In short

• Prices, charts, the converter and search work without an account.
• An account needs a mobile number or a Google account. What you post in the community is public; your watchlist, portfolios and price alerts are private.
• We do not sell your data, show ads, or use analytics or advertising trackers.
• Your data is kept on servers in Iran. You can download it or delete your account at any time in Account.

Without an account

You can browse markets, coin pages, charts, the converter and search without signing in. Your settings (language, currency, theme), and a watchlist and price alerts you make before signing in, stay on your device: in the app’s storage, or on the website in cookies and the browser’s local storage. Like any website, our servers see the requests your device makes, including its IP address (see “Technical data”).

Your account

To post, follow, keep a portfolio or receive alerts you need an account. You sign in with:

• Your mobile number: we text a one-time code to it. Your number is never shown to other users.
• Your Google account: Google gives us the account’s ID and its verified email address. We use them only to sign you in and, if needed, to contact you about your account; we do not use your Google name or photo. Google knows that you signed in to Bitisi with it, and where the website shows Google’s sign-in button, the button itself is loaded from Google.

An account can have either one or both. You then choose a username and, if you like, a display name, a bio and a picture: this profile is public. While joining is by invitation, we also keep which invite code admitted you and the codes you pass on.

What is public and what is private

Public — anyone can see it on the website and in the app, with or without an account: your profile; your posts, replies and reposts and the pictures in them; and the counts of likes, replies, followers and the like. An account you follow can see that you follow it, and when you like, repost or reply to a post, mention someone or follow them, they get a notification naming you.

Pictures are re-encoded when you upload them, which removes their hidden details such as location and camera information.

Private — only you can see it: your bookmarks, the accounts you block, your watchlist, your portfolios (the transactions you record, with amounts, prices, fees, dates and notes) and your price alerts. We use them only to show you prices, values and profit and loss, and to check your alerts against the market.

Reports you send about a post or an account go to our moderators, who may look at any post while they review one.

A post you delete disappears for everyone at once, and so do its pictures: their links stop opening right away. A hidden copy of the post stays with your account — moderators can still see it, and it is in your data download — until the account is erased; its pictures are erased for good 30 days after the deletion.

Notifications

• Push notifications: when you turn them on, we keep this device’s push token, its platform, its language and the app version, to send it price alerts and other notifications. On Android they travel through Google’s Firebase Cloud Messaging, which sees the token and the notification’s text; in a browser, through the push service of the browser’s maker, which receives them encrypted. Turning notifications off, or signing out, removes the device.
• SMS: if you choose to receive critical alerts by SMS, they are sent to your number through Kavenegar.
• Bale: if you link the Bale messenger, we keep your Bale chat ID and username to send you critical alerts there. Unlinking deletes them.

Technical data

• IP addresses: our servers see the IP address of every request. We use it to keep the service running and safe — for example to limit abuse — and to look into problems. Server logs include IP addresses. Our central log store removes phone numbers and email addresses from them and keeps them for 14 days; each service’s own short log is overwritten as it fills up.
• Signed-in devices: for each sign-in we keep the device’s name as your phone or browser reports it, its type, the browser or app identifier, its last IP address and when it was last used, so you can see your devices and sign them out in Account. A device’s record is removed 90 days after you sign it out or last use it.
• Signing in: sign-in codes are stored only in scrambled (hashed) form and expire after 2 minutes. The app keeps its sign-in tokens in the phone’s secure storage and the website in a cookie that page scripts cannot read; we store only a hash of them. A sign-in ends after 60 days without use.
• Error reports: when the app or our servers hit an error, a report goes to our own error-tracking server (GlitchTip, which we run ourselves). Phone numbers, email addresses, tokens and codes are removed first. App reports contain the app version, the phone’s model and Android version and, for crashes, a random ID of this installation, never your account; the IP address they come from is kept only in shortened form. Reports are kept for 30 days.
• Post views: to count each person’s view of a post once in 6 hours, we note for that long who has seen it — for someone not signed in, as a scrambled code made from the IP address and the browser.
• Cookies and storage on the website: cookies keep your preferences (for a year) and, while you are signed in, your sign-in; the browser’s own storage keeps conveniences such as recent searches, and a copy of pages and prices for offline use. There are no advertising or analytics cookies.
• Neither the app nor the website contains analytics, advertising or tracking tools.
• The Android app asks for permission to show notifications only when you turn alerts on, and reads only the photos you pick for a post or your profile; it has no access to your camera, microphone, location or contacts.

Where it is kept, and who else receives it

Everything we hold is on our servers and in our cloud storage at ArvanCloud, in Iran. Backups of the databases that hold personal data are encrypted and kept for 14 days. We may also keep a copy of the encrypted backups and of uploaded pictures with a second storage provider in Iran.

Only these services receive personal data from us, and only for what is named:

• ArvanCloud: hosting our servers, storage, and our domain’s network services (DNS and, where used, its content delivery network).
• Kavenegar: your mobile number with the sign-in code or the alert, when we text you.
• Google: Sign in with Google, if you use it; and Firebase Cloud Messaging for notifications on Android.
• Your browser maker’s push service, for notifications in a browser (encrypted).
• Bale, if you link it: the alerts we send you there.

Prices come from exchanges and price services; we only fetch public market data from them and send them nothing about you. We do not sell or rent your data, and we disclose it to authorities only when the law requires it.

How long we keep it

• Your account and what it holds: until you delete the account (below).
• Notifications: 90 days once read, 180 days unread. Alert history: 180 days. Records of the pushes, SMS and Bale messages sent to you: 30 days.
• Pictures of a deleted post: 30 days. Records of signed-out or unused devices: 90 days.
• Server logs: 14 days in the log store. Error reports: 30 days. Backups: 14 days.
• Short-lived internal copies, such as caches and message queues, are gone within two weeks.

Your choices: download, correct, delete

• Download: Account → Download your data gives you everything your account holds in one file (up to 5 times a day).
• Correct: change your profile at any time with Edit profile.
• Withdraw: turn notifications off, unlink Google (while the account has a mobile number) or Bale, and sign devices out — all in Account.
• Delete: Account → Delete account, confirmed with a code sent to your number or with your Google account.

Deleting closes the account at once: your profile and posts disappear for everyone, every device is signed out and your alerts stop. Signing in within 14 days keeps the account. After 14 days it is erased for good: your number, your Google sign-in and its email address, your profile and picture, your posts and their pictures, likes, follows, blocks, bookmarks, watchlist, portfolios, alerts, notifications, settings, devices and the Bale link. Other people’s replies to your posts stay. Reports you made stay without your name, and moderation records keep the action taken and its reason, with a pseudonym in place of your account. Copies in backups are gone as the backups are replaced, within about five weeks.

For anything you cannot do in the app, write to our support email (to be announced).

Children

Bitisi is not directed at children, and the community is meant for people aged 18 or over. If you believe a child has made an account, tell us and we will remove it.

Security

Connections to Bitisi are encrypted (HTTPS), codes and tokens are stored only as hashes, backups of personal data are encrypted, and only our team can reach the servers and their admin tools. No service is perfectly secure: if a breach affects your data, we will tell the people affected.

Changes to this policy

When we change this policy we update its date above, and we announce important changes in the app or on the website before they take effect.

Contact

Questions or requests about your data: write to our support email (to be announced). Bitisi is owned and run by Raastin.