Privacy Policy

1. Controller

The entity responsible for the processing of personal data described here is:

Denis Suciu, trading as PocketPhantom
Bahnhofstrasse 29
8154 Oberglatt ZH
Switzerland
Email: [email protected]
Support: open a support ticket

This policy is based on the Swiss Federal Act on Data Protection (revFADP/nFADP, in force since 1 September 2023). Where visitors or customers in the European Union or EEA are concerned, the EU General Data Protection Regulation (GDPR) applies in addition.

2. Your rights

You have the right to request information about the personal data we hold about you, to have inaccurate data corrected, and to request its erasure, subject to any legal retention obligations. You may object to processing based on a legitimate interest, request data portability, and, where processing is based on consent, withdraw that consent at any time with effect for the future. To exercise any of these rights, open a support ticket from the email address on your account. You can delete your account yourself under Settings › Account: we email a six-digit code to confirm it, and the account is deleted 30 days later. Signing in during those 30 days cancels the deletion and keeps everything. After that the account and everything on it are deleted permanently, except what section 18 says we must keep. An account with a paid subscription still running can be deleted once the subscription has ended.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). EU residents may contact the supervisory authority in their member state.

3. Hosting & Cloudflare

The website, the web app and the account and subscription servers run on servers in Switzerland. Traffic to pocketphantom.com and its subdomains is routed through Cloudflare, Inc. (San Francisco, USA), which provides DNS, TLS termination, caching, DDoS mitigation, and bot protection. To do this, Cloudflare processes request metadata such as IP address, URL, user-agent, and a country-level location. Cloudflare is certified under the EU–US Data Privacy Framework and offers Standard Contractual Clauses. Legal basis: our legitimate interest in a secure, performant service (Art. 6(1)(f) GDPR; Art. 31 para. 2 lit. a revFADP).

4. Data collected by the website

Server log files

When you visit the website, the server automatically records browser type, operating system, referrer URL, the time of the request, and the IP address. This is used only for the secure, error-free operation of the site and is not used to identify you. Log files are deleted after a short period (typically 7 days).

Rate limits

To keep the service fair, the web chat, the pictures and the sign-in routes count requests per account and per network for a few minutes to an hour at a time. A counter is stored so it survives a restart, but it is stored against a one-way fingerprint of the account or the address rather than against the address itself, and the row is replaced as each window rolls over. Legal basis: our legitimate interest in keeping the service available and unabused (Art. 6(1)(f) GDPR).

5. Your account

An account is an email address. When you sign up or log in we process and store:

• your email address, and a name if you give one or your Google or Apple account provides one;
• your password, if you set one: stored only as a salted hash (scrypt), never in clear; a password-reset link is a one-hour, single-use token sent to your email. An account that signs in with Google or Apple has no password at all until you add one, which happens while you are signed in, under Settings then Security, and is confirmed by a six-digit code sent to your address, stored only as a hash, valid for ten minutes and five tries;
• two-step verification codes, if you switch it on: a six-digit code is sent to your email at a login from a new browser, stored by us only as a hash, valid for ten minutes and five tries, then discarded; a trusted-browser cookie lasts 30 days;
• if you set up an authenticator app: the secret your app and our server share to make its codes, and your backup codes, both stored encrypted until you turn it off;
• if you sign in with Google or Apple: the identifier, email, name and profile picture their account provides, and the tokens they issue, which we store encrypted and use only to sign you in;
• your sessions: a session token in a cookie, with the IP address and browser it was created from, valid for a month and extended while you use the Service; log out ends it;
• when your account last had the app open and the country that visit came from, which Cloudflare reads from your IP address, kept as one date, time and country that each visit replaces, so we can see who is using the Service right now and from where.

Your account owns your subscription, your scheduled tasks, your projects, your memory, your saved strategies, your pictures and your chats. Legal basis: performance of the contract (Art. 6(1)(b) GDPR; Art. 31 para. 2 lit. a revFADP).

6. The web chat

When you send a message on pocketphantom.com, that message, the recent messages of the same chat, any images or PDFs you attached, the instructions of the project it is in, what you told us about yourself in Personalisation, and the list of your memory notes (below) are sent to our server and on to the AI provider of the model you picked (section 9) to produce the answer, which streams back to you. GLM-5.3 and GLM-5.2 cannot see pictures: with one of them, your pictures and your message first go to PocketPhantom Noir at the same provider, which describes them for GLM. That description is not kept. GLM-5.3, GLM-5.2 and PocketPhantom Noir cannot read PDFs: with one of them, our server takes the text out of your PDFs and sends that text to the model in their place, and keeps neither. Web search is part of the answer: the model may send search queries derived from your message to the provider's search tool. When web search is on, the model may also look for real pictures on Wikimedia Commons: our server sends a few search words drawn from your message to the Wikimedia Foundation, Inc. (USA) and fetches the pictures itself, so Wikimedia receives neither your IP address nor anything about your account, unless you open a picture's source page yourself. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Your chats are saved to your account on our servers in Switzerland (section 3): the title, every message you and the AI wrote, when the chat was created and last used, which project it is in, and whether it came from a scheduled task. That is what lets a chat you started on one computer be there on the next one you log in on. You need an account to chat at all. If you type a message while signed out, that message is kept in your own browser so the box is not empty after you sign in; it reaches us only when you send it.

Memory. Your memory is a set of notes on your account, in folders, written by you in Settings › Memory or by the AI in a chat. With each message the model you picked gets a short list of them, about 2,500 characters at most: each note's title and its first sentence (up to 120 characters), or the whole note when it is short (up to 160), for as many notes as fit, with the names of your saved strategies, projects and scheduled tasks; it reads a longer note in full, a note that did not fit, or one of those, only when it needs it. When the AI saves, changes or forgets a note, the chat says so, and Undo takes it back. In Settings › Memory you can read, edit and delete every note, switch memory off, stop the AI saving notes itself, and stop it searching your earlier chats.

Earlier chats. When you refer to an earlier conversation, the AI can search your own saved chats for it, on our server. Temporary chats and other people's chats are never searched. The few lines it finds go to the model with that message.

Saved strategies. When you agree to save a trading strategy, in a chat or in Settings › Trading, we store it on your account: its name, your own description of it word for word, the rules made from it and the symbols it is for. When you describe one in Settings, your words go to the AI once to be turned into rules, and nothing is saved until you say yes. That one request always goes to the Auto model (GLM-5.3 today, at an AI provider in the USA, section 9), whichever model you chat with. The names, rules and symbols of your saved strategies are sent to the model you picked with your messages, so it can refer to them. They are kept until you delete them, are included in the file Export your data gives you, and are deleted by Reset the account and with your account.

Charts and code. For now every chart of exchange prices in a chat is TradingView's, and nothing loads from TradingView until you agree. The first chart asks: “Only this chart” loads that one, and “Always show TradingView charts” loads it and every TradingView chart after it without asking again. Your browser then loads each chart from TradingView, on the symbol, timeframe and indicators it opens on (sections 10 and 16). That yes is stored with your account's settings on our servers, so it applies in every browser you sign in on. Legal basis for loading TradingView's charts: your consent, given on the chart (Art. 6(1)(a) GDPR; Art. 31 para. 1 revFADP). You can withdraw it at any time: switch off “Load TradingView charts automatically” in Settings › Trading, and each chart asks again. Our server fetches no prices from exchanges at the moment, and it never contacts TradingView. For a coin TradingView does not list, the model finds prices with its web search, when web search is on, the same search as for any other question (above), and the chat draws them with links to the pages they are on. A check of a saved strategy works the same way: the model's web search finds the values, and our server checks your rules against them. Those pages receive nothing from us; your browser reaches one only if you open its link. Such a chart or check is kept as part of that chat, like a chart saved in an older chat with the prices it showed. The preview of an HTML page in a reply is drawn in your browser without its scripts and without any network access, so it cannot load anything from anywhere.

A temporary chat is saved too. Switching it on in the chat header keeps that conversation out of your history and answers it without your personalisation, your memory or a project's instructions, and it cannot make pictures. It is still stored on your account like any other chat, for as long as any other chat. It is not listed, so it cannot be deleted on its own: "Delete all chats" and deleting your account both remove it.

We keep a chat until you delete it. Deleting a chat from the menu beside it in the sidebar deletes it from your account, on every computer; Settings › Data deletes every chat at once; deleting your account deletes all of them with it. A chat that a scheduled task produced is the one exception worth naming: the same text is also held with the task's own run history, and deleting the chat does not remove that copy. Deleting the task, or your account, does. A picture you attach is kept with the chat, so the chat shows it again when you open it: stored on our server, with its location and other details the file carried taken out, and deleted with the chat. In a temporary chat it is not kept. A PDF is kept in memory for the message only: a saved chat keeps its name, not its contents. Your projects, with their names and instructions, are kept on your account as well, so they apply on every computer you log in on. Your model and effort choice is kept in this browser (section 10).

Dictation: when you press the microphone in the chat, your browser's own speech recognition turns your voice into text. Your browser may send the audio to its maker for this (for example Google for Chrome, Microsoft for Edge, Apple for Safari) under that company's own privacy policy. We never receive the audio, only the text you then send.

7. Scheduled tasks

A scheduled task is stored on our servers so that it can run while you are away: its text, its schedule and the time zone you planned it in, and, for each run, the result the AI produced, with the times it started and finished. A task set to run in chat is sent to the AI provider of the model the task uses, at its time, in the same way as a chat message (section 6). A task about markets also carries the names, rules and symbols of your saved strategies, as a chat message does, so the run can name the values each rule reads. Runs are kept so they can reach you as chats on your account; deleting a task deletes its stored runs, and closing your account deletes all of them. With “Email me when it runs” on, each run the clock starts also emails you the task's title and the first lines of its result, or why it could not run, through Resend (section 14). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

9. The AI providers

What you send goes to the company that runs the model you use:

• Claude models, and the titles of chats: Anthropic Ireland, Limited (Ireland). It may pass data to Anthropic PBC in the USA under the EU Standard Contractual Clauses, with the Swiss and UK additions. Anthropic deletes it within 30 days; it keeps it for up to 2 years if its safety systems flag it, and keeps Claude Fable chats for 30 days for safety review.
• GPT models, and every picture: OpenAI Ireland Ltd. (Ireland). It may pass data to OpenAI in the USA under the Standard Contractual Clauses. OpenAI keeps abuse-monitoring logs for up to 30 days, and stored responses for at least 30 days.
• The uncensored models (GLM-5.3, GLM-5.2 and PocketPhantom Noir), and Auto when it picks one, which today is every message without files and some with only pictures: an AI provider in the USA. It processes what you send in memory, in the USA. We do not have a data processing agreement with it yet, so no Standard Contractual Clauses cover this transfer; if you do not want your messages to go there, pick a Claude or GPT model. When a GLM model searches the web, your search words go to a search provider that it uses and does not name.

The docs list every model. Content you send to the AI, in the chat and in scheduled tasks, reaches the provider of the model you picked through our servers, on our own account, to produce the answer: your message, the recent messages of the same chat, any file you attached, and the standing instructions described in section 6. Pictures are made at OpenAI whichever model you chat with: the description the model writes from the conversation, or the words you type for the “Make a picture” button, goes to OpenAI through our servers, and the picture is kept on your account with that description until you delete it. We do not train any model on what you write, and none of the three providers trains on it either. There is no way to use your own AI account with PocketPhantom, so what leaves our servers is always what this section and section 6 describe. Naming a chat sends your first message and the beginning of the first answer to Anthropic in a second, separate request, for the title only. Drafting a strategy from your words in Settings › Trading always uses the Auto model (GLM-5.3 today, at an AI provider in the USA), whichever model you chat with.

The included-AI pool can be configured to route through a reseller that speaks the same API, in which case that reseller would receive the content before it reaches the provider. No reseller is in the path today. This page is updated if that changes.

10. Cookies & local storage

• pp.session_token (cookie, first-party) — your sign-in session. Strictly necessary; up to a month.
• pp.state, pp.pkce_code_verifier (cookies, first-party) — set for a few minutes during a Google or Apple sign-in to complete it safely. Strictly necessary.
• pp.trust_device (cookie, first-party) — remembers a browser you verified with a two-step code, 30 days. Only with two-step verification on.
• pp-lang (cookie, first-party) — the language you read the site in, once you pick one. Strictly necessary; one year.
• pp-cookie-consent (localStorage, first-party) — stores your cookie choice. Strictly necessary; persists until you clear it.
• pp-chat-settings, pp-sidebar (localStorage, first-party) — your model and effort choice, and whether the sidebar is collapsed, kept in this browser. Functional; persist until you delete them. Your chats and projects are not among them: they are on your account (section 6).
• pp-projects (localStorage, first-party) — where projects were kept before they moved to accounts. No new project is ever put in it. The Projects page offers to import the ones in it into your account and then removes it; deleting your account also removes it from this browser.
• pp-chats (localStorage, first-party) — where chats were kept before they moved to accounts. No new chat is ever put in it. The first time you log in after the change, the chats in it that are yours are copied to your account, and each one is taken out of this browser only once your account holds it: anything your account had no room for stays here and goes over next time there is room. Every carry-over rewrites the key with what is still waiting, and removes it once nothing is. Chats somebody else made on this computer are left here, for them, so the key can outlast your own chats by years. Chats from before accounts carry no name at all, so on a computer two people have used they stay here rather than being given to whoever logs in first. Deleting every chat on your account, or deleting your account, also deletes yours from here, including anything that was still waiting; other people's are left.
• pp-chats-owners, pp-chats-left (localStorage, first-party) — which accounts have logged in on this browser, and how many chats each was last told are still waiting in pp-chats. The first is what stops one person's old chats being copied into another person's account; the second is so we tell you once rather than on every page load. Account identifiers and counts only, nothing you wrote. Functional; persist until you clear them.
• pp_fid (localStorage, first-party) — a random, per-browser identifier used to de-duplicate anonymous funnel events (section 12). It contains no name, email, or other personal identifier.
• __cf_bm / cf_clearance (Cloudflare) — bot management and security-challenge clearance. Strictly necessary.
• _ga, _ga_* (Google Analytics) — loaded only after you click “Accept” on the cookie banner. See section 11.
• TradingView (third-party) — only after you agree on a chart in a chat, for that chart or for every chart (section 6): the chart then runs from tradingview.com, where you can pick any pair and exchange, and may keep its own cookies or storage for that site in your browser, under TradingView's own policy.

You can withdraw analytics consent at any time via “Cookie settings” in the footer, which re-opens the banner.

11. Analytics

With your consent, this website uses Google Analytics 4, a web-analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is loaded only after you accept analytics cookies on the cookie banner, and is not loaded at all if you decline.

When active, it collects aggregate usage data such as the pages you view, time on page, approximate location (country/city level), device and browser type, and the source that referred you. IP addresses are anonymised before processing. It sets the _ga and _ga_* cookies described in section 10. Data may be transferred to Google servers in the United States under the EU–US Data Privacy Framework.

Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 31 para. 1 revFADP). You can withdraw it at any time via “Cookie settings” in the footer. For details on Google's processing, see policies.google.com/privacy.

12. Funnel & conversion events

To understand how visitors move through the purchase flow and to measure how well it converts, PocketPhantom records a small number of funnel events on its own backend, such as a visit to the pricing page and a checkout form submitted.

These events are keyed by pp_fid, a random per-browser identifier stored in your browser's localStorage (section 10). The identifier lets us de-duplicate and sequence events from the same browser. From the moment you start a checkout, these events also record the email address of your account, together with the originating IP address and the country derived from it, so that a completed purchase can be matched to the visit that produced it. Earlier events carry no email. Legal basis: our legitimate interest in measuring and improving the conversion of our own website (Art. 6(1)(f) GDPR; Art. 31 para. 2 lit. a revFADP). You can stop and reset this at any time by clearing your browser's storage for this site, which removes the pp_fid value.

13. Payments — Stripe

Subscriptions are processed by Stripe Payments Europe Ltd. (Dublin, Ireland). When you pay, you are handled on Stripe's secure checkout; we never receive or store your full card details. Stripe processes your name, email, billing details, and card data under its own privacy policy. We receive your subscription status, the plan, the billing interval and seat count, and a customer/subscription identifier to grant and renew your subscription. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

At checkout Stripe records your acceptance of the box on its payment page, where you ask for the plan to start immediately and accept that your right of withdrawal ends once it has, together with the time. We keep this so that we can evidence the consent you gave at the time of purchase. Legal basis: compliance with our legal obligations and our legitimate interest in keeping accurate records of consent (Art. 6(1)(c) and (f) GDPR).

14. Email — Resend

We use Resend (Resend, Inc., San Francisco, USA) to send transactional emails: two-step codes, password-reset links, the code that sets a first password on an account that signs in with Google or Apple, the notice we send instead when such an account asks to reset a password it does not have, the link to manage your subscription, and to send and receive support correspondence (section 15). While “Email me when it runs” is on for a scheduled task, as it is for a new task until you switch it off, each run the clock starts also emails you the task's title and the first few lines of its result with a link to its chat, or why it could not run (section 7). Only your email address and the relevant transaction, support or task data are transmitted. Legal basis: performance of the contract and our legitimate interest in reliable delivery (Art. 6(1)(b) and (f) GDPR).

15. Support & contact data

When you contact us for support through the support form on this website, we collect and process the information you submit so that we can answer you and keep a record of the request:

• your first and last name and your email address;
• the category, subject, and message content you provide, together with any further correspondence in the same conversation;
• any screenshots you attach, up to three, which we keep with the ticket;
• for feedback sent from the app's feedback button, also the page you were on, whether you were signed in, the site's language, your window size and your browser's user-agent string.

We store the support ticket and the full conversation thread so that we can handle your request, follow up, and refer back to it if you contact us again. To send our replies and to receive and attach your email responses back to the ticket, we use our email provider Resend (section 14). Before submitting the form you confirm that you have read this Privacy Policy and our Terms of Service. Legal basis: performance of the contract where your request relates to your subscription, and otherwise our legitimate interest in responding to enquiries and providing support (Art. 6(1)(b) and (f) GDPR; Art. 31 revFADP). Support records are retained as described in section 18, and you may request erasure of correspondence that is not subject to a retention obligation.

16. Third-party processors — summary

• Cloudflare — DNS, proxy, TLS, caching, security (section 3).
• Anthropic Ireland, Limited (Ireland, with Anthropic PBC in the USA) — the Claude models and chat titles, as our processor, on our own account (section 9).
• OpenAI Ireland Ltd. (Ireland, with OpenAI in the USA) — the GPT models, and every picture whichever model you chat with, as our processor, on our own account (section 9).
• An AI provider in the USA — the uncensored models, and Auto when it picks one, on our own account; no data processing agreement yet (section 9).
• Your browser's maker— not our processor: only if you use the chat's microphone, your browser's speech recognition may send the audio to it under its own policy (section 6).
• Wikimedia Foundation, Inc. (USA) — not our processor but a recipient: when web search is on and the model looks for real pictures, our server sends it a few search words, with no account data and not your IP address (section 6).
• TradingView, Inc. (USA) — not our processor and never reached by us: once you agree to load TradingView charts in a chat, for one chart or for every chart until you switch it off (section 6), your browser connects to TradingView, which receives your IP address, your device and browser details, the page address, the symbol, timeframe and indicators shown and any pair or exchange you pick or search for in it, and may collect usage analytics, including through Google Analytics, under its own policy. Prices and strategy values from the web come through the model's own web search (section 6), which reaches no one new.
• Stripe — subscription payments (section 13).
• Resend — two-step codes, transactional email, scheduled-task emails and support correspondence (sections 7, 14 and 15).
• Google and Apple — only if you choose to sign in with them; they tell us who you are, under their own policies (section 5).
• Google Analytics 4 (Google Ireland Limited) — website analytics, only with consent (section 11).
• Discord (Discord Inc., USA) — operational notifications to a private staff channel. These include your email address, the subject and an excerpt of any support message you send us, and, for security alerts, an IP address and browser user-agent (sections 5, 14 and 15).

