SHM PRIVACY POLICY

Version: 2026.09.23 Effective date: 23 September 2026 Last updated: 23 September 2026 1. WHO WE ARE SHM is a mobile market-information and trading-tools application operated by Mindovaq for software and digital marketing, trading as Mindovaq ("Mindovaq", "SHM", "we", "us", or "our"). For data-protection purposes, Mindovaq for software and digital marketing is the controller or data user responsible for the personal data described in this Privacy Policy. Business address:Al Fanar Tower, 10th Floor, Office of Other Information Technology & Computer Services Activities, 00398 Al Horeya Main Road, Abu Qir, Alexandria, Egypt Support: support@mindovaq.com This Privacy Policy applies to the SHM iOS and Android applications, the SHM account and API services, and related support communications. It explains what personal data we process, why we process it, whom we share it with, how long we keep it, and the choices and rights available to you. 2. WHAT SHM DOES SHM provides market-reference information and tools, including stock search, support and resistance levels, data freshness status, favorites, price alerts, position-sizing and average-price calculators, and push notifications. The mobile app does not display provider-supplied live or latest stock prices or stock logos. SHM does not execute trades, hold funds or securities, or connect to brokerage accounts. The free service may show ads. Where available, an optional SHM Pro subscription provides additional features without in-app ads. Google Play processes subscription payments; SHM does not receive your full payment-card number. 3. PERSONAL DATA WE PROCESS 3.1 Account and authentication data When you create or use an SHM account, we process: - your name and email address; - your authentication provider and email-verification status; - password and authentication data for email accounts, or identity tokens and basic profile data received through Google Sign-In; - an SHM account identifier, session tokens, account role, and account timestamps; and - security information such as IP address, user agent, authentication attempts, and related anti-abuse records. We do not receive your Google Account password. Google and Firebase process the sign-in credentials needed to authenticate you. On supported mobile devices, SHM stores its access and refresh tokens using secure operating-system storage. 3.2 App content and preferences We process information you choose or generate while using SHM, including: - favorite stocks; - price alerts, including the selected stock, target price, above/below condition, whether the alert is enabled, alert status, and any optional note you enter; - notification settings, such as whether price-alert or marketing notifications are enabled; - records showing which versions of the Terms, Privacy Policy, Financial Disclaimer, and Advertising Disclosure you accepted and when; - search queries and interactions with app features, to the extent they are sent to or retained by our servers; and - information you include in support requests or other communications. In the audited release, calculator inputs are processed on your device and are not sent to the SHM backend. If a future calculator sends or saves inputs, we will disclose that change before it takes effect. 3.3 Device, network, notification, and service data When you use SHM, we and our service providers may process: - IP address and approximate country or region inferred from IP address; - device type, operating system, app version, language, time zone, network information, and request timestamps; - an app installation identifier generated by SHM; - a Firebase Cloud Messaging device token if you grant notification permission, together with platform and device-registration status; - notification delivery and interaction data; - technical logs needed to operate, secure, diagnose, and improve the service; and - app configuration, maintenance, and version-compatibility information. SHM does not request precise GPS location permission in the audited release. Advertising providers may infer an approximate location from IP address. We do not collect contacts, photos, microphone recordings, health data, government identifiers, bank details, or brokerage credentials through the audited features. 3.4 Advertising data SHM uses Appodeal as an advertising mediation provider. Depending on your region, device settings, consent choices, and the ad networks selected through Appodeal, Appodeal and its advertising partners may process: - the Android Advertising ID or Apple Identifier for Advertisers, where permitted; - IP address and approximate location derived from it; - an app-scoped user or device identifier, including the SHM account identifier if configured; - device model, operating system, language, screen and network information; - app interactions, ad requests, impressions, clicks, ad placement and format, and advertising performance data; - diagnostic, crash, and performance information collected by an advertising partner; and - information used to detect fraud, limit ad frequency, measure advertising, or select contextual or personalized ads. SHM also sends its backend an ad-event record that can include the event type, ad format, placement, provider or network, app version, platform, session identifier, SHM user identifier, and, when available, country, currency, revenue, or SDK version. Appodeal describes the data its SDK and mediated networks may collect at https://docs.appodeal.com/android/data-protection/app-privacy-details and in its privacy policy at https://appodeal.com/privacy-policy/. 