Arbitra Privacy Policy
Effective date: 8 November 2026
Arbitra is published by Yupi, Mutnik BB, 77220 Cazin, Bosnia and Herzegovina ("we", "us"). Yupi is responsible for the personal information described in this policy. Contact: yupi@yupiba.com.
In short: Arbitra has no accounts and no advertising or analytics tools. If the app crashes or runs into an unexpected error, it sends a report to Firebase Crashlytics, a Google service, unless you turn this off (section 4). Apart from those reports and the short-lived Live Activity details described in section 2, we do not store information about you, and we do not sell anything about you. Your settings stay on your device. To deliver prices and news, our server and a few services briefly see your IP address, which is a normal part of using the internet. If notifications are allowed for the app, Google's notification service is used to deliver price and news alerts.
1. Settings on your device
Your theme, your watchlist and your alert choices are stored only in the app on your device. They are never sent to us. Your phone's own backup (Google or iCloud) may include them, and can restore them when you reinstall the app. Uninstalling removes them from the device. You manage backups in your Google or Apple account settings. The app also records on your device that you agreed to the Terms of Use, in a place your device's backup normally leaves out, so a reinstall usually asks again.
2. Our server
The app fetches prices, charts and news from our server, which is hosted by Fly.io in Frankfurt, Germany. Like every server, it sees your IP address while it answers a request. It uses the address only in memory, to limit how many requests and connections one device can make. Our server does not write your IP address to its logs or keep it after your connection ends. Requests contain only which prices or news to fetch, never anything about you, with one exception on iPhone and iPad: when you show a price on your Lock Screen (a Live Activity), the app sends our server that Live Activity's push token from Apple (the Live Activity may also appear on a paired Apple Watch, Mac or CarPlay; no extra data is sent for that), a random identifier for it, the asset you chose and when it will end. Our server keeps these in memory only, without your IP address, uses them to send price updates through Apple's push service, and deletes them when the app tells it the Live Activity has ended, or at the latest about eight hours after it started, or when the server restarts. This does not use Firebase. Fly.io processes the traffic as our hosting provider.
3. Alerts
Price and breaking-news alerts use Firebase Cloud Messaging, a Google service. On iPhone, Google passes them to Apple's push service, which delivers them.
- How alerts start. From version 1.0.2 of the app, every alert is off until you turn it on. When you first open the app, you can pick the markets you follow and choose whether to get big-move alerts for them. The app asks your phone for permission to send notifications only after you tap Turn on. Earlier versions asked once for permission after you agreed to these terms and, if notifications were allowed, turned on oil big-move alerts without asking; an earlier version you haven't updated still works that way. Alerts that are already on stay as they were. You can turn any alert on or off in More › Notifications, on Android and iPhone.
- Until an alert is on, the app does not register with Firebase for alerts. Crash and error reports (section 4) reach Firebase independently of alerts. When the first alert is on, the app registers with Firebase, which creates an identifier for this installation of the app. To manage your alert topics, Firebase also receives your device model, language, time zone, and operating-system and app versions, and on iPhone links Apple's push token to that identifier.
- Topics. Your device subscribes to a shared topic for each alert you choose, for example "oil big moves" or "breaking news". If quiet hours are on, the topic includes your time zone's offset from UTC (for example, UTC+2), so alerts are not sent at night. This is not your location.
- What we send. Our server sends each alert to a topic, never to an individual device, and never receives your identifier.
- Breaking news. A breaking-news alert carries the story's headline, the outlet's name and a link to the publisher's article, which opens when you tap it.
- Turning alerts off, or blocking notifications in your phone's settings, stops the alerts. The Firebase registration stays, and Firebase may keep it up to date, until you uninstall the app or ask us to delete it. Google removes deleted identifiers within 180 days. See Firebase privacy.
4. Crash and error reports
The app uses Firebase Crashlytics, a Google service, to learn when it crashes or runs into an error it did not expect, so we can fix it.
- What is sent. If the app crashes: the stack traces of every running thread and the error's type and text, or the name and code of the signal that stopped it. For some unexpected errors the app catches: the error's type and stack trace, without its text. On Android, also reports when the app stops responding (app not responding, ANR). Each report also contains the app's identifier and version, whether the app was in the background, the operating-system name and version, the device model, CPU architecture, memory and disk size, whether the device is rooted or jailbroken, the screen rotation, whether the proximity sensor was triggered, the names and identifiers of the app's loaded code libraries, and identifiers that Firebase creates: a random Crashlytics installation identifier, the Firebase installation ID, a Firebase session ID and a random identifier for each report. Reports never contain your watchlist, settings or alerts.
- When. Only after you agree to these terms, only from release builds of the app (including test builds through TestFlight or Google Play testing), and only for app sessions in which reporting was allowed the whole time. Reports wait on your device and are sent the next time the app starts.
- Turning it off. More › Legal › Share crash reports. Turning it off stops reporting at once, and reports waiting on your device are deleted the next time the app starts. Turning it back on applies from the next start.
- How long. Firebase keeps crash traces and their identifiers for 90 days before it starts removing them. Turning reporting off does not delete reports already sent; email us to ask. See Firebase privacy.
5. Content loaded from other servers
Crypto logos are loaded from CoinGecko, and news pictures are loaded from each news publisher's image server. These servers see your IP address when the picture loads, as with any website. Articles and links open in your browser, where that website's own policy applies.
6. Sharing price cards
When you share a price card, it goes to the app or person you choose. On iOS, saving the image to Photos asks permission only to add it; Arbitra cannot read your photos.
7. Emails
If you email us, we use your address and message only to reply to you. We delete them 6 months after the conversation ends.
8. Where information goes
Fly.io (Germany) and Google may process information outside your country, including in the United States. Where EU or UK law applies, these transfers are covered by the European Commission's Standard Contractual Clauses in their data processing terms.
9. Your rights
If you are in the EU, the UK or another region with similar laws, you can ask us to:
- access, correct or delete your information;
- restrict or object to how it is used;
- withdraw consent to alerts at any time, by turning them off or uninstalling the app.
- stop a Live Activity at any time, by tapping Stop in the app or swiping it away on your Lock Screen.
- object to crash and error reports at any time, by turning off Share crash reports in More › Legal.
We process information to run the service you asked for, keep it secure and, through crash and error reports, keep the app working (our legitimate interests); you can object to crash and error reports by turning off Share crash reports. We send alerts because notifications are allowed and the alert is on (your consent); you can withdraw it by turning the alert off, blocking notifications or uninstalling the app. Because we store almost nothing about you, there is usually nothing for us to look up. For Firebase, we can request deletion of your installation's registration and crash reports. Email yupi@yupiba.com; we reply within one month. You may also complain to your data protection authority.
10. Children
Arbitra is a general-audience app about financial markets and is not directed at children. A parent or guardian with a concern can contact us.
11. Changes
We will update the date above when this policy changes, and we will note significant changes in the app or its store listing.
12. Contact
Yupi, Mutnik BB, 77220 Cazin, Bosnia and Herzegovina