Privacy Policy

Last updated 9 November 2026

This Privacy Policy explains how Vangis Team (“Vangis”, “we”, “us”) collects, uses, and shares information when you use the Vangis mobile applications and the related service at vangis.xyz (together, the “Service”). By using the Service, you agree to this Policy. Questions: development@vangis.xyz.

1. Who we are

The Service is operated by Vangis Team. For privacy requests, email development@vangis.xyz. This Policy is governed by the laws of Singapore.

2. What Vangis is

Vangis provides market-insight views for crypto perpetual symbols. It does not open accounts on your behalf, does not place or execute orders, and does not ask for exchange API keys. Insights are for information only; see our Disclaimer and Terms of Use.

3. Information we collect

We do not require a name, email address, or password to use the Service. Depending on how you use the Service, we and our service providers collect:

• Device identifier. A platform device id (on Android, the device’s ANDROID_ID; on iOS, the vendor identifier) and the platform name (android or ios), sent when the app signs the installation in with our server. We use this to apply access control, free-tier or Pro entitlements, and abuse prevention.
• App attestation. When the app signs in, it also sends our server a Firebase App Check token (Google) attesting that the request comes from the genuine Vangis app on a device that passes the platform’s integrity check — Google Play Integrity on Android, Apple App Attest on iOS. The token names our app, not you or your device; the integrity check itself is run by Google or Apple under their own policies, and we receive only the resulting token, which we verify and do not store.
• Usage tied to that device. First-seen and last-seen times; how many Analyze runs were made on a given day on the Free pass (for quota enforcement; the symbols are not recorded).
• Radar alerts and push token. If you create a Radar alert, our server stores the alert's settings (signal preset, time window, filter thresholds, minimum score) and, so it can tell you about new matches once rather than repeatedly, the list of symbols currently matching it. Alerts belong to your subscription when you have one, so every device signed in with the same subscription shares them; otherwise they belong to this device's free-tier record. To deliver the notification, the app sends our server a push registration token issued by Firebase Cloud Messaging (Google); the token identifies this app installation to Google's push service and nothing else. Deleting an alert deletes its settings and matches; the token is kept while the device record exists.
• Consensus calls. Each time the app computes an Analyze consensus for a pair, it sends our server the pair, the call (long, short or stay out), its conviction and agreement, the readings behind it and the price at that moment, keyed to your subscription or free-tier record. The server later adds the pair's price 4 and 24 hours after the call. The recent calls for a pair are shown, without who made them, to every user who opens that pair, and we use the log to tune the consensus.
• Purchase credentials (Pro). If you subscribe, the app sends the store purchase token (Google Play) or the App Store original transaction identifier to our server so we can verify that your subscription is active. Our server keeps that token on file, together with the subscription's state and expiry date as the store last reported them and the devices signed in with it, so that it can recognise your subscription at the next launch, deliver Radar alerts while the subscription is active, and check with the store again when it is due to renew. We do not receive your card number or full billing address; payment is handled by Google or Apple.
• Network metadata. Your IP address, which our server and our network provider see with every request and use for security and rate limiting.
• Crash reports. The release apps report crashes and errors to Firebase Crashlytics (Google): the stack trace, device model, OS and app version, a Crashlytics installation identifier, and the app’s recent warning and error log lines (which may name the screen or crypto symbol in use). Crash reports carry no name, email, or advertising identifier.
• On-device only. Your watchlist and local caches stay on the device unless a future feature expressly syncs them; we do not currently upload the watchlist to our servers.

The apps do not use analytics or advertising SDKs, do not read advertising identifiers (GAID / IDFA), and do not show ads. If that changes, we will update this Policy first.

4. Information we do not require

We do not require your legal name, email, phone number, contacts, precise GPS location, photos, or microphone access to use core insight features. We do not ask for exchange API keys or private trading credentials. If a future optional feature needs more data, we will ask in-product and update this Policy.

5. How we use information

We use information to: operate, maintain, and secure the Service; authenticate free-tier and Pro access; enforce quotas and rate limits; verify and renew store subscriptions; diagnose crashes and keep the apps stable; run promotions and flash sales; prevent spam and abuse; improve features; and comply with law or respond to valid legal process.

6. Sharing with third parties

We do not sell your personal information as a standalone product. We may share information with third parties in these cases:

• Public market data providers. The app and our servers fetch public market data to power insight screens. Those endpoints may receive ordinary request metadata (such as IP).
• AI analysis provider. When you open the AI brief of a pair, our server sends Anthropic (the Claude API) a snapshot of that pair's public market data and the pair's recent consensus calls, and asks it to search the web for the coin's news. No device, account or usage record is included.
• App stores. Google Play and Apple process payments and subscription status under their policies.
• Infrastructure processors. The marketing and legal pages at vangis.xyz are hosted on Cloudflare Pages. The app API runs on Oracle Cloud (Batam, Indonesia), where the device, subscription, usage, redemption, alert, push-token and consensus-call records are kept; Cloudflare (including a Worker on API paths and a Tunnel to the VM) carries that traffic.
• Push delivery. Firebase Cloud Messaging (Google) delivers Radar alert notifications to your device; it receives the registration token and the notification's text (the preset, window, matching symbols and their figures).
• Crash reporting. Firebase Crashlytics (Google) processes the crash reports described in Section 3 on our behalf, to deliver stability reports to us.
• App attestation. Firebase App Check (Google), with Google Play Integrity or Apple App Attest behind it, issues the attestation token described in Section 3.
• Professional and legal. Advisors, or authorities, where required by law, to protect rights, or in connection with a merger, acquisition, or asset transfer involving Vangis.

We do not share information with advertising networks or data brokers.

7. Retention

• A daily Analyze count is deleted 3 days after that day.
• A consensus call is deleted 30 days after it was made.
• A device record, with its push token, is deleted 90 days after the device was last seen. The free-tier record of a device is deleted with it.
• A subscription record (the purchase token, its state and expiry, and the Radar alerts created under it) is deleted 7 days after the subscription expired without renewing.
• Radar alerts and their current matches are deleted with the subscription or free-tier record they belong to, or earlier when you delete the alert; a push token is forgotten when the push service reports it invalid.
• Access tokens issued by our server are short-lived and re-issued as needed; we do not publish a fixed lifetime in this Policy because configuration may change.
• Purchase-verification answers and similar caches may be held briefly for performance.
• Crash reports are kept by Firebase Crashlytics under Google’s retention rules (currently 90 days).
• Data stored only on your device remains until you clear app data or uninstall.

8. Your choices and requests

Because we key free-tier state to a device id, reinstalling or resetting the device may create a new id. To request deletion of server-side records associated with your device, email development@vangis.xyz and include the platform and, if you can, any subscription or device details that help us find the record. We may need to retain limited information when required by law, for fraud prevention, or to complete a store refund dispute.

You can cancel a subscription in your Google Play or App Store subscription settings. That stops future billing according to the store’s rules; it does not by itself erase historical ledger rows until retention rules or a deletion request apply.

9. Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has used the Service in a way that left data with us, contact development@vangis.xyz and we will take appropriate steps.

10. International processing

Our server and the records it keeps are in Indonesia (Batam and Jakarta). Cloudflare and Firebase Crashlytics may process information in other countries where they operate. By using the Service you understand that information may be transferred to those locations.

11. Changes

We may update this Policy from time to time. The “Last updated” date at the top will change. Continued use after an update means you accept the revised Policy. Material changes may also be called out in the app or on vangis.xyz when practical.

12. Contact

Vangis Team — development@vangis.xyz — https://vangis.xyz