📈 KOSAK Privacy Policy

Effective: October 20, 2026 · Service: KOSAK — AI investment-prediction dashboard (the “Service”)

1. Items Collected and When

• When not logging in / not using an account: We do not collect account information. Watchlist groups, the trade journal and settings are kept in on-device storage (browser local storage). Ads, usage statistics and optional push notifications are processed separately as described below.
• When signing up / logging in (optional): User ID, authentication information, and a name or nickname. For ID/password login, only a PBKDF2-derived authentication value is transmitted and stored; the original password is never stored on the server. Google and Apple login use the provider's account identifier, email and name; Kakao login uses its account identifier and nickname. Available fields depend on your provider and disclosure settings. Basic account information, including the email and name supplied, is stored on the server for authentication and account management.
• When using sync (optional): Watchlist groups; trade-journal symbols, buys/sells, prices, amounts, leverage, notes, emotions and entry times; entered seed capital; paper-trading records; price-alert and chart/app settings. These financial/transaction records and user-written content are encrypted with AES-256-GCM on your device, linked to your account, and transmitted to and stored on the server. The key is derived from your password for password login, or from the provider's account identifier for social login. We do not guarantee that the operator cannot decrypt data under every login method.
• When using push notifications (optional): A push-subscription identifier (device/browser token) and the securities for which you have set alerts. Used to deliver notifications and provide the notification inbox. Notification titles, text, links and send times are associated with a hash of the subscription identifier and retained on the server for up to 30 days. Read state and up to 200 recent records are stored on this device; the inbox fetches up to 100 recent server records.
• When using paid features (optional): Purchase/receipt identifiers, products, entitlements and subscription status are used to verify purchases and provide paid features such as ad removal. Payment methods are handled by the relevant app marketplace or payment provider.
• Usage statistics: Event names and counts for app launches, opening screens/securities, features used, platform, language and app version are aggregated on the server. Our own statistics payload does not include emails, account IDs or trade-journal content. See Section 4 for advertising SDK data.

2. Purposes of Use

• Syncing your “My Settings” (watchlist groups, trade journal, alerts, etc.) across devices.
• Sending push notifications such as new listings and target-price reached for watched securities.
• Authentication and account management; purchase verification and provision of paid features and ad removal.
• Usage/performance analysis, advertising and measurement, and fraud prevention.

3. Retention and Use Period

Account information, including emails and names, and sync data are retained while the account exists; they are not discarded immediately after a transient request. Account deletion removes the account record, sync data, nickname registration and current login session. Existing sessions for the deleted account cannot access the server, including from other devices; remaining session identifiers expire within 60 days. Logging out ends the current session and does not delete the server account or synced data. Our usage statistics expire within 90 days, and web-payment receipt records used to prevent duplicate processing within 400 days. Push subscriptions and purchase records are processed separately from the account; contact us below if you need help disabling or deleting them. Advertising and payment providers retain information under their own policies. You can delete local data directly.

4. Third-Party Processing & Advertising (Google AdSense and AdMob)

The operator does not sell account information or sync data. Hosting, authentication, notifications and payment processing use the providers described below. We do not provide a feature that publishes your email, name or trade-journal content to other users. External APIs (Upbit, Binance, CoinGecko, Naver Finance, Yahoo Finance, Google News, alternative.me, etc.) provide prices, news, exchange rates and indicators; request details such as the queried security and connection information such as an IP address may reach those providers.

Advertising: To keep the Service free, we display Google AdSense (web) and Google AdMob (app) ads. For advertising, analytics and fraud prevention, the Google Mobile Ads SDK may automatically collect and share IP addresses and derived approximate location, app launches and ad interactions, performance/diagnostic information, and device/account identifiers (such as Advertising ID and app set ID). See Google's SDK data disclosure for details. Advertising providers, including Google, may use cookies and similar identifiers for ads based on this Service and other sites. Non-personalized ads or personalization limits do not stop all such processing. You can limit personalization in device settings or Google Ad Settings, or decline third-party cookies at aboutads.info and youronlinechoices.eu. Where available, use the regional consent screen to manage privacy choices. Google's use of data is governed by Google's Privacy & Terms.

5. Entrustment of Processing (Infrastructure)

Cloudflare, Inc.'s Workers and KV infrastructure stores basic account information, authentication values, sessions and encrypted sync data. Basic account information is processed separately from encrypted sync content. Depending on your choices, Google, Apple or Kakao handles login authentication; Google Firebase Cloud Messaging and browser push providers deliver notifications; app marketplaces or payment providers such as Bootpay handle payments. Authentication tokens, subscription tokens and purchase identifiers needed for these features are processed with the relevant providers.

6. Security Measures

• One-way password transformation (PBKDF2, multiple iterations) — the original is not retained.
• Sync data is encrypted on the device with AES-256-GCM before transmission and storage; key derivation depends on the login method.
• All communications encrypted via HTTPS.
• Our own usage statistics aggregate event names/counts without including account emails, IDs or trade-journal content in the statistics payload (see Section 4 for advertising SDK processing).

7. User Rights

You can use watchlist groups, the trade journal and settings in local-only mode without logging in. You can delete your account directly in the app — Account menu (👤 My account) → Delete account. This requests deletion of server account information (including email and name) and synced data; local records and separate push subscriptions/purchase records are handled as described in Section 3. Logging out alone does not delete the account. You may also request deletion by email; see the account deletion instructions.

8. Children Under 14

This Service is intended for users aged 14 and over, and does not intentionally collect the personal information of children under the age of 14.

9. Privacy Officer / Contact

Email: contact.kosak@gmail.com

10. Duty of Notification

If this Policy changes, the effective date and the details of the change will be announced through this page.