Privacy Policy

Undertow, Arizona, USA ("we", "us") operates Undertow and is responsible for the personal data described in this policy. Contact: support@floorfn.com.

This policy is written to meet the privacy laws that apply to people around the world, including the EU and UK General Data Protection Regulation (GDPR), Canada's PIPEDA and Quebec's Law 25, and California's CCPA and CPRA.

Account data. Your email address, the handle and name you choose, an optional password (stored only as a one-way hash), and when you signed in. If you sign in with Apple or Google, we receive your email address and name from that provider and nothing else.

Stock lists. The stocks you follow and, if you enter them, your shares and average cost. We do not connect to your brokerage and never see your real holdings.

Content you post. Comments, which are public with your handle and name, and pictures attached to them; a profile photo, if you add one; likes, reports and blocks; and the members you follow and who follows you (your handle and follower count are public on your member page).

Notification data. A random device identifier, Apple's push token for your device, and which stocks you turned alerts on or off for.

Payment data. Payments are processed by Stripe. We receive your email, billing country, postal code (for tax) and subscription status. We do not receive your full card number.

Technical data. Server logs recording the request, the stock looked up and your IP address.

Communications. Messages you send to us.

We do not collect your precise location, contacts, health data or other sensitive categories of personal data, and we do not track you across other companies' apps or websites.

To provide the Service and your account, and to show your lists and send the alerts you asked for. Basis: performance of our contract with you.

To take payment, keep tax and accounting records and meet legal duties. Basis: contract and legal obligation.

To keep the Service secure, prevent abuse, and moderate the community. Basis: our legitimate interests.

To send push notifications. Basis: your consent, which you may withdraw at any time in iOS Settings or in the app.

To answer your messages. Basis: our legitimate interests and, where relevant, contract.

We do not use your personal data for advertising and we do not make decisions about you by automated means that have legal or similarly significant effects.

We share personal data only with service providers that we need in order to run Undertow, each under its own privacy terms: Apple (sign-in, push notifications, app distribution), Google (sign-in, if you choose it), Stripe (payments and tax), our email provider (sign-in codes and receipts), and our hosting and network providers.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We may disclose personal data where the law requires it, to protect rights and safety, or in connection with a business transfer, in each case as the law permits.

Our servers and our team are in the United States. If you use Undertow from another country, your personal data will be transferred to and processed in the United States. Where the law requires it, we rely on standard contractual clauses or another lawful transfer mechanism for that transfer.

We keep account data while your account is open. When you delete your account we remove your profile, stock lists, photo and settings, and remove your comments from view. We keep only what the law requires, such as payment and tax records, for up to seven (7) years.

Server logs are deleted after 14 days. Support messages are kept for as long as needed to resolve them and for a reasonable period afterwards.

Whatever your location, you may ask us to give you access to, correct, delete or provide a copy of your personal data, and to restrict or object to particular uses. Depending on where you live, you may also withdraw consent, request portability, and complain to your data protection authority (in Canada, the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada; in the EU or UK, your national authority; in California, the California Privacy Protection Agency).

Download. In the app, go to Profile, Download my data. You receive one structured JSON file containing your profile, the stocks you follow and hold (with shares and what you paid), your alert settings, the members you follow and your public comments. It contains nothing internal. The app asks for Face ID or your passcode first.

Delete. In the app, go to Profile, Delete account. This cancels Undertow Pro and removes your data as described in section 6.

Other requests. Email support@floorfn.com. We respond within 30 days. We do not treat you differently for exercising a privacy right.

Data travels over encrypted connections. Passwords are stored only as one-way hashes. Sign-in codes expire after 15 minutes. The data file in 7.2 is built only for the signed-in account, is limited to five downloads a day, and is never cached. No system is perfectly secure. If a breach creates a risk to your rights, we will notify you and the authorities as the law requires.

Undertow is for people aged 18 and over. We do not knowingly collect personal data from anyone younger and will delete it if we learn that we have.

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect.

Undertow, Arizona, USA. support@floorfn.com