WavePrint Privacy Policy

Effective date: October 6, 2026 Last updated: October 8, 2026
Español: Política de privacidad

This policy covers the WavePrint Android app (package com.waveprint.desk), the WavePrint web/desktop version (currently at https://terra-iris-fire-drift.grok.me), and WavePrint pages on https://safesecurityconsulting.com (together, the "Service"). It is available in English and Spanish.

1. Who we are

Controller / operator: S.A.F.E. Security Consulting LLC, a Nevada limited liability company (Nevada Entity ID E51125472025-7), 732 S 6th St Ste N, Las Vegas, NV 89101, USA. Privacy contact and designated request address: ernie.castro@safesecurityconsulting.com Website: https://safesecurityconsulting.com

We have not appointed a data protection officer. We have not appointed an EU/UK representative.

2. Summary

  • The Bitcoin desk works without an account and without a purchase.

  • The Android app has no accounts. It does not ask for your name or password.

  • We do not sell personal information, show ads, use an advertising ID, or use analytics or crash-reporting tools.

  • We do not collect portfolio balances, wallet addresses, seed phrases, exchange API keys, government ID, contacts, photos, or precise location.

  • The web/desktop version offers optional sign-in with Google or X to save a watchlist and alerts.

3. Information we collect

3.1 Android app

  • Install identifier — What it is: A random ID the app creates the first time it runs. It is not your Android ID or advertising ID. — When: Every request to our API — Where it goes: Stored on your device. Sent to our API with each request. Our current server does not store it or use it to make access decisions. We may use it in the future for abuse prevention and to link purchases to an install, and we will update this policy if that use changes.

  • Purchase information — What it is: The product ID (for example waveprint_alts_monthly or waveprint_alts_lifetime) and the Google Play purchase token for your purchase. — When: When you buy or restore a purchase, and with later requests to the API — Where it goes: Stored on your device. Sent to our API, which asks Google Play whether the purchase is active. Our server does not write the token to storage; it keeps only a short-lived in-memory result (about 10 minutes) keyed to a one-way hash of the token. We receive purchase status (active or not, product, expiry, order number). We do not receive your card number.

  • Free-access email (optional) — What it is: An email address you choose to type in the "Free-access email" field. — When: Only if you enter it; then sent with each API request until you clear it — Where it goes: Stored on your device. Sent to our API, which compares it with our free-access list in memory. Our code does not store or log it. The address is not verified.

  • Coin searches and desks requested — What it is: The coin search text, coin, chart timeframe, and language you request. — When: When you search or open a desk — Where it goes: Sent to our API to return the desk. May appear in our hosting provider's request logs (see 3.4).

  • Headline translation (Spanish only) — What it is: Headline text (public news titles). — When: When the app is set to Spanish — Where it goes: The app sends public headline text directly from your device to a Google translation service to show Spanish titles. Google receives your device's IP address and the headline text, not any WavePrint data about you.

Purchase status updates from Google Play. Google Play also tells our server, directly and through its refund ("voided purchases") list and real-time notifications sent via Google Cloud Pub/Sub, when a purchase is renewed, canceled, expires, is revoked, or is refunded. These messages contain the purchase token, order number, and event type, not your name or email. Our server uses them only to end access promptly after a cancellation, expiry, or refund. It keeps refunded purchases in memory only (identified by a one-way hash of the token and the order number), and its event logs show only a shortened hash of the token, never the token itself.

Stored only on your device (not sent to us): your Terms acceptance record (Terms version, date and time accepted, and language), your language preference, and your chosen coin buttons (favorites). Android's own backup feature may include app data in your Google account backup, under Google's terms.