3.5 Subscription and purchase data If you view or buy SHM Pro, Google Play and our subscription-management provider RevenueCat process purchase and subscription information. SHM sends RevenueCat your immutable SHM account UUID as its App User ID to associate entitlements with your account; we do not use your email address as that identifier. RevenueCat may receive a Google Play purchase token, product and plan identifiers, purchase and renewal dates, expiry date, cancellation or billing status, store and country or currency information, and device or app technical information needed to verify and manage the subscription. SHM's backend receives and stores a verified entitlement snapshot, including your SHM account UUID, subscription status, plan or product identifier, store, relevant dates, and synchronization status, and receives subscription lifecycle notifications from RevenueCat. We use this information to provide Pro benefits, prevent unauthorized access or account transfers, respond to support requests, reconcile billing state, and meet legal or accounting obligations. We do not receive or store your full payment-card number or card security code. Google Play handles checkout and payment details. RevenueCat's privacy policy is at https://www.revenuecat.com/privacy. 4. WHY WE PROCESS PERSONAL DATA We process personal data only when we have a lawful basis. Depending on the activity and applicable law, our bases and purposes are: - Contract or requested service: to create and secure your account; authenticate you; sync favorites and alerts; provide market tools; verify and deliver SHM Pro entitlements; deliver requested price-alert notifications; maintain your settings; and respond to support requests. - Consent: to send optional marketing notifications and, where required, to store or access advertising identifiers and provide personalized advertising. You may refuse or withdraw consent without losing access to SHM's core market-information features. - Legitimate interests: to protect SHM and users; prevent fraud and abuse; diagnose failures; maintain service reliability; understand aggregate feature and subscription performance; administer legal-version records; and display and measure contextual advertising, where those interests are not overridden by your rights. - Legal obligation or legal claims: to comply with law, respond to lawful requests, enforce our terms, and establish, exercise, or defend legal rights. Accepting this Privacy Policy acknowledges that you have received this notice; it is not consent to every type of processing. Where consent is legally required, SHM must request it separately and provide a way to withdraw it. 5. WHEN WE SHARE PERSONAL DATA We may disclose personal data to the following recipients for the purposes described above: - Hosting and infrastructure providers, including the provider hosting the SHM backend, currently Fly.io. - Google and Firebase, for Google Sign-In, Firebase Authentication, and Firebase Cloud Messaging. Firebase privacy and security information is available at https://firebase.google.com/support/privacy/ and Google's privacy policy is at https://policies.google.com/privacy. - Appodeal and mediated advertising networks, for ad delivery, personalization where permitted, measurement, reporting, and fraud prevention. The active network list may change through Appodeal's mediation configuration. - Google Play and, where relevant, Apple, as app-store and operating-system providers. Google Play handles subscription checkout, billing, purchase records, cancellation, and refunds under its own terms and privacy notice. - RevenueCat, to validate purchases, manage entitlements, receive subscription events, and support subscription analytics and customer support. We share the SHM account UUID and subscription-related data described in section 3.5, not your full payment-card details. - Professional advisers and vendors that support security, legal compliance, accounting, or customer support, subject to appropriate confidentiality and data-protection duties. - Government authorities, courts, regulators, or other parties when disclosure is legally required or reasonably necessary to protect rights, safety, security, and the integrity of SHM. - A buyer, investor, or successor in a merger, financing, reorganization, or sale of all or part of the business, subject to applicable notice and legal requirements. We do not permit service providers to use SHM account data for their own unrelated purposes. Advertising partners may act under their own privacy policies for the data they collect through their SDKs, so you should review those policies and available controls. 6. ADVERTISING CHOICES AND TRACKING CONTROLS Where required, SHM uses Appodeal's consent solution to ask for advertising choices before personalized advertising or tracking begins. Refusing or withdrawing a choice does not remove access to SHM's core features. Contextual or less-personalized ads may continue to appear. You can revisit available choices in Settings > Privacy & Advertising. That screen lets you manage advertising choices when Appodeal makes a consent, re-consent, or opt-out form available; review this Privacy Policy and the Advertising Disclosure; and report an inappropriate ad. On iOS, Settings > Privacy & Advertising also shows the current App Tracking Transparency permission status. If iOS no longer permits SHM to display the system request again, the screen provides a link to the device settings. Your Appodeal advertising choice, iOS tracking permission, acknowledgement of this Privacy Policy, and acceptance of the Terms are separate actions. 