleting your account makes any unused code stop working at once.
Google and Apple sign-in: each attempt uses a one-time check that expires after 5 minutes. It holds no email address, only your IP address in scrambled form, and it is deleted automatically the next time anyone starts a Google or Apple sign-in after it has been expired for 1 day. The link between your Google or Apple account and your app account is kept while your account exists.
App sessions: signing in keeps you signed in on that phone for 30 days from sign-in; using the app does not extend it. Signing out ends the session at once and deletes its record. A session that runs out is not deleted automatically: its record (a scrambled copy of the session key and when it was created, last used and ends) stays until you delete the account.
Phone notifications: when you turn on phone alerts, we keep this phone's push token, platform, device name and app version. The record is deleted when you turn phone alerts off in the app, when you sign out on that phone, when Expo, our notification service, reports that the phone no longer accepts our notifications (for example after the app is removed; we learn this the next time we send an alert), or when you delete the account. Removal at sign-out needs the app update that sends this phone's token when you sign out; until your app has it, turn phone alerts off before signing out.
Terms agreements: kept as our proof that you agreed. They are not deleted automatically, and deleting your account does not delete them.
Limits against bots: each counter is deleted automatically once its counting window has been over for 2 days.
Alerts: your alert choices and the history of alerts sent to you are kept while your account exists. Turning an alert off keeps the choice, switched off. Alert history is not deleted automatically. Deleting the account deletes both.
Purchases: Google Play and Superwall keep their own records under their own privacy policies. We keep three things: the random billing number that connects your purchases to your app account, the current state of your Crypto Whales Sonar Pro subscription (plan, whether it is active, renewal and expiry date, store transaction reference) and a copy of each billing message Superwall sends us about it. None of these is deleted automatically, and deleting your account does not delete them: Google Play renewals, cancellations and refunds for a purchase you already made reach us through that billing number, and we keep purchase records like our website payment records, for tax and accounting. The billing number cannot be used to sign in.
Deleting your account: use Delete account on the Account page at safutrading.com after signing in there with the same email, or ask support as the account deletion page describes. Delete account on the website signs you out on every phone and on the website, disconnects Google or Apple sign-in, removes your phones from notifications, deletes your alert choices and alert history, makes unused sign-in codes stop working, deletes your display name and replaces your email address with a placeholder. It closes the website account (and cancels any paid website plan) and the app account together, because they share one email record. What stays, without your email address: the dates the account was created and last signed in, the purchase records listed under Purchases above, and the record of which version of the Terms you agreed to and when (see Terms agreements above). Deleting the account does not cancel a Google Play subscription; cancel it in Google Play.
Backups and server logs: the app uses the same database and servers as the SafuTrading website, so the backup and log periods in section 5 of the SafuTrading privacy policy apply. Data stored on your phone stays there until you remove the app or clear its data.
Security and deletion requests
We use encrypted transport, hashed server-side credentials, restricted server access and secure phone storage for session tokens. No storage or transmission system is infallible. Contact us if you suspect unauthorized access.
You can request account deletion from Account in the app or the public deletion page below. It explains verification, what is removed, shared website records, exceptions, backups and timing. You do not need to buy a subscription to make a request.
Your choices and rights
You can use the app's free previews without purchasing, decline optional notification permission, stop alerts, sign out, and request access, correction or deletion of personal data. Depending on applicable law, you may also request portability, restriction, object to certain processing, withdraw consent, or complain to your local data protection authority. We may need to verify your identity before fulfilling a request.
The app is intended for adults and is not directed at children. If you believe a child has provided account data, contact the privacy team so we can investigate and remove it where appropriate.
Material changes will be reflected in this policy with a new effective date and an additional notice where required. Questions or rights requests: legal@safutrading.com.