Vigil — Privacy Policy
Last updated: 2026-10-14

Vigil is operated by Keyao Zhu, an individual based in Vancouver, British Columbia, Canada ("we", "us").

1. What we collect
• Without an account: a random device identifier and a push-notification token generated by your phone, your app language, whether you want mid-session alerts, whether notifications are allowed, whether you have written a plan (yes or no — never its text) and whether a home-screen widget is placed, and — only if you entered funds — ONE combined number (the beta-weighted value of your funds, rounded) with its currency. We do not receive which funds you hold unless you sign in.
• With an account: your email address, a display name and avatar you choose, and the list of funds and plans you enter (so they can be restored on another device). If you sign in with Apple or Google, we receive the email address and name they share with us (Apple lets you hide your real email); we never see your Apple or Google password. If you subscribe, the store's purchase token and subscription status.
• Headline checks: the link or text you submit, stored with the result so monthly limits can be counted.
• Feedback: the text you send, your email if signed in, your language and subscription status, and the app version and operating system version it was sent from.
• App usage events: which steps and screens are used — for example "finished setup", "turned alerts on", "opened an alert", "viewed the Premium screen", "started a purchase" — with the app version, the platform and the same random device identifier. They never contain your plan's text, amounts, fund names or the headlines you check. If you sign in, the device record is linked to your account, so these events are too.
• Crash and performance reports: when the app crashes or hits an error, the device model, OS and app version, the error and the screens that led to it; and, for a sample of sessions, how long screens and requests took. They contain no name, email, funds, plans or financial data, and we have the provider discard IP addresses.
• Install attribution: when the app is opened, our attribution provider (AppsFlyer) receives a device identifier — on iOS the vendor identifier (IDFV); on Android an identifier AppsFlyer generates for this installation — together with the install source, app version, device model and OS version, and a coarse region derived from the IP address. It is used only to tell which advertising channel an install came from. It contains none of your funds, plans, alerts or purchases.

2. What we do not collect
We do not connect to your bank or brokerage, do not collect account numbers, and do not track you across other apps or websites: we do not request Apple's advertising identifier (IDFA), show no tracking permission prompt, and do not collect the Google Advertising ID. We do not use your funds, plans or alerts for advertising, and we do not sell personal information.

3. How we use it
To send market alerts, show your estimated impact, restore your data, verify subscriptions, answer feedback, fix bugs, see which parts of the app people use (from the usage events, counted in aggregate) so we can improve it, and — with the install attribution data only — measure which advertising channels bring installs, so we can judge where to keep advertising.

4. Service providers
• Supabase (database, authentication, server functions; Canada region).
• Expo (push notification delivery).
• Anthropic (the AI model that summarizes news and runs headline checks — it receives the market figures and, for a check, the link or text you submitted; never your fund list or identity).
• Apple and Google (payments, and sign-in if you choose it).
• Resend (delivers the sign-up confirmation and password-reset emails, and feedback emails to us).
• Vercel (hosts the service that checks App Store purchase receipts; it receives the signed purchase record, not your identity).
• Sentry (the crash and performance reports described above).
• AppsFlyer Ltd. (the install attribution data described above, to measure advertising performance).
Market data comes from third-party market-data providers, named on the app's About screen, through our server; they receive no personal data. The app fetches exchange rates (European Central Bank, via Frankfurter) directly, so Frankfurter sees your IP address as any website would, and nothing else.

5. Retention
Account data is kept while your account exists and deleted when you delete the account (Account → Delete account). A device record without an account stays while notifications can still reach the phone, because alerts can be more than a year apart; if the app has not been opened for 12 months, the fund figure and the setup flags are removed and only what an alert needs (the notification token, app language and alert preference) is kept. The record is deleted once notifications can no longer reach the phone (for example, the app was uninstalled) and the app has not been opened for 12 months. Headline-check records and app usage events are kept for 13 months. Install attribution data is held by AppsFlyer on our behalf under its data-processing terms; ask us and we will have it deleted.

6. Your rights
You can access, correct or delete your data in the app, or by emailing worldtab.app@gmail.com. Residents of the EU/UK (GDPR), California (CCPA/CPRA) and Canada (PIPEDA) have the rights their laws provide; we honour them for everyone.

7. Children
Vigil is not directed to anyone under 18.

8. Changes
We will post changes here and update the date above.

Contact: worldtab.app@gmail.com

Vigil provides information, not investment advice.