Privacy Policy

1. Introduction

Welcome to Orcb. This Privacy Policy explains how the developer of Orcb ("we," "our," or "us") collects, uses, discloses, and safeguards your information when you use the mobile application Orcb (the "App"), available on Android and iOS.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the App immediately. By using the App, you consent to the data practices described in this Privacy Policy.

This Privacy Policy should be read together with our Terms of Use.

2. Who We Are

Orcb is developed and operated by Pedro Lorente Díaz, based in Spain. For the purposes of applicable data protection laws (including the GDPR), Pedro Lorente Díaz is the data controller of your personal information.

3. Information We Collect

We collect information that you provide directly to us, information collected automatically, and information from third-party services.

3.1 Information You Provide Directly

• Account Information: When you register, we collect your email address and password (stored in hashed form). If you use Google Sign-In, we receive your name, email address, and profile picture from Google.
• Alarm Preferences: Market capitalization threshold alarms you create, including token pair addresses, blockchain network (currently Solana), alarm conditions (greater than or equal to / less than or equal to), and target thresholds.
• Support Communications: If you contact us for support, we may collect your name, email address, and the content of your messages.

3.2 Information Collected Automatically

• Device Information: Device type, operating system, app version, and a unique installation identifier generated by our system.
• Push Notification Token: A Firebase Cloud Messaging (FCM) token is collected when you grant notification permissions, used solely to deliver price alarms to your device.
• Usage Data: Logs of alarms created, edited, activated, or deleted; token pairs searched; and timestamps of app activity.
• Session Data: Authentication tokens (JWT) stored locally on your device to maintain your session.
• Alarm History: A local history of push notifications received, stored on your device.

3.3 Subscription Information

• Subscription Status: We receive your subscription status (active, expired, cancelled) and entitlement information from RevenueCat. This includes subscription type, purchase date, and expiration date.
• No Payment Data: We do not receive or store your credit card number, bank account information, or any payment credentials. All payment processing is handled directly by Apple App Store and Google Play Store.

3.4 Information We Do NOT Collect

• We do not collect precise or approximate GPS location data.
• We do not collect payment card numbers, bank account details, or any sensitive financial identifiers. All payment processing is handled directly by Apple App Store and Google Play Store.
• We do not collect biometric data (fingerprints, face scans, etc.).
• We do not collect contacts, photos, or any content from your device's storage.
• We do not use third-party advertising SDKs or ad tracking technologies.
• We do not sell, rent, or trade your personal data to advertisers or data brokers.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

You may withdraw your consent at any time (e.g., by disabling push notifications in your device settings). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. How We Use Your Information

We use the information we collect to:

• Provide and maintain the App: Create and manage your account, authenticate your identity, and deliver the core alarm functionality.
• Send push notifications: Notify you in real time when a token's market capitalization crosses your configured threshold.
• Process subscriptions: Manage your free tier limits and PRO subscription status via RevenueCat, in coordination with Apple App Store and Google Play Store.
• Improve the App: Analyze usage patterns and app performance to debug issues and improve features.
• Communicate with you: Respond to support inquiries submitted to info@orcb.app.
• Ensure security: Detect fraud, abuse, and unauthorized access using audit logs and role-based access controls.
• Comply with legal obligations: Respond to lawful requests from public authorities.

We do not use your data for targeted advertising, profiling for marketing purposes, or automated decision-making that produces legal effects concerning you.

6. Third-Party Services

We use the following categories of third-party services to operate the App, each governed by their own privacy policies:

• Authentication providers: Google Sign-In for account authentication and profile data retrieval when you choose to sign in with Google.
• Notification providers: Firebase Cloud Messaging (FCM) to deliver push notifications and alarm alerts to your device.
• Subscription and payment providers: RevenueCat to manage subscription status and entitlements, and Apple App Store and Google Play Store to process in-app purchases and subscription billing.
• Infrastructure providers: Railway for backend hosting, database operations, and secure server-side processing.
• Market data providers: Solana Tracker and DexScreener to retrieve token, pair, and market data used by the App's search and alert features.

We do not control the privacy practices of third-party services. We encourage you to review their respective privacy policies before using the App.

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may disclose information if required to do so by law, regulation, legal process, or governmental request, or if such disclosure is necessary to protect our rights, your safety, or the safety of others. In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country. Specifically:

• Our backend infrastructure is hosted on Railway, which may store data in the United States or other regions.
• Third-party services (Firebase, Google, RevenueCat) may process data in the United States or other jurisdictions.

