Privacy Policy

Last updated: October 27, 2026

1. What we collect

• Account data — your e-mail address (magic link) and, if you sign in with Google, your name and avatar as provided by Google.
• Subscription data — your plan, subscription status (including trial and cancellation dates), and Stripe customer and subscription identifiers. Card numbers never touch our servers — payment data is handled entirely by Stripe.
• Trial check — the Pro trial is one per person. When you start one, we keep the card fingerprint Stripe gives us (an opaque identifier, not the card number) and your e-mail address in a normalized form (for Gmail, without dots or "+" tags), to decline a second trial with the same card or the same Gmail address.
• Usage log (signed-in accounts only) — a short record of how you use the product while signed in: sign-ins, opening the terminal, which market windows you view (asset, duration, venue), visits to the pricing, account and performance pages, starting a checkout, connecting Telegram, and changes to terminal settings. We use it to understand which features matter and to improve the product. It is never sold, never shared for advertising, and never used to show you ads.
• Sign-in diagnostics — when a sign-in e-mail is requested or a sign-in fails, we record the step, the reason (for example "code expired"), the page language and the type of e-mail provider (Gmail, Outlook, Yahoo, iCloud, Proton or other) — never the address. It tells us when signing in breaks. To stop repeated guessing of sign-in codes we also keep short-lived counters keyed by a one-way hash of the address and of the IP address (never stored in clear), deleted within a day.
• Button clicks — when you click a sign-up or sign-in button ("Try a month for €4.95", "Sign in"), we count which button and the page language. No identifier, no cookie.
• Where your first visit came from — on your first visit we note thedomain name of the referring site only (for example reddit.com — never the full address), the campaign tags of the link if it had any (utm_source,utm_medium, utm_campaign, reduced to plain lowercase words), the first page you landed on and the day. It stays in your browser, in a first-party cookie named mp_src, for 30 days, and is added to the usage log only at three moments: when you sign up, when a new account signs in for the first time, and when you start a checkout. We use it for one thing: counting sign-ups per source, in aggregate. It is not an identifier, no third party receives it, and the site works the same if your browser refuses it (the source is then recorded as "unknown").
• Anonymous audience measurement — Vercel Web Analytics counts page views and where visits come from (referring site, country, browser, device type). It sets no cookie and stores no identifier on your device; visitors are not identified and the figures are aggregated.
• Weekly email (only if you subscribe) — your e-mail address, the page where you subscribed (or your account page), and the dates you asked and confirmed. Subscription is double opt-in: we send one confirmation e-mail, and an address that is not confirmed within 7 days is deleted. When you unsubscribe, the address is deleted; we keep only a one-way hash of it and the dates, to count unsubscriptions and so that subscribing again goes through confirmation again. We count clicks on the links of each issue, per issue, without recording who clicked. There is no tracking pixel: we do not measure opens. The weekly email is separate from sign-in e-mails — unsubscribing never stops the sign-in e-mails of a Mispria account.
• Telegram (only if you connect the bot) — your Telegram chat ID and @username, your alert settings, and a log of the alerts the bot sent you (kept 14 days).
• Technical logs — standard server logs (IP, user-agent, timestamps) kept briefly for security and debugging.

The public performance pages contain no personal data — only market metrics.

2. Cookies

We use authentication cookies only: your session, plus short-lived sign-in helpers (the page language, the page to return to, and the address waiting for a sign-in code — deleted within an hour). No advertising cookies, and our audience measurement uses no cookie at all.

One more cookie, for measurement: mp_src, first-party (readable by mispria.com only), kept 30 days, which holds the source of your first visit described in §1 — the referring site's domain name, the campaign tags of the link, the first page and the day. No identifier, no third party. Vercel's audience measurement remains cookie-free.

3. Processors

• Supabase (EU region, eu-west-1) — database and authentication.
• Stripe — payments and subscription management.
• Vercel — website hosting and anonymous audience measurement (Web Analytics).
• Hetzner (Germany) — data-collection server, which also runs the Telegram bot.
• Telegram — message delivery, only if you connect the bot.
• Resend (EU region, Ireland) — sending the weekly email and its confirmation e-mail, only if you subscribe.

4. Purpose and legal basis

We process your data to provide the service (contract), to secure it and to improve it — the usage log and the audience measurement (legitimate interest) — and to meet accounting obligations (legal obligation). The trial check (card fingerprint and normalized e-mail) rests on our legitimate interest in preventing abuse of the trial. The weekly email rests on your consent, which you can withdraw at any time in one click. We do not sell or share personal data for advertising.

5. Retention

Account data and the usage log are kept while your account exists and deleted upon account deletion, except what invoicing law requires us to retain. The Telegram alert log is kept 14 days. The trial check is kept for as long as the trial is offered, so that deleting and re-creating an account does not grant a second trial. The weekly-email address is kept until you unsubscribe (an unconfirmed address, 7 days); the per-issue click counts hold no personal data. Technical logs are short-lived. The first-visit cookie expires after 30 days; the source values added to the usage log follow the usage log.

6. Your rights

Where GDPR applies you may request access, rectification, erasure, portability, or restriction of your personal data, and object to processing — including the usage log. To stop the weekly email: the unsubscribe link at the bottom of every issue (one click, no sign-in), your e-mail app's unsubscribe button, the checkbox on your account page, or a message to us. Write to contact@mispria.com — we answer within 30 days. You may also lodge a complaint with your local supervisory authority.

7. Controller

The data controller is GuideMyGuest OÜ (registry code 17284496), Sakala tn 7-2, Kesklinna linnaosa, 10141 Tallinn, Estonia — operator of the Mispria product. As an Estonian company we fall under the GDPR; the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), and you may also complain to the authority of your own country of residence.

Contact for any data request: contact@mispria.com.

8. The terminal (mispria.com/terminal)

The terminal runs in your browser. Signed out, it reads public market feeds directly (Polymarket, Binance, Coinbase, Kraken, OKX, Bybit) and the model runs on your device; the only requests it makes to mispria.com fetch a market's reference price and carry no personal data (plus the anonymous page count of §1). Signed in, it adds the usage-log entries of §1 — opening the terminal, the windows you view, the settings you change. Signed in as a Pro subscriber, it opens one authenticated stream to our server using your session (Kalshi data is relayed through it): we use it to confirm the subscription and send the metrics, and we do not store the token. Display preferences (collapsed cards, chart sizes) stay in your browser's local storage. If you add the terminal to your home screen, the browser caches static files only — never market data. No ads, no advertising trackers.