3.2 Web/desktop version

  • Sign-in information (optional) — What it is: If you choose "Continue with Google" or "Continue with X," we receive information from that provider through our hosting platform's sign-in service, such as an account identifier, display name, and email address. We do not receive your Google or X password. — When: Only if you sign in

  • Watchlist and alerts (signed-in only) — What it is: Coins you add to a watchlist, and alerts you create (coin, ticker, alert type, price level, and any note you type). — When: Only if you sign in and use these features

  • Session data — What it is: A sign-in token stored in your browser and session cookies needed to keep you signed in. — When: When signed in

  • Requests and security data — What it is: Coin searches and desks requested, IP address, browser type, and time, processed by our hosting platform and its network provider (including a Cloudflare security cookie used to tell people from bots). — When: Every visit

  • Stored only in your browser — What it is: Terms acceptance record and language preference. — When: Every visit

The web version also loads fonts from Google Fonts, a script from our hosting platform (xAI's Grok Build) that displays platform features, and, in Spanish, Google's translation service for headlines. These providers receive your IP address and standard browser information when your browser contacts them.

3.3 Website pages

WavePrint pages on safesecurityconsulting.com are hosted by Squarespace, which may use cookies and collect standard visit data under Squarespace's settings.

3.4 Technical logs (all versions)

When your device or browser contacts our servers, our hosting providers (Render for the API, behind Cloudflare; xAI's Grok Build platform for the web version) automatically process technical data such as IP address, date and time, requested URL path (which can include the coin or search text), response status, and browser or app user-agent. Our code does not add IP addresses, emails, or purchase tokens to logs. Our server also records error messages, and Google Play notification events (event type, product, and a shortened one-way hash of the purchase token), for debugging. We use logs only to operate, secure, and debug the Service. We do not use IP addresses to determine your location.

3.5 Support emails

If you email us, we receive your email address and whatever you include in the message.

3.6 Information from Google Play

Google Play processes payments. Through the Google Play Console, Google gives us purchase and sales records, such as order number, product, price, date, and buyer country, state or region, and postal code. We do not receive your full card number.

4. How we use information and our legal bases

  • Provide the desks you request — Information: Coin searches and desks requested, language — Legal basis (EEA/UK/Spain): Contract (providing the Service)

  • Confirm purchases and unlock WavePrint Alts; restore purchases — Information: Purchase information, install identifier — Legal basis (EEA/UK/Spain): Contract

  • Check free-access eligibility — Information: Free-access email — Legal basis (EEA/UK/Spain): Consent (you choose to enter it; you can clear it at any time)

  • Sign-in, watchlist, and alerts on the web version — Information: Sign-in information, watchlist and alerts, session data — Legal basis (EEA/UK/Spain): Contract; consent where required for sign-in

  • Security, abuse and fraud prevention, debugging — Information: Technical logs, install identifier, purchase information — Legal basis (EEA/UK/Spain): Legitimate interests (keeping the Service secure and working)

  • Spanish headline translation — Information: Headline text, IP address (to Google) — Legal basis (EEA/UK/Spain): Legitimate interests (providing the Spanish interface you selected)

  • Accounting, tax, and handling refunds and disputes — Information: Google Play purchase records — Legal basis (EEA/UK/Spain): Legal obligation; legitimate interests

  • Answer support requests — Information: Support emails — Legal basis (EEA/UK/Spain): Legitimate interests; contract where the request concerns a purchase

  • Comply with law and protect rights — Information: Any of the above, as needed — Legal basis (EEA/UK/Spain): Legal obligation; legitimate interests

We do not use your information for advertising, profiling, or automated decisions with legal or similarly significant effects.

5. Who receives information

We do not sell personal information. We share it only with:

  • Google — Google Play billing, purchase verification, refund lists, and purchase notifications (Google Play Developer API and Google Cloud Pub/Sub); the Google translation service for Spanish headlines; Google Fonts on the web version; and Google sign-in if you choose it on the web version.

  • X — only if you choose X sign-in on the web version.

  • Hosting and network providers acting for us — Render (API hosting) and Cloudflare (network and security in front of our API and the web version); xAI (Grok Build hosting and sign-in service for the web version); Squarespace (website).

  • Our email provider (Google Workspace / Gmail for the contact address above) — to receive and answer support emails.

  • Legal and safety recipients — when required by law or legal process, or to protect rights, safety, and security.