For transfers of personal data from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) or the service provider's certification under applicable data transfer frameworks.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the App's services. If you delete your account, we will delete or anonymize your personal data within 90 days, unless we are required to retain certain information for legal or compliance purposes (e.g., financial transaction records, audit logs, or fraud prevention).

Local data stored on your device (session tokens, alarm history, notification history) is deleted when you log out or uninstall the App.

Specific retention periods:

• Account data: Retained while account is active; deleted within 90 days of account deletion request.
• Alarm data: Retained while account is active; deleted with account.
• Audit logs: Retained for up to 2 years for security and compliance purposes.
• Subscription records: Retained for the duration required by applicable tax and financial regulations.

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption in transit: All communications between the App and our servers use HTTPS/TLS encryption.
• Password hashing: Passwords are stored using industry-standard hashing algorithms (bcrypt).
• Authentication: JWT-based authentication with secure token handling.
• Access control: Role-based access control and audit logging for internal systems.
• Secure hosting: Our backend is hosted on Railway with managed infrastructure security.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users via email or in-app notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where required by applicable law (e.g., GDPR Article 33), we will also notify the relevant supervisory authority.

11. Account Deletion

You have the right to delete your account and all associated personal data at any time. You can do so by:

• In-App: Navigate to Profile → Delete Account within the Orcb app.
• Public Web Instructions: Visit orcb.app/account-deletion for the public deletion instructions required by app stores.
• Email: Send a request to info@orcb.app with the subject "Account Deletion Request."

Upon receiving your request, we will:

• Delete your account and personal data from our servers within 90 days.
• Remove your alarms, device registrations, and notification history.
• Revoke your authentication tokens.

Important: Account deletion does not automatically cancel an active subscription. You must cancel your subscription separately through the Apple App Store or Google Play Store to stop future charges. See our Terms of Use for cancellation instructions.

12. Children's Privacy

Orcb is not intended for users under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at info@orcb.app.

If we become aware that we have collected personal data from a child under 18 without verification of parental consent, we will take steps to delete that information as quickly as possible.

13. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal data. We are committed to honoring these rights.

13.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data (see Section 11).
• Opt-out of notifications: Disable push notifications at any time in your device settings.

13.2 Additional Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the GDPR:

• Data portability: Request your personal data in a structured, commonly used, machine-readable format.
• Restriction of processing: Request that we restrict the processing of your personal data under certain conditions.
• Object to processing: Object to processing of your personal data based on legitimate interests.
• Withdraw consent: Withdraw previously given consent at any time.
• Lodge a complaint: File a complaint with your local data protection supervisory authority.

13.3 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: You have the right to request that we disclose the categories and specific pieces of personal data we have collected about you, the categories of sources, the purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You have the right to request deletion of your personal data, subject to certain exceptions.
• Right to correct: You have the right to request correction of inaccurate personal data.
• Right to opt-out of sale/sharing: We do not sell or share your personal data for cross-context behavioral advertising.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

13.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at info@orcb.app. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

14. Push Notifications and Alarms

The App requests permission to send push notifications to notify you when your configured market cap thresholds are triggered. This is the core functionality of the App.

You may opt out at any time by disabling push notifications in your device settings:

• iOS: Settings → Notifications → Orcb → toggle off.
• Android: Settings → Apps → Orcb → Notifications → toggle off.

Disabling push notifications will prevent the App from delivering alarm alerts to your device, but your alarms will remain configured on our servers.

15. Tracking Technologies

Orcb does not use cookies, web beacons, pixel tags, or similar tracking technologies within the App. We do not use any third-party analytics SDKs (such as Google Analytics, Firebase Analytics, or Crashlytics) in the current version of the App.

We do not participate in any ad-tracking or cross-app tracking. We do not use Apple's App Tracking Transparency (ATT) framework because we do not track users across other apps or websites.

"Do Not Track" Signal: The App does not track users, so "Do Not Track" browser signals are not applicable. However, we honor your privacy preferences in all cases.

16. Financial Disclaimer

Orcb displays market capitalization data sourced from third parties (Solana Tracker, DexScreener). We do not control the accuracy, completeness, or timeliness of this data. This information is provided for informational purposes only and does not constitute financial, investment, legal, or tax advice.

Orcb is not a cryptocurrency exchange, wallet, or financial services provider. The App does not facilitate the buying, selling, or trading of any digital asset. You should consult a qualified financial advisor before making any investment decisions.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via push notification or in-app notice at least 7 days before changes take effect.
• For material changes that affect your rights, provide at least 30 days advance notice.

Your continued use of the App after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should stop using the App and request account deletion.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EEA/UK residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.