Last updated: October 2026
The data controller responsible for data processing on this website is:
Sheran Investments UG (haftungsbeschränkt)
Erzgießereistr. 5a
80335 München, Germany
Phone: +49 176 4734 3575
Email: support@doesitrepeat.com
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
We take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
When you use this website, various personal data is collected. This privacy policy explains what data we collect, what we use it for, and how we process it.
We process personal data based on the following legal grounds under Art. 6(1) GDPR:
When you create an account, we collect your email address, display name, and authentication credentials. Account authentication is managed through Firebase Authentication (Google Ireland Limited). The legal basis is Art. 6(1)(b) GDPR (contract performance).
When you subscribe to our service, payment processing is handled by Stripe, Inc. (Stripe Payments Europe, Ltd. for EU customers). We do not store your full payment card details on our servers. Stripe processes your payment information in accordance with PCI-DSS standards. We receive only a truncated card number, expiration date, and billing address for record-keeping. The legal basis is Art. 6(1)(b) GDPR (contract performance).
For more information, see Stripe's privacy policy at stripe.com/privacy.
When you visit our website, our servers automatically collect technical data including your IP address, browser type and version, operating system, referrer URL, pages visited, and the date and time of your visit. This data is collected based on our legitimate interest in ensuring website security and functionality (Art. 6(1)(f) GDPR).
If you contact us via email, your message and all provided personal data (name, email address) will be stored for the purpose of processing your inquiry. We will not share this data without your consent. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to the performance of a contract, or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
Our website uses cookies. Cookies are small text files that are stored on your device by your web browser. You can configure your browser to reject cookies or to alert you when cookies are being sent; however, some parts of the Service may not function properly without them.
These cookies are essential for the operation of the website and cannot be disabled. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing a functional website).
| Cookie | Purpose | Duration |
|---|---|---|
| firebase-auth-session | Authentication session token | 24 hours |
| cookie-consent | Stores your cookie consent preference | Persistent |
| astro-selection | Remembers your selected symbol/ticker | Persistent |
| theme | Stores your light/dark mode preference | Persistent |
| NEXT_LOCALE | Remembers the language you chose in the language switcher | 1 year |
If you consent via our cookie banner, we use PostHog analytics cookies to understand how visitors interact with our website. These cookies are only set after you have given your explicit consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by clearing your cookies or changing your preference in the cookie banner.
| Cookie | Purpose | Duration |
|---|---|---|
| ph_* | PostHog analytics — page views, interactions | 1 year |
When you arrive at our website by clicking a Google Ads advertisement, the URL contains a Google Click Identifier (“gclid”). We store this identifier in a first-party cookie so that, if you later create an account or buy a subscription, we can attribute your sign-up or purchase back to the ad you clicked. The cookie does not contain your name, email address, or any directly identifying information.
We use Google Consent Mode v2 to respect your choice in the cookie banner. If you click “Accept All”, we transmit the click identifier to Google with your advertising consent flags set to “granted” (legal basis: Art. 6(1)(a) GDPR — consent). If you click “Essential Only”, the identifier is still transmitted but with consent flags set to “denied”, which restricts Google to using only aggregated, modeled conversion measurement on our behalf and prevents personalized advertising or cross-site profiling based on it (legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring the effectiveness of our marketing). You can withdraw consent or object to this processing at any time by clearing your cookies or contacting us.
To understand which channels bring visitors to us, we also record how you first reached our website: the address of the referring page (without its query string), the first page you opened, any campaign tags in the link you followed (“utm” parameters), and whether that link carried an advertising click identifier (only its type, not its value). This is kept in a first-party cookie and, if you subscribe to our newsletter or create an account, stored with your subscriber record. It is not shared with third parties (legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring the effectiveness of our marketing). If you click “Essential Only”, this cookie is not set and any existing one is deleted.
| Cookie | Purpose | Duration |
|---|---|---|
| gclid | Google Ads click identifier — attributes sign-ups and subscription purchases to the originating ad click | 90 days |
| first_touch | First-visit source — referring page, landing page and campaign tags, used to attribute sign-ups to a marketing channel | 90 days |
We use the following third-party service providers to operate the Service. Each provider processes personal data on our behalf as a data processor or as an independent controller, as indicated below.
We use Firebase Authentication by Google Ireland Limited for user account management and sign-in. When you sign in (via email/password or Google Sign-In), Firebase processes your authentication data (email address, display name, authentication tokens). The legal basis is Art. 6(1)(b) GDPR (contract performance). Google may transfer data to the US under Standard Contractual Clauses (SCCs) in accordance with Art. 46(2)(c) GDPR. For more information, see Firebase Privacy Information.