  • A successor — if we are involved in a merger, acquisition, or sale of assets, subject to this policy.

Market-data sources (Coinbase public market endpoints, Kraken public market endpoints, CoinMarketCap, Cointelegraph and Google News RSS feeds) receive requests from our servers only. They do not receive your email, install identifier, or purchase information from us.

6. No sale, no ads, no cross-site tracking

  • We do not sell personal information for money or other value, and we do not "share" it for cross-context behavioral advertising.

  • No third party collects information about your activity across other apps or websites through the Service for its own advertising. Google, xAI, Cloudflare, and Squarespace receive the technical data described above when they serve their part of the Service.

  • Nevada residents: we do not sell covered information as defined in NRS 603A. You may still send a verified request not to sell to ernie.castro@safesecurityconsulting.com, our designated request address. We will respond within 60 days.

7. How long we keep information

  • On-device data (install identifier, purchase token and product, free-access email, Terms acceptance, language, coin-button favorites) — How long: Until you clear it, clear the app's or browser's storage, or uninstall the app

  • Purchase tokens and free-access emails on our server — How long: Not written to storage. Processed in memory to answer each request; verification results are cached in memory for about 10 minutes; refunded-purchase records (token hash and order number) stay in memory until the server restarts

  • Google Play purchase records — How long: As long as needed for accounting, tax, refunds, and disputes, generally up to 7 years

  • Web sign-in, watchlist, and alerts — How long: Until you ask us to delete them or we close the web version

  • Hosting and network logs — How long: Kept by our providers for their standard periods, generally a few days to 30 days, unless needed for a security investigation

  • Free-access list entries (addresses we added) — How long: Until we remove them or you ask us to

  • Support emails — How long: As long as needed to resolve your request and for our records, generally up to 3 years

8. Security

We use HTTPS for all traffic between the app, the web version, and our servers. We limit access to our systems and keep secrets out of our code. No method of transmission or storage is completely secure.

9. Your choices and rights

Choices available to everyone:

  • Use the Bitcoin desk without an account, purchase, or email.

  • Leave the free-access email blank, or clear it in the app.

  • Delete all on-device data by clearing the app's storage in Android settings or uninstalling the app (web: clear site data in your browser). This does not cancel a Google Play subscription.

  • On the web version, use the desks without signing in.

Requests to us: you may ask to access, correct, delete, or get a copy of your personal information, or object to or restrict our use of it, by emailing ernie.castro@safesecurityconsulting.com. This includes deleting a web sign-in account, watchlist, and alerts. Because the Android app has no accounts, we usually hold little or no information that identifies you; we may ask for details (such as the email you used for web sign-in or a Google Play order number) to find and verify your information. We aim to respond within one month (or 45 days for California requests), and may extend that period where the law allows. We will not treat you differently for exercising your rights. Billing disputes and Google Play refunds are handled by Google Play.

California residents: you may request to know, delete, and correct personal information, and to opt out of sale or sharing (we do neither). You may use an authorized agent. We will not discriminate against you for using these rights.

EEA, UK, and Spain: you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time (this does not affect earlier processing). You may complain to your local data protection authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

10. International transfers

We are based in the United States, and our providers process information in the United States and other countries. When personal information from the EEA, UK, or Switzerland is transferred to the United States, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses offered by our providers, where required. You may ask us for more information.

11. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from children under 13, or, where consent is the legal basis, from children under 14 in Spain or under the applicable age elsewhere. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

We review this policy when the Service changes and at least once a year. We will post any update on this page with a new effective date. For material changes, we will also notify you in the app, on the web version, or in the Google Play listing before the change applies, and ask for consent where the law requires. If we add new collection (for example, accounts in the Android app), we will update this policy and Google Play's Data safety section first.

13. Contact

S.A.F.E. Security Consulting LLC 732 S 6th St Ste N, Las Vegas, NV 89101, USA Email: ernie.castro@safesecurityconsulting.com Phone: 775-242-8402 Website: https://safesecurityconsulting.com