Privacy Policy

Last updated: 2026-07-02

Insynet ("we", "us", "the app") respects your privacy. This policy describes what personal data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR, 2016/679).

1. Data Controller

Insynet (Nenad Milicevic), Stockholm, Sweden. Contact: hej@insynet.se. Company registration number will be added here upon incorporation.

2. What data do we collect?

Apple ID (anonymized) — for Sign in with Apple. We only see an anonymous identifier, not your real Apple email if you choose "Hide my email".
Email address — if you create an account in the app.
Watchlist & preferences — which stocks and signals you follow, stored in our database.
Push tokens — Apple Push Notification token to deliver alerts. Not tied to your real identity beyond your account.
Usage analytics — the app ships no analytics or tracking SDK and collects no behavioral data (e.g. screen views) about you. We only see aggregated, anonymous statistics that Apple itself provides via App Store Connect (e.g. number of downloads) — nothing is measured or sent from within the app.
Purchase history — subscription payments are handled by Apple/App Store. We only see status (active/inactive), never card details.

3. What we do NOT collect

Your full name (unless you provide it voluntarily)
Your location or GPS data
Contacts, photos, or microphone access
Payment card details — handled entirely by Apple
We never sell your data to third parties

4. How we use your data

Deliver the service (show signals, send notifications, manage your account)
Improve the app through anonymous usage patterns
Communicate important updates or security notices
Fulfill legal obligations (e.g. accounting of subscription revenue)

5. Third-party services (data processors)

Apple Inc. — App Store, Sign in with Apple, In-App Purchase, Push Notifications, App Analytics. apple.com/legal/privacy
Supabase Inc. — database and backend. Servers in the EU (Stockholm region, eu-north-1). supabase.com/privacy
Netlify — website hosting (insynet.se). netlify.com/privacy

5b. Data about insiders (GDPR Art. 14)

The app's feed shows names, roles and reported trades of company insiders, fund managers and members of the US Congress. This information comes exclusively from public, legally mandated regulatory filings — EU MAR Article 19 via Finansinspektionen, SEC Form 4/13D/13G in the US, and US Congress disclosures under the STOCK Act (House Clerk) — and we display it unaltered for informational and journalistic purposes under legitimate interest (GDPR Art. 6(1)(f)). Because this data is not collected directly from the individuals concerned, we provide this disclosure under GDPR Art. 14. Insiders who have questions about their data in Insynet can contact hej@insynet.se.

6. Legal basis (GDPR Art. 6)

Contract — data required to deliver purchased service
Legitimate interest — anonymous analytics and security
Consent — push notifications (you approve in iOS dialog)
Legal obligation — accounting and tax law

7. Data retention

We retain data while your account is active. When you delete your account, all personal data is erased within 30 days (except what law requires us to keep, e.g. accounting records for 7 years per Swedish Bookkeeping Act).

8. Your rights (GDPR)

Access — request a copy of your data
Rectification — correct inaccurate data
Erasure ("right to be forgotten") — delete your account entirely
Restriction — pause processing
Portability — export your data in machine-readable format
Objection — opt out of certain processing
Complaint — contact the Swedish Authority for Privacy Protection (IMY) at imy.se

Send requests to hej@insynet.se. We respond within 30 days.

9. Cookies on insynet.se

We use no tracking cookies. No ads. The website has no forms and collects no personal data. The only thing generated is anonymous server logs (IP address, page requested) which Netlify retains for up to 30 days for security purposes.

10. Security

All data is encrypted in transit (HTTPS/TLS 1.3) and at rest. Supabase is hosted in the EU (Stockholm region, eu-north-1). Sign-in is exclusively via Sign in with Apple — we use no passwords and therefore store no passwords (neither in plaintext nor hashed). In case of a personal data breach, we will notify you within 72 hours as required by GDPR.

11. Children

Insynet is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe your child has used the app, please contact us and we will erase the data.

12. Changes to this policy

For significant changes, we will notify you by email or in-app notice at least 30 days in advance.

13. Contact

Questions? Email hej@insynet.se