In short
- No account. We never ask for your name, email, phone number or ID.
- No tracking. No analytics tools, ad networks, tracking pixels or cookies, in the app or on this website.
- No selling. We do not sell, rent or share your data for advertising.
- We never see payment details. Premium purchases and subscriptions are handled by Apple or Google; your card details and your store account's name or email never reach us. We only see the store's transaction ID to verify Premium.
Data we keep
On first launch the app creates a random installation ID and a device secret on your phone. Our server links your alerts to this anonymous ID. It is not associated with you or with any other account.
| Data | Why | How long |
|---|---|---|
| Installation ID (randomly generated) | To recognise your device and link your alerts to it | Until the device record is deleted |
| Hash of the device secret (SHA-256) | To stop anyone else using your ID. The secret itself stays on your phone. | Until the device record is deleted |
| Push notification token | To deliver alert notifications to your phone | Until the token becomes invalid or the record is deleted |
| Language, time zone, quiet hours, app version, operating system (iOS / Android) | To send notifications in the right language, respect quiet hours, and keep versions compatible | Until the device record is deleted |
| Alerts you create (coin, market, timeframe, threshold, direction) | To evaluate your alerts | Until you delete the alert or the record is deleted |
| Sent notification log (coin, timeframe, RSI value, notification text, time) | The "Recent notifications" list in the app, and troubleshooting | 30 days |
| App verification data (Apple App Attest / Google Play Integrity) | To verify that requests come from the genuine app installed from the store, and to prevent abuse | Verification results are not stored; on iOS the public part of the device's verification key is kept with the device record |
| Premium purchase record (store transaction ID, product, expiry date, sandbox/production) | To verify Premium, track renewals and cancellations, and restore a purchase on a new device | While the subscription lasts; deleted 90 days after it is no longer linked to any device |
| IP address and request details | Security and preventing abuse of the service | Web server logs, at most 14 days |
We do not access or ask for your location, contacts, photos, microphone, camera or advertising ID.
Stays on your device
Your favourite coins, your view preference (heatmap / radar), your selected market and timeframe, and the most recently viewed market data are stored only on your phone and are not sent to our server. One exception: if you create a "Favorites" alert, your list of favourite coins is sent with that alert so it can work.
How we use it
We use the data above only to run the app: showing market data, evaluating alerts, sending notifications and protecting the service from abuse. We do not build profiles, make automated decisions about you or use the data for marketing.
Legal basis: under the GDPR (and Turkey's KVKK) we process this data to provide the service you chose to use (performance of a contract) and to keep it secure (legitimate interest). Notifications depend on your permission, which you can withdraw at any time in your phone settings.
Third parties
We work with the following providers to run the service. None of them receives data from us for advertising or analytics.
- Apple: App Store purchases and subscriptions, purchase verification and renewal notifications, Apple Push Notification service (iOS notifications), App Attest (app verification).
- Google: Google Play purchases and subscriptions, purchase verification through the Play Developer API, Firebase Cloud Messaging (notification delivery), Play Integrity (app verification).
- Contabo GmbH: data centre hosting for our servers (Germany).
Market data (prices and RSI) is computed on our servers from public exchange data. No information about you is sent to the exchange in the process.
Where data is stored
Our servers are in Germany (European Union). Because notifications are delivered through Apple's and Google's infrastructure, your push token and notification content pass through their servers.
Retention and deletion
- If you delete the app, your push token becomes invalid. 30 days after our server notices this, it permanently deletes your device record and all your alerts.
- If you don't open the app for 60 days, your device record and alerts are deleted automatically.
- To delete right away, use Settings → Delete my data in the app. Your record and alerts are deleted immediately.
- Notification logs are deleted after 30 days and web server logs after 14 days.
- Delete my data also removes the device's link to Premium; your purchase stays in your Apple/Google account and can be linked again with Restore purchases.
Your rights
Under the GDPR and Turkey's KVKK you have the right to access your data, ask for it to be corrected or deleted, object to its processing and lodge a complaint. You can see most of the data we keep in the app (your alerts and recent notifications) and delete all of it with Delete my data. For anything else, write to us. You may also contact the data protection authority in your country.
Children
Thermal is not intended for people under 18, and we do not knowingly collect data from children.
Changes
If we change this policy we will publish the new version on this page and update the effective date. We will also announce important changes in the app.
Contact
Data controller: Mehmet Nurettin Şimşek, Ankara, Turkey.
Email: info@thermalcrypto.com