1 Information We Collect

1.1 Information You Provide Directly

When you create an account or interact with the Service, we may collect:

1.2 Information Collected Automatically

When you access the Service, we may automatically collect:

• Usage Data — Prediction history (asset queried, direction, timestamp), feedback on predictions (like/dislike), token consumption patterns.
• Device & Browser Data — IP address, browser type and version, operating system, device identifiers.
• Log Data — Server access logs, error logs, timestamps of requests.

1.3 Information from Third Parties

If you register or log in using Google OAuth, we receive your Google profile information (name, email, profile picture) in accordance with Google's OAuth consent flow. We do not access your Google contacts, files, or any other Google services data.

2 How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery — To operate, maintain, and provide you with the core features of BinaryFusion, including signal generation, token management, and Telegram alerts.
• Account Management — To create and manage your user account, process subscription payments, and handle token refills.
• Communication — To send transactional emails (e.g., password resets), service announcements, and optional newsletters (with your consent).
• Analytics & Improvement — To analyze usage patterns, measure algorithm performance based on user feedback, and improve the accuracy of our prediction engine.
• Security — To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
• Legal Compliance — To comply with applicable laws, legal processes, and regulatory requirements.

3 Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share your information only in the following circumstances:

3.1 Service Providers

We share limited data with trusted third-party service providers that assist us in operating the Service:

• NOWPayments — Receives payment-related data for cryptocurrency transaction processing.
• Binance Pay — Receives payment-related data for cryptocurrency deposit processing.
• Supabase (PostgreSQL) — Hosts our primary database infrastructure.
• Render.com — Hosts the web application server.
• Google — Processes OAuth authentication requests.
• Gmail SMTP — Delivers transactional emails (password resets).

3.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, subpoena, court order, or other governmental or legal request.

3.3 Business Transfers

If BinaryFusion is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

4 Data Storage & Security

4.1 Where We Store Your Data

Your data is stored on servers managed by Supabase (PostgreSQL hosted in AWS ap-northeast-1 region) and Render.com. Media files (profile pictures) are stored on the application server.

4.2 Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Password Hashing — All passwords are securely hashed using Django's default PBKDF2 algorithm with SHA-256.
• CSRF Protection — All forms are protected against Cross-Site Request Forgery attacks.
• HTTPS Encryption — All data transmitted between your browser and our servers is encrypted via TLS/SSL.
• IPN Verification — Payment callbacks from NOWPayments are verified using HMAC-SHA512 signatures.
• Access Controls — Admin access to the Django admin panel is restricted to authorized personnel only.

5 Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the Service. Specific retention periods include:

• Account Data — Retained until you request account deletion.
• Payment History — Retained for a minimum of 3 years for financial record-keeping and dispute resolution.
• Prediction History — Retained for the duration of your account to power analytics and personal dashboards.
• Support Tickets — Retained for 2 years after ticket resolution for quality assurance purposes.
• Server Logs — Retained for up to 90 days for security and debugging purposes.

When data is no longer needed, it will be securely deleted or anonymized.

6 Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access — You may request a copy of the personal data we hold about you.
• Right to Rectification — You may update or correct inaccurate personal data through your dashboard settings.
• Right to Deletion — You may request the deletion of your account and associated data by contacting support. Certain data may be retained as required by law.
• Right to Object — You may object to the processing of your data for specific purposes.
• Right to Data Portability — You may request your data in a structured, machine-readable format.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected].

7 Cookies & Tracking Technologies

BinaryFusion uses the following cookies and similar technologies:

• Session Cookies — Essential for authentication, maintaining your login state, and CSRF protection. These are strictly necessary and cannot be disabled.
• Preference Cookies — Store your theme preference (light/dark mode) and timezone settings for a consistent experience.

We do not use third-party advertising cookies or behavioral tracking pixels. We do not participate in ad networks or cross-site tracking.

8 Children's Privacy

BinaryFusion is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will take steps to promptly delete such information. If you believe a minor has provided us with their data, please contact us immediately.

9 International Data Transfers

Your information may be transferred to and processed in countries other than your own, including Japan (database hosting via AWS), the United States (service providers), and Bangladesh (business operations). By using the Service, you consent to the transfer of your data to these jurisdictions, which may have data protection laws that differ from those in your country.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post the revised policy on this page.
• For significant changes, send an email notification to registered users.

Your continued use of the Service after any modifications constitutes your acceptance of the updated Privacy Policy.

11 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us: