This document is provided in English; the English version is authoritative.
Last updated: September 24, 2026 · Applies to elcaro.online (the terminal and GlobalPrediktor at /predictor), the ElcaroAi iOS app and the ELCARO AI Android app.
1. Who we are
ELCARO AI ("we") runs a free market-data and analytics service at elcaro.online and in our mobile apps. The service is operated by its owner, who is the data controller for the information described here.
Account. Username and email. If you sign up with a password, we store only a bcrypt hash of it, never the password itself. If you sign in with Apple, Telegram or GitHub, we store that provider's user ID and, if the provider shares them, your display name and email.
Things you create. Watchlists, portfolios, price alerts and Telegram alert settings, wallet addresses you choose to track, GlobalPrediktor predictions and alerts, and messages you send to support.
Optional trading connection. Only if you connect a trading account (the EVEDEX demo integration), we store its key encrypted at rest (Fernet / AES) and use it solely to place the orders you configure.
Push notifications. If you enable them in the app, your device's push token.
Technical logs. Our server logs each request (IP address, time, URL, browser/app identifier) for security and debugging. Logs are kept for 7 days.
Usage counts (no cookies). To know how many people use the website and the apps, our server counts unique visitors per day. It combines your IP address and browser/app identifier with a random value that is replaced every day and keeps only a short one-way hash of the result, which cannot be turned back into your IP or linked to your visits on other days. After each day only the totals remain. For signed-in users we also store the time of your last activity.
Website analytics. With your consent only, the website uses Google Analytics to count visits and see which pages are used. It sets cookies in your browser. Until you press “Accept” in the cookie banner, Google Analytics is not loaded at all. Advertising features and Google signals are switched off. The mobile apps do not use Google Analytics.
We do not collect payment details (the service is free; donations go straight to public crypto addresses), precise location, contacts or photos.
3. How we use it
To sign you in and keep you signed in across the terminal, GlobalPrediktor and the apps (one account).
To save and sync what you create, and to send the alerts and emails you ask for (verification, password reset, alerts).
To answer support messages.
To keep the service secure, find bugs and understand which features are used.
We do not sell or rent personal data, and we do not use it for advertising.
4. Who processes data for us
Amazon Web Services: hosting. Servers are in the EU (Frankfurt).
Google: Google Analytics on the website, and Gmail for sending our emails.
Apple, Telegram, GitHub: only if you use them to sign in or to receive alerts. Their own privacy policies apply.
Market-data providers (CoinGecko, Binance, Yahoo Finance, DefiLlama and others) receive requests from our server only. No personal data is sent to them.
5. Cookies and local storage
Necessary (no consent needed): your sign-in token, interface preferences (language, layout) and your cookie choice, stored in your browser or on your device. GlobalPrediktor uses a session cookie and a language cookie.
Analytics (only if you accept): Google Analytics cookies _ga and _ga_*, which last up to 2 years. The legal basis is your consent (GDPR Art. 6(1)(a)). We ask again after 12 months. You can withdraw consent at any time; we then stop Google Analytics and delete its cookies.
6. How long we keep it
Account data is kept while your account exists. Server logs are kept for 7 days. To delete your account and everything linked to it, email elcaronosam@gmail.com from the address on the account. We complete deletion within 30 days.
7. Security
All traffic uses HTTPS/TLS. Passwords are stored only as bcrypt hashes and trading keys are encrypted at rest. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you.
8. Your rights
Depending on where you live (for example under the EU GDPR), you can ask to access, correct, export or delete your data, and object to or restrict its use. Email or message us on Telegram and we will reply within 30 days. You can also complain to your local data-protection authority.
9. Children
The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Changes
If we change this policy, we will update the date above and, for significant changes, tell you on the site or in the app.