AiValut

Privacy Policy

Effective 1 November 2026 · updated 5 November 2026 (our own visit count)

AiValut (aivalut.pl) is a free market-data website. This policy explains what personal data it keeps, why, for how long, and what you can do about it. We keep as little as we can: there are no ads, and the only measurement is Google Analytics, with cookies only if you accept them.

Who is responsible

The controller of your data is the operator of aivalut.pl. Contact for anything about your data: contact [at] aivalut.pl.

What we keep

Your account: your e-mail address; your password only as a one-way scrypt hash (never the password itself); when the account was made, confirmed, last signed in and last used while signed in.
Sign-in with Google: if you use "Continue with Google", Google tells us your e-mail address and that Google has confirmed it. We ask for nothing else and get no access to your Google account, contacts or files.
Your consent to news e-mails: only if you tick it, with the time you gave it. You can take it back at any time in your account menu.
Your settings: what you set up in the terminal (panel layout, chart studies, watchlists and any portfolio you enter yourself), so they come back when you sign in.
How the site is used (Google Analytics): pages viewed, rough location (country, city), device and browser type, where the visit came from, and events such as a completed sign-up. Details below, under "Google Analytics".
Your IP address is used for a moment to stop abuse (too many sign-in attempts or requests); for that it is kept in memory only, not in the accounts database. The web server's error log may also record the IP address of a request that failed (for example while the server restarts); that log is used only to fix problems and is deleted after 14 days at most.
Our own visit count (no cookie): to count how many different people open the site each day, our server turns the IP address and browser name of a page load into a one-way code mixed with a random value made for that day. The codes and that value are deleted when the day ends (Warsaw time); after that only the day's totals remain (number of visitors and page loads), which cannot identify anyone. The IP address itself is not stored.

Why (legal bases under the GDPR)

To provide your account and the service you asked for: Art. 6(1)(b).
To send news e-mails, only with your consent: Art. 6(1)(a).
To measure how the site is used with Google Analytics cookies, only with your consent: Art. 6(1)(a). The cookieless measurement before you choose (see below): our legitimate interest in counting visits, Art. 6(1)(f). The same interest covers our own cookieless visit count and the record of when an account was last used.
To keep the service secure and prevent abuse: our legitimate interest, Art. 6(1)(f).

Cookies and browser storage

av: keeps you signed in, for up to 30 days or until you sign out. Strictly necessary.
av_g: used for at most 10 minutes during "Continue with Google", to check that the answer from Google belongs to your sign-in. Strictly necessary.
_ga and _ga_<id>: Google Analytics cookies that tell one visit from another, for up to 14 months. Set only after you click Accept.
Your browser's local storage keeps a few display choices (time zone, table sorting, live updates) and your answer to the cookie question (av.consent) on your device only.

We use no advertising cookies.

Google Analytics

We use Google Analytics 4, loaded through Google Tag Manager, to count visits and see which parts of AiValut are used, so we can make it better. It runs in Google's "Consent Mode":

Before you choose, or if you click Reject: no analytics cookies are stored on your device. Your browser still sends Google short, cookieless signals (that a page was viewed, with the time, page address, browser and device type), which Google uses to estimate visits in aggregate. They carry no identifier that would recognise you on a later visit.
If you click Accept: the _ga cookies are set and visits are measured in full.
Advertising features are always off: nothing is used for ads or ad personalisation, and nothing is shared with Google for advertising.
Google Analytics does not log or store IP addresses for visitors in the EU.

You can change your choice at any time with the Cookie settings link at the bottom of each page (or in the account menu when signed in). Clicking Reject later also removes the _ga cookies. You can also block them in your browser.

Who processes the data for us

Hostinger hosts the server (data center in Vilnius, Lithuania, EU) and the mailbox that sends sign-up e-mails.
Google Ireland Limited runs Google Analytics and Google Tag Manager for us, as our processor. Google may process the data in the United States; such transfers rely on the EU–US Data Privacy Framework and Google's standard contractual clauses.
Google, only if you choose "Continue with Google". Backups of the server's data (including the accounts database) are kept on the operator's computer and on Google Drive.

Market data shown on the site is fetched by our server from public sources; your IP address and account are not passed to them. We never sell your data.

How long

Your account and settings: until you delete the account.
Sign-ups never confirmed: deleted after 7 days. Confirmation links: valid for 24 hours.
Backups: kept for 30 days, then deleted.
Server logs: 14 days at most.
Visit-count codes: until the end of the day they were made; daily totals: kept, as they contain no personal data.
Google Analytics data: 14 months, then deleted by Google. Your answer to the cookie question: on your device until you clear it.

Your rights

You may ask for a copy of your data, have it corrected, have your account and data deleted, object to processing, or take back your consent to news e-mails at any time (this does not affect what was done before). Write to contact [at] aivalut.pl from the address of your account. You may also complain to a data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

Changes

If this policy changes, the new version will be published on this page with its date.