Privacy Policy
Version 1.0 · effective from 2026-09-01
This is an English translation for your convenience. The binding version is the Czech one — Zásady ochrany osobních údajů. In case of any discrepancy, the Czech wording prevails.
This document describes what data the WiggleWick service processes about you, why it does so, who it passes the data to and what rights you have over it.
1. Who the controller is
The controller of personal data is Pavel Holkup, company ID 23566701, registered office at Za Pilou 1264, 374 01 Trhové Sviny, Czech Republic.
On matters of personal data protection, contact us at support@wigglewick.com. We have not appointed a data protection officer — the scope of processing does not require one.
2. What data we process
| Data | Why we have it | Legal basis |
|---|---|---|
| E-mail address, and a name if given | Account, sign-in, communication about the service | Performance of a contract |
| Password | Sign-in. Only an irreversible hash is stored; we do not know the password itself | Performance of a contract |
| Phone number | Only if you turn on the verification code by SMS | Performance of a contract |
| IP address, browser and sign-in time | Account security, the brake against password guessing | Legitimate interest in the security of the service |
| Trades, journal entries, portfolio | The content of the service itself. This is your data and no one else sees it | Performance of a contract |
| Exchange access keys | Downloading trade history. Stored encrypted | Performance of a contract |
| Subscription details | So we know whose service should run and until when | Performance of a contract |
You will not learn your card details or billing address from us — we do not have them. The subscription is sold to you by Lemon Squeezy and payment data is processed solely by them. All that reaches us is the information that a subscription started, renewed or ended.
3. How long we keep it
- Account details and your data for as long as the account exists. When you delete the account, they go with it.
- Records of sign-ins and failed attempts for a short time, a matter of days — then they are deleted automatically.
- Accounting documents for the period required by tax law (usually 10 years). Deleting the account does not remove these.
4. Who we pass it to
We do not sell data to anyone. We pass it only to the suppliers without whom the service could not work, and only to the extent necessary:
| Supplier | What for |
|---|---|
| Hosting and database provider | Running the app and storing data |
| E-mail gateway provider | Sending account e-mails |
| SMS gateway provider | Verification codes, only if you turn SMS on |
| Sign-in with Google, only if you use it | |
| Lemon Squeezy | Selling the subscription, payments and tax documents |
| The exchanges you connect | Downloading your trade history on your instruction |
Lemon Squeezy stands in a different position from the other suppliers. They are not our processor but a separate controller: they sell you the subscription in their own name, so they decide about your payment and billing data themselves and follow their own privacy policy. We have no sight of that data.
Some suppliers may process data outside the European Union — that includes Lemon Squeezy. Where that happens, it is based on the safeguards required by the General Data Protection Regulation (standard contractual clauses or an adequacy decision).
5. Cookies and analytics
The service uses only cookies necessary for it to work — sign-in, language and the chosen appearance. We use no analytics tools and no advertising code. A detailed overview is on the Cookies page.
If we introduce analytics or advertising in the future, they will only start after you consent, and we will update this document beforehand.
6. How the data is secured
- Passwords are stored as an irreversible hash, not in readable form.
- Exchange keys are encrypted in the database.
- Sign-in tokens are stored in the database only as a hash — not even the database contents would let anyone rebuild a session from them.
- You can turn on two-factor authentication for your account.
- All transfers are encrypted and the browser is given strict security rules against injected scripts.
7. Your rights
Over your data you have the right:
- of access to it and to a copy,
- to have inaccurate data corrected,
- to erasure — you can delete the account and all data yourself in settings at any time,
- to restriction of processing and to data portability — you can download your trades and portfolio as CSV in settings at any time,
- to object to processing based on legitimate interest,
- to lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).
You can exercise them at support@wigglewick.com. We will respond within one month at the latest.
8. Automated decision-making
We carry out no automated decision-making or profiling with legal effects for you. The statistics the app calculates are meant for you alone and are not sent anywhere.
9. Changes to this policy
We may amend this policy when the service or the law changes. The current version is always on this page; we announce material changes by e-mail or in the app.
This version 1.0 is effective from 2026-09-01.