SafuTrading · Follow the Whales
Follow the Whales — Privacy Policy
The app and this policy
Effective 8 September 2026. Follow the Whales, previously called Whale Sonar, is a mobile market analytics app operated under the SafuTrading name at safutrading.com. This policy covers the app and its mobile API, including review builds. The SafuTrading website has a separate privacy and cookie policy.
Contact the privacy team at legal@safutrading.com or app support at support@safutrading.com. The app provides market information, not a wallet or exchange: it does not ask for wallet seed phrases, hold your crypto, execute trades or mine crypto on your device.
Account and authentication data
If you sign in with email, we process your email address, a verification-code hash, expiry and attempt records, and a security hash derived from your IP address for rate limiting. The code is sent through Resend. Codes expire after 10 minutes; expiration is not the same as deletion of the related security record.
Where Google or Apple sign-in is enabled, we receive the provider identifier and verified email information needed to authenticate you. We do not receive your Google or Apple password. Sign-in availability can differ between app builds.
We store a mobile account identifier, a random billing identifier, account email and any existing account display name, session hashes and session timestamps. The session token is held using the phone’s secure storage. Server sessions expire after 30 days unless ended earlier. Signing out ends the current app session; it does not delete your account.
Alerts, device details and local storage
When you enable notifications, we process your Expo push token, device platform, device name or model, app version, alert selections and alert delivery/history records. Expo and Firebase Cloud Messaging help deliver Android notifications. Notification permission is optional and can be changed in the phone’s settings. You can mute alerts or unregister this phone through the app.
Onboarding progress, interface preferences and related local state are stored on the device. Secure session tokens use secure storage; preferences use app storage. This native storage is not permission for advertising tracking.
API requests expose technical information such as IP address and request timestamps to our hosting infrastructure. We use technical and error records to protect the service and diagnose failures. We do not request precise location, contacts, photos, microphone access or wallet private keys for chart viewing.
Subscriptions and purchase information
When store billing is enabled, Google Play processes Android payments. We do not receive the full payment card details entered into Google Play. We receive information needed to verify and restore access, including product and plan identifiers, store or transaction references, purchase status, renewal/expiry information and entitlement events.
Configured production builds use Superwall to display subscription offers and coordinate purchases. The app sends it a random billing user ID and membership attributes. Its SDK also processes device/app, paywall interaction and transaction information. Review builds with billing disabled do not activate a purchase or free trial.
Why we use data and who receives it
We use data to authenticate accounts, provide charts and alerts, manage subscriptions, restore purchases, respond to support and deletion requests, prevent abuse and meet legal obligations. Essential account processing supports the service you request; security processing supports our legitimate interest in protecting it. Where consent is required for optional processing, we ask before that processing begins and allow withdrawal.
Relevant providers include hosting and database infrastructure, Resend for authentication email, Expo/Firebase for app infrastructure and notification delivery, Google Play for Android billing, enabled sign-in providers, and Superwall for configured subscription flows. They receive the data needed for their respective functions. Support correspondence is processed through our support email service. We may disclose limited information where legally required or necessary to address fraud or security incidents.
We do not sell personal information or use the app to serve targeted advertising. Providers may process data outside your country. Where data protection law requires safeguards for international transfers, those safeguards apply to the relevant provider arrangement.
Retention, security and deletion
Account data is kept while needed to operate the account. Authentication, security and delivery records are kept only while needed for access, abuse prevention, troubleshooting or applicable legal obligations. Purchase records may need longer retention for tax, refund and dispute purposes. Code/session expiry limits access; it does not promise that all associated records vanish at expiry.
We use encrypted transport, hashed server-side credentials, restricted server access and secure phone storage for session tokens. No storage or transmission system is infallible. Contact us if you suspect unauthorized access.
You can request account deletion from Account in the app or the public deletion page below. It explains verification, what is removed, shared website records, exceptions, backups and timing. You do not need to buy a subscription to make a request.
Your choices and rights
You can use the free chart sample without purchasing, decline optional notification permission, stop alerts, sign out, and request access, correction or deletion of personal data. Depending on applicable law, you may also request portability, restriction, object to certain processing, withdraw consent, or complain to your local data protection authority. We may need to verify your identity before fulfilling a request.
The app is intended for adults and is not directed at children. If you believe a child has provided account data, contact the privacy team so we can investigate and remove it where appropriate.
Material changes will be reflected in this policy with a new effective date and an additional notice where required. Questions or rights requests: legal@safutrading.com.