Privacy Policy

Northtape is operated from Singapore and is the controller of the personal data described in this policy. Contact: privacy@marcomfin.tech.

We collect only the following, and nothing else:

• Account data — your email address and, if you sign in with Google, your display name and avatar image. Authentication tokens are stored in your own browser.
• Preferences you save — watchlist assets, alert keywords, muted sources and categories, notification cadence, and your generated daily briefs.
• Push subscription data — if you enable push notifications: the push endpoint issued by your browser, its encryption keys, and your browser's user-agent string, used solely to deliver the alerts you asked for.
• Service data — short-lived rate-limit counters tied to your account (to keep the free AI features available to everyone), and error logs.
• Aggregate analytics — cookieless page-view statistics that do not identify you and are not combined with your account (see the Cookie Policy).

We do not collect payment details (the app is free), precise location, contacts, or any special-category data.

• To provide the service you signed up for (account, preferences, briefs, alerts) — performance of a contract (GDPR Art. 6(1)(b)); deemed consent under the PDPA.
• Push notifications — your consent, given via your browser's permission prompt (GDPR Art. 6(1)(a)). Withdraw any time in your browser or notification settings.
• Service integrity (rate limits, error logs, abuse prevention) — our legitimate interest in keeping a free service available and secure (GDPR Art. 6(1)(f)).

We do not sell or rent personal data. We share it only with processors who run the service for us, under contracts that restrict their use of it:

• Cloud hosting and content-delivery providers (application and database hosting).
• Authentication and database infrastructure providers.
• Cloudflare Web Analytics — cookieless, privacy-first pageview analytics. It receives no account data.
• AI processing providers — receive the text needed to generate a summary or brief (news article text, your question, your selected categories and watchlist asset names), not your identity.
• Browser push services (operated by your browser vendor, e.g. Google, Apple or Mozilla) — deliver the notifications you enabled.

News articles link out to their original publishers; what those sites collect is governed by their own policies. The app also contains a personal referral link to Tangem — if you follow it, Tangem's own privacy policy applies from that point.

The app runs on a global edge network, so data may be processed in Singapore, the EU/EEA, the UK and the United States. Where data of EU/UK users leaves those jurisdictions, we rely on adequacy decisions or Standard Contractual Clauses. Under PDPA section 26, we only transfer personal data overseas where comparable protection applies.

• Account data and saved preferences — until you delete your account.
• Daily briefs — until you delete your account.
• Push subscriptions — until you disable notifications, or automatically when your browser reports the subscription dead.
• Rate-limit counters — rolling 10-minute windows, overwritten continuously.
• Cached AI article summaries — up to 7 days; they are keyed to the public article, not to you.

You can access, correct, export (portability), delete, or object to the processing of your personal data, and withdraw consent where processing is based on it. Exercise any of these by emailing privacy@marcomfin.tech from your account email. We respond within 30 days. Deleting your account removes your watchlist, keywords, preferences, briefs and push subscriptions.

Northtape is not directed at children. You must be at least 18 to use it (see the Terms of Service). We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

All traffic is encrypted in transit (TLS). Data is encrypted at rest by our infrastructure providers. Access to user data is restricted by row-level security so that each account can only ever read its own records, and administrative access is limited to server-side processes.

Contact us first — most issues resolve fastest that way. You may also complain to the Singapore Personal Data Protection Commission (pdpc.gov.sg); if you are in the UK, the Information Commissioner's Office (ico.org.uk); if you are in the EU/EEA, your national supervisory authority.

We will post any changes on this page and update the "last updated" date. For material changes affecting signed-in users, we will show an in-app notice before the change takes effect.