AFAT Quant AI — Privacy Policy

Effective 11 October 2026. Provided by Nematullah GULZARI.

AFAT Quant AI is a members-only market information app. This policy explains what the app and its service handle, and why.

What we process

• Account details. We hold your email address, display name, account role and an internal account ID to identify your account, let you sign in and provide the app's member features.
• Sign-in. The app sends your email, your password and a 6-digit authenticator (TOTP) code to sign you in.
  • Passwords are stored only as one-way (Argon2id) hashes, never in plain text.
  • The authenticator setup secret is kept on our service to check codes and is never sent to the app.
  • The app also sends a generic device name, for example "iPhone".
• Sessions. After you sign in, session tokens are stored on your device in the iOS Keychain. Our service stores only hashed copies of them, and access to member content requires a valid session.
• Security records. To protect accounts, our service records sign-in and account events, for example sign-in, sign-out, password change and reset requests. Each record includes your account email, the time and the outcome. Rate-limiting records also contain your account email or account ID together with an internal network address. Password-reset protection uses a one-way hashed form of your network address.
• Password reset email. If you request a reset, a code is emailed to you through our email delivery provider, Postmark, which keeps message content for a limited period.
• Network provider. Requests to our service pass through Cloudflare, which processes network information such as your IP address to deliver them.

What stays on your device

Your watchlist and display preferences are stored only on your iPhone. The app lock is always on in this version and can't be turned off. Face ID is handled entirely by iOS; the app never receives biometric data.

What we do not do

• No advertising, and no tracking across apps or websites.
• We do not sell personal data.
• The app contains no third-party analytics, advertising or crash-reporting software.
• We do not collect location, contacts, photos, health data, purchases or purchase history, payment details, or browsing or search history.
• The app does not place trades, connect to a brokerage or hold funds.

Retention

Security and rate-limit records are retained for up to 90 days, expired authentication challenge records for up to 90 days, and account-security audit records for up to 365 days. Expired password-reset tokens are removed on a shorter schedule. These limits are enforced by automatic daily maintenance. Your account details are kept while your account exists.

Your choices

You can sign out of every device from Settings → Account & Security. For questions about your data, or to ask about access, correction or deletion, contact support@afatquant.com.

Changes

We will update this page when our practices change, with a new effective date.