Privacy Policy

NestCalc.ai LLC dba CertusFX ("CertusFX," "we," "us," or "our") is a Wyoming limited liability company. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the CertusFX application (the "Service"). By using the Service, you consent to the practices described in this policy.

Creating an account is optional — the app works without one. If you create an account, we collect your email address and an encrypted password. Authentication is managed by Supabase, and the emails that confirm your address or reset your password are delivered through Brevo. We do not store your password in plaintext. Accounts are operated by NestCalc.ai LLC for CertusFX only: your CertusFX account is not shared with, and does not sign you in to, any other NestCalc app.

Your preferences — base currency, language, theme, watchlists, and rate alerts — are stored on your device, not on our servers.

If you have an account, we store against your account profile what gives you access to the full app, so it is recognized across your devices: when your free trial started, when you bought the lifetime unlock and whether it was one of the first 1,000 sold on its store (a founding purchase), whether you are an early user (you had the app installed before the one-time unlock was introduced, or created your account before then), and, for a pass bought earlier, its expiry date. We also keep a record of each purchase — the app store transaction ID or Stripe Checkout session ID, the product bought, the dates a pass covers, and any refund of it — which we use to grant what you bought, count founding purchases, and apply refunds.

If you purchase in the iOS or Android app without an account, the purchase is honored on the purchasing device and the grant is held server-side against the purchase's app identifier — the anonymous customer ID our purchase provider, RevenueCat, creates for your installation, not any personal data — until you sign in and it attaches to your account.

If you start the free trial in the iOS or Android app without an account, we record when it started against that same anonymous app identifier, so the trial runs its 14 days once and is not started again. If the app finds that it was installed before the one-time unlock was introduced, it asks our server to record you as an early user; our server confirms this by asking RevenueCat when it first saw that app identifier, and records the identifier and that date. When you sign in, the trial start date and the early-user record are also recorded on your account (the earliest trial start is kept). These records hold no personal data: an anonymous app identifier and dates.

If you start the free trial on the web without an account, nothing is stored on our servers: your browser keeps a short code our server signs, which holds only the time the trial started.

If you purchase on the web without an account, our server creates a random code for that purchase and your browser stores it in its local storage, beside the code of any other purchase made in that browser; holding that code is what makes the purchase work in that browser. A code is created when you start a checkout, so your browser may also keep the code of a checkout you cancel or leave; such a code never becomes a purchase. Our servers never store the code itself: we keep a one-way (SHA-256) hash of it, a one-way hash of the email address entered at Stripe Checkout, and the purchase details (the Stripe Checkout session ID, the product, and, for a pass, its dates). The email hash is used only to find a purchase when you contact support — never to grant or move one. You can save a purchase to an account by signing in from the browser that holds it; each record then also notes the account it was saved to.

If you purchase in the iOS or Android app, payment is processed by the app store you buy through — the Apple App Store or Google Play — and we do not receive or store your card details; the store provides us only your purchase status.

If you purchase the lifetime unlock on the web at certusfx.com, it is sold to you by Link (Stripe) as merchant of record, on Stripe's own hosted Checkout page. Link — not CertusFX — is the seller of that purchase: it calculates, collects and remits any sales tax, VAT or GST, sends your receipt, and handles payment support and disputes. You enter your payment details, your name and billing address, and an email address there, directly with Link and Stripe, and we never receive your full card number. To create the Checkout, we send Stripe the product you chose and a reference linking the payment to you — your account ID if you are signed in, otherwise the random purchase code described above — and, if you are signed in, your account email address. From Stripe we receive whether the payment succeeded, the Checkout session ID, the product bought, and the email address entered at Checkout; for a purchase made without an account we store only the hash of that email, and show the address itself only in the browser holding the purchase, to fill in the optional account form. Stripe's payment and refund notifications to us also carry the name and billing details entered at Checkout and limited card details, such as the card brand and last four digits; we use them only to process that purchase or refund and do not store them.

Our hosting infrastructure automatically records minimal technical information such as request paths, device type, and timestamps. This data helps us improve performance and diagnose issues.

Our hosting provider, Netlify, receives your IP address and the details of each request as part of serving the website and our server functions. Our server functions hold your IP address briefly in memory to limit abusive request rates and do not store it. Their logs can include your account ID, app store transaction IDs and Stripe Checkout session IDs in connection with purchases, saved purchases and refunds.

The CertusFX apps for iOS and Android use Google Firebase Crashlytics and Google Firebase Analytics. They collect crash and diagnostic data (such as the error and where in the app it happened), your device model, operating system and app version, a pseudonymous identifier for your installation of the app, and in-app usage events — for example, which screens are opened, and whether onboarding was finished, a free trial was started, a purchase was started, completed or cancelled, an alert was created or a pair was added to a watchlist.

These reports never include your name, email address, account ID or your device's advertising identifier. We do not attach any of those to them, and the apps are configured so Firebase does not collect the advertising identifier. Firebase Analytics uses your IP address only to estimate a coarse location, such as your country, and does not keep it. We use this data for app stability and product improvement only: it is not sold and is not used for advertising. The web version of the Service does not use Firebase.

We use the information we collect to:

The AI trend outlooks shown in the app are generated from public market data only — no personal data of any user is involved in producing them.

We rely on the following third-party services to operate CertusFX. Each service receives only the minimum data required to perform its function:

CertusFX uses device local storage (not traditional cookies) to:

We do not use third-party tracking cookies. We do not use advertising cookies. If Supabase sets cookies for session management, those are governed by its privacy policy. Stripe's Checkout page is operated by Stripe on its own website, and any cookies it sets there are governed by Stripe's privacy policy.

We retain your account data for as long as your account is active. If you delete your account, we delete your sign-in — your email address and password — and the access record on your profile (your trial, lifetime unlock, early-user and pass dates) within 30 days. See our Delete data page for how to request deletion.

We keep the records of your purchases and refunds described in Section 1 after your account is deleted, because we need them to honor refunds and for our tax and accounting records. Once your account is deleted, those records carry only the random account ID and the app store or Stripe transaction reference they were recorded under — not your email address or any other account detail. The record of a web purchase made without an account keeps the one-way hash of the checkout email described in Section 1.

Our records of purchases and refunds, and the trial and early-user records kept against an anonymous app identifier, described in Section 1, are not removed automatically. Link, Stripe, Apple and Google keep their own records of the payments they process, under their own policies.

Cached market data (rates, yields, trend outlooks) contains no personal data.

Firebase Crashlytics keeps crash reports and their identifiers for 90 days, after which Google begins deleting them. Firebase Analytics keeps event-level and user-level data for 14 months, after which it is deleted automatically; reports that hold only totals, such as a daily count of users, are not covered by that limit and carry no identifiers.

We implement reasonable technical and organizational safeguards to protect your data:

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

For a purchase made on the web, you can also ask Link to delete your information from its records of the purchase and from your Link account; Link then removes it from the payment records it keeps, including those held in our Stripe account.

California Residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@nestcalc.ai.

European Residents (GDPR): If you are located in the European Economic Area, you have additional rights including the right to lodge a complaint with your local data protection authority. Our lawful basis for processing is contract performance (providing the Service) and legitimate interest (improving the Service).

CertusFX is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at support@nestcalc.ai.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or an in-app notice. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Effective Date: October 12, 2026