Privacy Policy

This Privacy Policy explains how T2MA Labs LLC ("T2MA Labs", "we", "us") handles personal data when you use Fips: the websites fipsapp.com and app.fipsapp.com, the Fips mobile and desktop apps, and our support channels (together, the "Service").

1. Who is responsible

T2MA Labs LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA, is responsible for your personal data. It is the "controller" under the EU and UK GDPR and the "data controller" (veri sorumlusu) under Turkey's Personal Data Protection Law No. 6698 (KVKK). For any privacy question or request, email [email protected].

If you use Fips through a Team plan run by your organization, your organization may decide how some of your data is used. In that case our Data Processing Agreement also applies.

2. What we collect

Data you give us

• Account details: your email address and a password, which we store only as a salted hash. If you sign in with Google or Apple, we receive your email address and an account identifier from them. If you use the mobile app as a guest, we use a device identifier instead of an email address.
• Waitlist: your email address when you join the waitlist.
• Trading data: trades, journal notes, tags, screenshots you upload, trading accounts, watchlists, alerts, calculator settings and other preferences.
• Connected MetaTrader 5 accounts: if you connect one, its account number, server and investor (read-only) password, and the balances and trade history we read with them. We never ask for your trading (master) password.
• Onboarding answers: if you answer the optional questions when you sign up, for example about your trading experience.
• Messages to us: your name, email address and what you write through the contact form, by email or in the support chat, as well as bug reports and feedback.

Data collected automatically

• Device and usage data: IP address, browser or device type, operating system, app version, and the pages or screens you use.
• Security logs: sign-in times and related technical data, used to protect accounts.
• Notification tokens: if you allow push notifications.
• Crash reports from the mobile app.
• Cookies and similar technologies on our websites. See our Cookie Policy.

Data from others

• Payments: our payment provider, Apple or Google tell us your subscription status, plan and transaction identifiers. We do not receive or store your full card number.
• Sign-in providers: Google or Apple, if you choose to sign in with them.

We do not ask for sensitive data, such as health information or government ID numbers. Please do not put it in notes or uploads.

3. How we use your data and our legal bases

If you are in the EU/EEA or the UK, each use relies on a legal basis under the GDPR or UK GDPR:

• To provide the Service: run your account, store and sync your data, calculate analytics, read connected accounts, send the alerts you set up, and manage subscriptions. Basis: performing our contract with you.
• To support you: answer your messages and fix problems. Basis: contract and our legitimate interest in helping users.
• To keep the Service secure: prevent abuse, fraud and unauthorized access, limit request rates and keep security logs. Basis: legitimate interests and, where applicable, legal obligations.
• To understand and improve the Service: website analytics and product analytics in the mobile app. Basis: your consent where the law requires it (for example, analytics cookies for visitors from the EU/EEA, UK and Turkey); otherwise our legitimate interests. You can opt out at any time.
• To send service messages: account verification, password resets, security and billing notices, and important changes. Basis: contract.
• To send product news or offers: only if you agreed to receive them. You can opt out at any time. Basis: consent.
• To meet legal obligations: tax and accounting records and responses to lawful requests. Basis: legal obligation.

If you are in Turkey, we rely on the matching conditions in Article 5 of KVKK: performance of a contract, legal obligation, legitimate interest, and your explicit consent where it is required.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your data and we do not use your trading data for advertising.

4. Who processes data for us

We use the following service providers. They process personal data on our behalf, under contract, and only to provide their service to us:

• Cloudflare: hosting of our websites and API, our database, file storage for uploads, security and bot protection (including Turnstile), and cookieless web analytics.
• Google: Google Analytics 4 on fipsapp.com (with Consent Mode); Gemini, the AI model that drafts answers in our support chat (it receives only the messages of your support conversation); and Firebase Cloud Messaging, used only to deliver push notifications to the mobile app.
• Resend: sending emails, such as account verification, password resets and replies to your messages.
• Chatwoot: our support chat software, which we host ourselves on a cloud server.
• Sentry: crash reports from the mobile app.
• PostHog: product analytics in the mobile app, which you can switch off in Settings.
• RevenueCat: subscription status for purchases made in the mobile apps.
• Our payment provider: processes web payments and may act as merchant of record.
• Cloud server provider: runs our self-hosted support chat and the services that collect economic calendar data and read connected MetaTrader accounts.

Apple and Google also process data when you download our apps, buy a subscription in them or sign in with Apple or Google. For those activities they act under their own privacy policies.

We may also disclose data when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you.

5. International transfers

T2MA Labs is based in the United States, and our providers process data in the US and other countries. When we transfer personal data from the EU/EEA, the UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, together with the UK Addendum or the Swiss adjustments where needed, or rely on a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

For transfers from Turkey, we rely on the safeguards allowed by Article 9 of KVKK, such as standard contracts.

You can ask us for more information about these safeguards at [email protected].

6. How long we keep data

• Account and trading data: while your account is open. When you delete your account, it is removed from our active systems.
• Security logs: kept after your account is deleted, but no longer linked to you.
• Waitlist entries: until you get access or ask us to remove you.
• Support and contact messages: as long as needed to handle your request and follow up on it.
• Payment and invoice records: as long as tax and accounting laws require.
• Website analytics: for the retention period set in Google Analytics.
• Backups: kept by our hosting provider for a limited time and then overwritten.

7. Deleting your account

You can delete your account and its data in the Fips mobile app under Settings › Delete account, or by emailing [email protected] from the address on your account. Deletion removes your trades, trading accounts and connected-account details, notes, uploads, alerts and settings. Deleting your account does not cancel a subscription bought through Apple or Google; cancel that in your store account.

8. Your rights

EU/EEA and UK

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal. You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Turkey (KVKK)

Under Article 11 of KVKK you can ask whether we process your data and request information about it; learn why it is processed and whether it is used for that purpose; learn who it is transferred to in Turkey or abroad; ask us to correct incomplete or wrong data; ask us to delete or destroy it; ask us to tell recipients about those corrections or deletions; object to a result against you that comes solely from automated analysis; and claim compensation for damage caused by unlawful processing. We answer within 30 days. You can also complain to the Personal Data Protection Authority (KVKK).

United States

Depending on the state you live in, such as California, you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of its sale, sharing or use for targeted advertising. We do not sell or share personal information, as those terms are defined in California law, and we do not use it for targeted advertising. We will not treat you differently for using your rights. You can use an authorized agent, and if we decline a request, you can appeal by replying to our answer.

How to make a request

Email [email protected], preferably from the address on your account. We may need to confirm your identity before acting. We answer within the time the law sets: one month under the GDPR, 30 days under KVKK and 45 days under US state laws, and we will tell you if we need an extension the law allows. Requests are free unless they are clearly unfounded or excessive.

9. Children

Fips is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

10. Security

We protect data with measures suited to the risk, including encrypted connections (HTTPS), passwords stored only as salted hashes, and access limited to the people who need it. No system is completely secure. If a breach affects your personal data, we will inform you and the authorities as the law requires. More details are in our Security Policy.

11. Changes to this policy

We will update this policy when our practices change and update the date at the top. If a change is material, we will also tell you by email or in the app.

12. Contact

T2MA Labs LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Email: [email protected]