7. INTERNATIONAL DATA TRANSFERS SHM is operated from Egypt. Fly.io, Google, Firebase, RevenueCat, Appodeal, app stores, and mediated advertising networks may process personal data in the United States, the European Economic Area, or other countries where they or their processors operate. Privacy and data-protection laws in those locations may differ from the laws where you live. Where cross-border transfer requirements apply, we take steps intended to use a lawful transfer mechanism and safeguards appropriate to the circumstances. Depending on the provider and applicable law, these measures may include contractual data-protection commitments, access controls, encryption in transit, vendor review, data minimization, and limits on retention and use. This statement does not claim that a particular government permit or approval applies where its status has not been verified. Contact support@mindovaq.com if you want more information about safeguards relevant to your data. 8. RETENTION We keep personal data only for as long as necessary for the purpose for which it was collected, including legal, security, accounting, and dispute-resolution needs - Account profile, favorites, alerts, notification preferences, and associated content: while the account remains active, then deleted or anonymized within 1 day, unless a legal exception applies. - Authentication and security logs: Firebase states that authentication IP logs are generally kept for a few weeks and that other authentication data is removed from live and backup systems within up to 180 days after the Firebase customer initiates deletion of the associated user. - SHM access and refresh tokens: until expiry, logout, account deletion, or security revocation, subject to short-lived security logs. Locally stored tokens are removed on logout or account deletion. - Push tokens and SHM installation identifiers: until notifications are unregistered, the token becomes invalid, or the account is deleted, subject to provider backup periods. - Legal acceptance records: 1 month. - Server logs and backups: logs for 1 month after which they are deleted or overwritten under the applicable schedule. - Subscription and entitlement data in SHM systems: while needed to provide and verify Pro access, then deleted or de-identified on account deletion unless a specific legal, accounting, fraud-prevention, or dispute-resolution obligation requires longer retention. Google Play and RevenueCat retain their own purchase and transaction records under their respective policies and applicable law; contact us for assistance with a verified RevenueCat data-deletion request. - Advertising data: according to the retention settings and policies of Appodeal and each participating ad network. 9. ACCOUNT AND DATA DELETION You can initiate account deletion in SHM from Settings > Profile > Delete account. You may also request deletion outside the app at https://shm-backend.fly.dev/delete-account or by contacting support@mindovaq.com Deleting an account is intended to delete the SHM account and data associated with it, including profile data, favorites, alerts, notification registrations and settings, and other user content, except data we must retain for a specific legal, security, fraud-prevention, or dispute-resolution reason. Residual copies may remain in protected backups until the backup-retention period expires. Deleting an SHM account or uninstalling the app does not cancel an active Google Play subscription. Cancel it separately through SHM's Manage subscription link or https://play.google.com/store/account/subscriptions using the purchasing Google account, to avoid further renewal charges. Purchase and billing records held by Google Play remain subject to Google's policies and applicable law. Deletion of data held independently by an advertising, identity, or subscription provider may require using that provider's controls or submitting a separate request; we will assist or forward a verified request where applicable. 10. YOUR RIGHTS Depending on where you live and subject to legal exceptions, you may have the right to: - know whether and how we process your personal data; - request access to and a copy of your personal data; - correct inaccurate or incomplete data; - request deletion, restriction, or anonymization; - object to certain processing, including direct marketing and, where applicable, targeted advertising; - withdraw consent at any time without affecting processing that was lawful before withdrawal; - request data portability where applicable; and - lodge a complaint with a competent data-protection authority. Submit a request through support@mindovaq.com We may need information reasonably necessary to verify your identity and protect your account. We will respond within the period required by applicable law. In Egypt, you may also contact or lodge a complaint with the Personal Data Protection Center at https://pdpc.gov.eg/. Residents of the EEA, United Kingdom, Switzerland, California, and other jurisdictions may contact their local authority or use the rights and opt-out mechanisms required by their local law. 11. CHILDREN SHM is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal data from a person under 18 or knowingly serve them personalized advertising. If you believe a minor has provided personal data, contact support@mindovaq.com so we can investigate and delete it as required. The stores' target-audience declarations and advertising configuration must identify SHM as an adult-directed financial-information app. 12. SECURITY We use administrative, technical, and organizational safeguards designed to protect personal data. These include encrypted HTTPS transport, access controls, secure mobile token storage, credential redaction in application logs, and provider security controls. No system is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and contact us immediately if you suspect unauthorized account access. 13. THIRD-PARTY LINKS AND SERVICES Ads or other content may link to third-party apps, websites, or services. Their privacy practices are governed by their own notices, not this Privacy Policy. SHM is not responsible for a third party's privacy or security practices. 14. CHANGES TO THIS POLICY We may update this Privacy Policy when SHM's features, providers, or legal obligations change. We will publish the new version and effective date. If a change materially affects your rights or requires new consent, we will provide appropriate notice and request consent where required. SHM records the legal-document version accepted by each signed-in user. 15. CONTACT US Controller / data user: Mindovaq for software and digital marketing, trading as Mindovaq Support: support@mindovaq.com Address: Al Fanar Tower, 10th Floor, Office of Other Information Technology & Computer Services Activities, 00398 Al Horeya Main Road, Abu Qir, Alexandria, Egypt.