Privacy Policy
The short version. Insider Ledger works without an account. We never ask for your name, email address, phone number or location. The app sends us only what it needs to build your brief and alerts: a random device token, your watchlist and settings, and, if you turn them on, a push token. We do not sell or share personal data, we run no advertising or analytics SDKs in the app, and you can delete your data at any time from Settings → Delete my data.
1. Who we are
Insider Ledger (the "app" and the website insiderledger.boralabs.app) is operated by [OWNER: developer legal name], [OWNER: postal address], Türkiye ("we", "us"). We are the data controller for the personal data described here, including for the purposes of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Contact: support@boralabs.app.
2. What leaves your device, and why
The table lists every kind of data the app sends off the device, who receives it, why, and how long it is kept.
| Data | Sent to | Why | Kept |
|---|---|---|---|
| Device token: a random value created by the app. We store only its SHA-256 hash. | Our API | To recognize your device's watchlist and settings without an account | Until you delete your data, or 180 days after the app was last used |
| Push token (Expo push token) | Our API, then Expo and Apple Push Notification service or Firebase Cloud Messaging | To deliver the briefs and alerts you turned on | Same as the device token |
| Watchlist, followed insiders, alert settings and rules, time zone, brief time | Our API | To build your brief and send your alerts | Same as the device token |
| Product interaction: when you last viewed a company, what you have seen, app version, when the app was last used | Our API | Change dots on your watchlist, the minimum-version check, and removing inactive devices | Same as the device token |
| RevenueCat anonymous app user ID and subscription status | RevenueCat and our API | To check whether Insider Ledger Pro is active | Same as the device token. On Delete my data we also ask RevenueCat to delete its subscriber record |
| Filing reports: the reason you chose and an optional note | Our API | To correct mistakes | 365 days. On Delete my data the note is cleared and the report is no longer linked to your device |
| IP address, user agent and requested path (without search terms or other query parameters) | Our server logs (nginx) and in-memory rate-limit counters | Security and rate limiting | 14 days in logs; rate-limit counters are kept in memory only |
| Thesis notes, recent searches, theme | Nowhere: they stay on your device (and in your device's own iCloud or Google backup) | Your own use | On your device until you delete them |
| Crash reports | Apple and Google, through their own consoles, if you allow it in your device settings. We use no third-party crash SDK | App stability | Under Apple's and Google's own policies |
Not collected: your name, email address, phone number, location, contacts, advertising ID, brokerage or bank data, and in-app analytics events. The app does not track you across other companies' apps or websites, and it shows no ads.
Purchases. Subscriptions are bought through Apple or Google. We never see your payment card or store account details; we receive only the subscription status, through RevenueCat.
3. Public filings and AI summaries
Insider Ledger reads public filings from the U.S. Securities and Exchange Commission's EDGAR system. Some 8-K summaries are written by Anthropic's Claude. Only the public filing text is sent to Anthropic for this, never anything about you or your device. The same summary is shown to everyone who can see it.
4. People named in public filings
Insider filings (Forms 3, 4 and 5) and 8-Ks name company directors, officers and large shareholders. We process these names as follows.
- Source: filings that the person or the company made public on the SEC's EDGAR system.
- Purpose: to show those filings in plain English and to alert users who follow the company or the person.
- Legal basis: the data was made public by the data subject or the company (KVKK Article 5(2)(d); GDPR Article 9(2)(e) where relevant), and our legitimate interest in presenting public filings accurately (GDPR Article 6(1)(f); KVKK Article 5(2)(f)).
- What we do: we show the name, role, transaction details, footnotes, remarks and filing dates as filed, with a link to the original filing on sec.gov.
- What we don't do: we do not combine filings with other sources about a person, we do not publish pages about individual people on the web, and share pages for single filings (insiderledger.boralabs.app/f/…) are marked so that search engines do not index them. In our own labels and sentences, indirect ownership is shown only as the relationship ("by trust"), never as a family member's or a trust's full name. The filing's own footnotes and remarks are shown as filed, so they can include such names.
- Corrections and objections: write to support@boralabs.app. We fix errors in how a filing is shown, usually within 2 business days. We cannot change what was filed with the SEC.