We do not sell or rent your personal data.

We disclose personal data to authorities only when we are legally required to, under a valid order or request from a competent authority.

17. International data transfers

Some of the processors above are located in, or transfer data to, the United States. As a result, personal data may be processed outside Switzerland and the EU/EEA. Where that happens we rely on recognised transfer mechanisms:

• Anthropic and OpenAI (their Irish companies, which may pass data to their US affiliates) — Standard Contractual Clauses in their data processing agreements; the content you send to the AI is covered.
• The uncensored models' AI provider (USA) — no safeguard in place yet: we have no data processing agreement with it so far (section 9).
• Cloudflare (USA) — certified under the EU-US Data Privacy Framework and offers Standard Contractual Clauses.
• Stripe (EU entity in Ireland, with group processing in the USA) — Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Resend (USA) — Standard Contractual Clauses.
• Google and Apple (USA), if you sign in with them — their own Data Privacy Framework certification and Standard Contractual Clauses.

For transfers from Switzerland, the equivalent Swiss safeguards apply (the Swiss-US Data Privacy Framework and the Swiss addendum to the Standard Contractual Clauses, recognised by the FDPIC). You can request a copy of the relevant safeguards by opening a support ticket.

18. Retention

• Account data (email, name, password hash, sessions): for as long as your account exists, including the 30 days after you ask for it to be deleted. Sessions expire after a month of no use. Two-step codes are discarded after ten minutes, reset links after an hour.
• Scheduled tasks and their runs: until you delete the task or your account is deleted.
• Chats on the web: on your account until you delete them, or until your account is deleted, which takes them with it. Nothing is deleted to make room. Projects: on your account, until you delete them. Saved strategies: until you delete them, reset the account or the account is deleted. Memory notes: the same. A note the AI forgets is hidden rather than erased, so Undo can bring it back. It is erased at the first change to your notes, by you or by the AI, once seven days have passed, and Export your data lists it until then; Forget everything erases every note at once.
• Sign-in records (each sign-in, failed sign-in, sign-out, password change and two-step change, with the address it came from): 180 days, then deleted automatically. Those still held when the account is deleted are kept as described below.
• Subscription and billing records (including metering: the model, the token counts and the account, with no part of what you wrote): for the duration of your subscription and for as long as required by statutory bookkeeping obligations (10 years under Art. 958f of the Swiss Code of Obligations), also after the account is deleted.
• After an account is deleted: its email address, name, creation and deletion dates, and its sign-in records (IP addresses and browser) are kept for 10 years from the deletion, so that we can deal with fraud and abuse and answer lawful requests from authorities. A suspension or ban on the account is kept until it is lifted, and at least as long. Data under a legal hold is kept until the hold is released. After that it is erased.
• Support tickets: kept after a ticket is resolved so it can be reopened or referenced, until you ask us to delete them.
• Server logs: deleted after a short period. Rate-limit counters: from minutes to an hour, against a fingerprint rather than an address.

You may request erasure of data not subject to a retention obligation at any time.

19. Encryption

All connections to the website, the web app, the account server and the AI relay use TLS encryption (the https:// padlock in your browser). Passwords and two-step codes are stored hashed; tokens from Google or Apple are stored encrypted. What you write in a chat is stored as ordinary text on our own database server, not encrypted a second time on top of that.