Privacy Policy

Version 2026-10-03 · in force from 2026-10-03

This policy explains what personal data Scope Signals collects, why, and what you can do about it. We keep it short and specific on purpose.

1. Who we are

Scope Signals operates scopesignals.com and the Scope Signals app, and is the data controller for the data described here. Contact: [email protected] or Telegram @scopesignals.

2. What we collect

• Email address — given when you subscribe, used to send your access code and service messages.
• Access code and subscription status — which plan you have, when it was issued and when it expires.
• Sign-in activity — when your code was first and last used.
• Device identifier — a random ID that the app creates on your device and keeps in its local storage. It is sent with app requests so we can count active devices per access code and notice shared codes. It is not linked to your phone's hardware or advertising ID, and it is deleted when you remove the app or clear its data.
• Consent record — date, time, IP address and the version of the terms you accepted (see section 4).
• Notification subscription — if you enable push, the technical endpoint your browser gives us, so notifications can reach your device.
• Technical and traffic data — IP address, approximate visit information and, where present, the campaign tag in the link you arrived from.
• Language preference, so we write to you in the right language.

We do not collect or store card or bank details. Payments are handled entirely by Stripe, and we only see that a payment succeeded or failed.

3. Why we use it and our legal basis

• To provide the service — issuing your code, keeping your access valid, sending signals and service emails. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To keep the service secure and prevent abuse — detecting shared codes, fraud and attacks. Legal basis: legitimate interests (Art. 6(1)(f)).
• To establish and defend legal claims — in particular proving that our terms were presented and accepted if a payment is disputed. Legal basis: legitimate interests (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c)).
• To meet accounting and tax obligations. Legal basis: legal obligation (Art. 6(1)(c)).

We do not sell your data, we do not use it for profiling or automated decisions with legal effects, and we do not send marketing to people who did not ask for it.

4. Records of your consent

When you accept our terms — at checkout or in the app — we record the date and time, your IP address and which version of the terms was shown to you. Stripe keeps its own equivalent record for the checkout tick.

We do this for one reason: if a payment is later disputed, we must be able to show that the terms were presented and accepted. Your IP address is part of that evidence; without it the record proves very little. We store this separately from your other data and never use it for marketing or analysis.

5. How long we keep it

• Account and subscription data — while your subscription is active and for 12 months afterwards.
• Consent records — for as long as a related claim or payment dispute remains possible, up to 10 years, because that is the period in which such a claim can be brought. Then deleted.
• General technical and traffic logs — 90 days.
• Invoices and accounting records — for the period required by tax law.

6. Who we share it with

We do not sell or rent your data. We share only what is necessary with:

• Stripe — payments and subscription management;
• Cloudflare — protecting and delivering the website;
• Zoho Mail — sending our emails;
• browser push services (such as Google, Apple, Mozilla) — delivering notifications to your device;
• our hosting provider in the EU.

We may also disclose data where the law requires it, or to a payment provider when defending a disputed payment.

7. Transfers outside the EEA

Our servers are in the EU. Some of the providers above may process data outside the EEA. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

8. Cookies and local storage

We use only what the service needs to work: a cookie holding your access code so you stay signed in, Cloudflare's security cookie, and your browser's local storage for your language, theme and access code. We do not use advertising or tracking cookies, and there is no third-party ad network on our site.

9. Your rights

Under the GDPR you may ask us to:

• give you a copy of your data, or correct it;
• delete it, or restrict how we use it;
• transfer it to another provider;
• object to processing based on legitimate interests.

Write to [email protected] and we will reply within 30 days, free of charge. Note that we may keep a consent record even after an erasure request, where it is still needed to defend a legal claim; in that case we will tell you and keep nothing beyond what is necessary.

You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or to the authority in your own country.

10. Security

Data is held on a server in the EU with restricted access, the site is served only over encrypted connections, and off-site backups are encrypted. No system is perfectly secure, but we take this seriously and keep the amount of data we hold deliberately small.

11. Children

The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.

12. Changes

If we change this policy materially, we will tell you by email or in the app at least 14 days before it takes effect, and previous versions are kept.

13. Contact

Email [email protected] or Telegram @scopesignals.

Also available in Lietuvių and Español.