5. The website insiderledger.boralabs.app
insiderledger.boralabs.app uses Cloudflare Web Analytics to count page views. It is cookieless and aggregate: it sets no cookies, does not use your IP address to identify you, and does not follow you across sites. The app does not use it. Our web server keeps standard access logs (IP address, user agent, requested page) for 14 days for security. The website sets no cookies of its own and shows no ads.
6. Where your data goes: servers, processors and transfers
Our API server and its database run on Oracle Cloud Infrastructure in the Germany Central (Frankfurt) region. We use these service providers (processors), each only for the purpose shown:
- Oracle (Oracle Cloud Infrastructure): hosting of our server, database and encrypted backups.
- Cloudflare: domain name service, website analytics, and forwarding of email sent to support@boralabs.app.
- Expo, with Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): delivery of push notifications.
- RevenueCat: checking subscription status for Insider Ledger Pro.
- Anthropic: AI summaries of public filing text only. No personal data is sent.
- Apple and Google: app distribution, in-app purchases and, if you allow it, crash reports.
Cross-border transfers. We are based in Türkiye, and these providers process data in other countries, including the United States and the European Union. For transfers of personal data abroad we rely on standard contracts or data processing agreements with each provider. Where KVKK applies, we use the standard contracts published by the Personal Data Protection Authority and notify the Authority as KVKK Article 9 requires. Where the GDPR applies, we use the European Commission's standard contractual clauses or another valid transfer mechanism.
7. Backups and security
All traffic between the app and our API is encrypted in transit (HTTPS). Server backups are kept for 14 days on the server and for 35 days in Oracle Object Storage. When you delete your data, it therefore leaves every backup within 35 days. Device tokens are stored only as hashes.
8. Deleting your data
- In the app: Settings → Delete my data. This deletes your device record, watchlist, followed insiders, alert rules, delivered alerts and briefs from our database right away. Filing reports keep only their reason; the note is cleared and the link to your device is removed. We also ask RevenueCat to delete its subscriber record. Deleting your data does not cancel a store subscription; cancel it in your Apple Account or Google Play settings.
- By email: write to support@boralabs.app. Because there is no account, we may ask you for details shown in the app so that we can find your device.
- Automatically: device data is deleted 180 days after the app was last used.
Thesis notes, recent searches and your theme live only on your device. Removing the app removes them, except from your device's own iCloud or Google backup.
9. Your rights
Everyone
You can ask us what data we hold about your device, ask us to correct or delete it, and object to its use, by writing to support@boralabs.app. We answer within 30 days.
Türkiye (KVKK)
Under KVKK Article 11 you can learn whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used for that purpose, learn the third parties in Türkiye or abroad to whom it is transferred, request correction or deletion, request that third parties be notified of a correction or deletion, object to a result that arises from automated analysis and is against you, and claim compensation for damage caused by unlawful processing. Send requests to support@boralabs.app.
California (CCPA/CPRA)
In the last 12 months we collected identifiers (the device token, push token and RevenueCat app user ID), commercial information (subscription status), internet or network activity (product interaction and server logs) and user-provided content (filing reports, watchlist and alert settings), for the purposes in section 2 only. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information. You have the right to know, delete and correct personal information, and we will not treat you differently for using these rights. You can use them in the app (Delete my data) or by email.
European Economic Area and United Kingdom (GDPR)
If Insider Ledger is offered where you live and the GDPR or UK GDPR applies, our legal bases are the performance of our contract with you (providing the brief, alerts and Pro features you asked for) and our legitimate interests (security, rate limiting, preventing abuse, and presenting public filings). You can request access, correction, deletion, restriction, portability and object to processing, and you can complain to your local data protection authority.
10. Children
Insider Ledger is not directed to children. You must be 18 or older (or the age of majority where you live) to use Insider Ledger Pro. If you believe a child has sent us data, write to us and we will delete it.
11. Changes to this policy
We will post any change on this page with a new date. If a change affects how we use data already collected, we will also say so in the app before it applies.
12. Contact
Questions, requests and complaints: support@boralabs.app.