MarketAssistant Privacy Policy

Effective date: 18 October 2026

This notice covers the MarketAssistant Android application (de.marketassistant.app) and marketassistant.online. Processing depends on app version, enabled features and user choices. The advertising section applies to versions integrating AdMob; publishing this notice does not enable advertising in older versions.

1. Responsible developer

Baraa Abdullah, Germany, operating MarketAssistant (Marketassistant on Google Play). Contact for privacy, support and rights requests: baraadeu2020@gmail.com.

2. Local application information

The app stores settings, language and display preferences, watchlists, portfolio entries, research, analysis records and information you enter in its local application storage, including WebView storage. In the reviewed implementation, built-in analysis and chat logic runs locally without an external AI chat API. Online market and news information may still be requested as described below.

Saved provider API credentials are encrypted in the Android implementation using Android Keystore. Other local records are not claimed to have this same encryption. Do not enter unnecessary sensitive information into chat or research fields. The reviewed app has no developer-operated central user-account database. That does not mean external services receive no information when your device connects to them.

3. Market-data and news services

Depending on configuration and feature, the app connects directly to Yahoo Finance, Twelve Data, Finnhub, Financial Modeling Prep, NewsAPI, GDELT, Nasdaq/Nasdaq Trader, FRED and public sources including the US Federal Reserve, European Central Bank and SEC. Requests can disclose IP addresses, technical request headers, requested symbols, search terms, intervals and query parameters. A configured provider receives its own API key for authentication. Requested symbols can reveal interests even without an entire portfolio being transmitted.

These requests provide prices, charts, searches, economic information and news; some refreshes and research requests occur automatically while the app's local service runs. You can disable optional internet-data collection in settings and avoid optional providers by not supplying their keys. User actions requesting online content still require network access.

Providers process received information under their own privacy notices, available on their websites. Opening news articles or other links brings you under the destination site's privacy and cookie practices. We do not control those sites' retention periods.

4. Google AdMob and advertising choices

AdMob-enabled versions use Google's Mobile Ads SDK for banner advertising and Google's User Messaging Platform (UMP) for applicable privacy choices. Google may collect and share IP addresses, approximate location derived from IP, advertising/app/device identifiers, ad views and interactions, and diagnostic/performance information. Purposes include ad delivery and measurement, advertising analytics and fraud prevention. Partners disclosed in the consent message may also process information for the purposes you permit or otherwise allowed by applicable law.

The app does not request GPS or precise-location permission for advertising. Non-personalized or limited ads may still involve technical information; they do not mean that no data is processed.

Where required, including in the EEA, UK and Switzerland, supported versions present Google's consent message with options to accept, refuse or manage choices. Where required by UMP, the app shows an Ad privacy choices button to review or withdraw consent. Withdrawal affects future processing, not processing lawfully performed before withdrawal. Android's advertising settings also allow management or deletion of advertising identifiers, depending on Android version.

The new integration refreshes consent information before requesting ads and suppresses ad requests when consent configuration or form handling fails. The main app remains usable without an ad. Existing versions without this integration do not gain these controls merely through a website update.

Google privacy information: https://policies.google.com/privacy. Advertising practices: https://policies.google.com/technologies/ads. Mobile Ads SDK disclosures: https://developers.google.com/admob/android/privacy/play-data-disclosure. Google's retention information: https://policies.google.com/technologies/retention.

5. Website and support

The website is hosted on an Oracle Cloud Ubuntu server. Its static frontend includes no advertising or analytics scripts, contact forms, tracking cookies or browser-storage features. Hosting requests can generate logs containing IP addresses, timestamps, requested URLs, status codes, browser/user-agent information and referring URLs. We use this information to deliver the site and maintain security and reliability. The current Nginx configuration rotates logs daily and keeps 14 rotated files; active logs and rotation timing can extend retention beyond exactly 14 days. Oracle may process infrastructure information under its service arrangements; see https://www.oracle.com/legal/privacy/.

Support email is handled through Gmail. If you email us, we receive your address, message and attachments to respond, troubleshoot and handle rights requests. Avoid sending passwords, private keys or unnecessary identity or financial information. Correspondence is retained only as needed to resolve and follow up on an inquiry, meet applicable legal obligations or establish or defend legal claims, then deleted. Google's separate email processing and backup/deletion practices also apply.

Google Play handles app distribution under Google's own terms and privacy notice.

6. Purposes and legal bases

Where GDPR applies, processing necessary to provide requested features or service is based on Article 6(1)(b). Necessary website delivery, security, troubleshooting and general correspondence may rely on legitimate interests under Article 6(1)(f), balanced against your rights. Optional advertising processing requiring consent relies on Article 6(1)(a), together with consent for device storage/access where applicable. Processing required by law relies on Article 6(1)(c). Partners explain their own legal bases and choices in their notices and applicable consent messages. This notice is not itself consent.

7. Retention and deletion

Local records remain until removed by available app controls or clearing app storage. Android Clear storage or uninstalling normally removes the app's private local records, but exported files or separately saved backups must be deleted separately. Uninstalling does not erase records held by outside providers.

The reviewed automatic local-backup feature is enabled by default and keeps up to seven recent backup archives unless its settings are changed; older archives are pruned when new backups are created. The frontend limits active conversation history to the latest 50 messages. This limit does not establish deletion of every analysis record or backup. Local research, diagnostics, exports and backups have separate lifecycles.

For records we hold, contact baraadeu2020@gmail.com to request information or deletion. We cannot remotely erase local app data or guarantee deletion of information independently controlled by providers. Third-party retention and deletion procedures are explained in their privacy notices.

8. Recipients, international processing and security

Recipients include enabled market/news providers, Google and applicable advertising partners, Oracle for hosting, and Google for email and app distribution. Information may also be disclosed where legally required or needed to establish or defend legal claims. We do not sell locally stored portfolios or chat records to advertisers.

Providers may process information outside your country, including outside the EEA. Applicable transfers require an adequacy decision or another valid safeguard such as standard contractual clauses. Consult provider notices for their arrangements; contact us for details of transfers for which we are responsible. This notice does not promise that all data stays in Germany.

The website uses HTTPS. The app uses Android app isolation and credential protection described above; reviewed external provider requests use HTTPS. Its interface also communicates with a Python service through an on-device HTTP loopback connection, not a public internet server. No storage or transmission method guarantees absolute security.

9. Rights and children

Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Send requests to baraadeu2020@gmail.com; proportionate verification may be needed. Legal limitations can apply. You may complain to a competent data-protection supervisory authority, including one where you live or work in the EU.

MarketAssistant is a financial-information application and is not specifically designed to solicit children's personal information. If you believe a child supplied information to us, contact us so we can investigate and take appropriate action. A store content rating does not replace applicable age, consent or parental requirements.

10. Changes

We update this policy and its effective date when practices change. Where required, we provide further notice or request new consent. This policy is not financial advice and does not authorize trading on your behalf.