Payment processing is handled by Stripe Payments Europe, Ltd. (for EU-based customers). Stripe processes your payment details (card number, expiration date, billing address) in a PCI-DSS-compliant environment. We receive only a truncated card number and billing details for record-keeping. The legal basis is Art. 6(1)(b) GDPR (contract performance). For international data transfers, Stripe relies on Standard Contractual Clauses. For more information, see Stripe's Privacy Policy.
With your consent, we use PostHog to analyse how visitors interact with our website. PostHog collects data such as pages visited, clicks, session duration, browser type, screen resolution, and approximate location derived from your IP address. Your IP address is anonymized before storage. The legal basis is Art. 6(1)(a) GDPR (consent). PostHog data is stored and processed in the United States by PostHog, Inc.; these transfers are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can withdraw your consent at any time via the cookie banner or by clearing your browser cookies. For more information, see PostHog's Privacy Policy.
We use Cloudflare, Inc. as a content delivery network (CDN) and for DDoS protection. Cloudflare may process your IP address, request headers, and other connection metadata to route traffic and protect against malicious requests. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in website security and performance). Cloudflare is certified under the EU-US Data Privacy Framework. For more information, see Cloudflare's Privacy Policy.
Our website frontend is hosted by Vercel Inc. Vercel may process server logs containing IP addresses and request metadata. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the Service). Vercel uses Standard Contractual Clauses for data transfers outside the EU/EEA. For more information, see Vercel's Privacy Policy.
We use Google Ads, operated by Google Ireland Limited, to advertise our Service. To measure the effectiveness of our advertising, we load Google's tag (gtag.js) from googletagmanager.com on every page and we transmit conversion events (such as a completed sign-up or a subscription purchase) to the Google Ads API from our backend server. These transmissions include the Google Click Identifier described in section 5.3, the date and time of the conversion, for purchases the amount paid (excluding tax) and the checkout reference, and your IP address as observed by Google when the tag loads.
We have implemented Google Consent Mode v2. The Google tag is loaded with all advertising and analytics consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) set to “denied” by default. When you make a choice in the cookie banner, these signals are updated accordingly, and the same flags are sent to the Google Ads API alongside our server-side conversion uploads. When the flags are “denied”, Google is contractually required to use the data only for aggregated, modeled conversion measurement on our behalf and not for personalized advertising or cross-site profiling.
The legal basis for personalized advertising attribution is your consent (Art. 6(1)(a) GDPR). The legal basis for aggregated, modeled measurement when consent is denied is our legitimate interest in evaluating our marketing spend (Art. 6(1)(f) GDPR). Google may transfer data to the United States; transfers are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. You can object to this processing at any time by withdrawing consent in the cookie banner or by contacting us. For further information, see Google's Privacy Policy and Google's information on Consent Mode v2.
Some pages show a video hosted on YouTube, operated by Google Ireland Limited. Until you press play, the page shows only a still image served from our own website, and no data is sent to YouTube. When you press play, the player loads from youtube-nocookie.com (YouTube's privacy-enhanced mode), and Google receives your IP address, browser information and the page you are watching from, and may store information on your device as part of playing the video. The legal basis is your request to play the video (Art. 6(1)(a) GDPR). Google may transfer data to the United States under the EU-US Data Privacy Framework. For more information, see Google's Privacy Policy.
Some of our third-party service providers are based outside the European Economic Area (EEA). Where personal data is transferred to countries outside the EEA that do not have an adequate level of data protection as determined by the European Commission, we ensure appropriate safeguards are in place, including:
You may request a copy of the applicable safeguards by contacting us at support@doesitrepeat.com.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
After expiry of the applicable retention period, personal data is securely deleted or anonymized. Where deletion is not possible due to legal archival obligations, the data is restricted from further processing and stored securely until deletion is possible.
Under the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at support@doesitrepeat.com. We will respond to your request within one month as required by Art. 12(3) GDPR.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with Art. 32 GDPR. These measures include:
Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. We regularly evaluate and update our security measures but cannot guarantee absolute security.
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at support@doesitrepeat.com and we will promptly delete such data from our systems.
We do not use automated decision-making or profiling as defined in Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The trade signals and analytical outputs displayed on the platform are generated by algorithms applied to market and astronomical data, not to your personal data, and do not constitute automated individual decision-making.
If you subscribe to our newsletter or marketing emails, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time by clicking the “unsubscribe” link included in every marketing email or by contacting us at support@doesitrepeat.com. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
We may send you transactional emails related to your account and subscription (e.g., payment confirmations, service notifications) without separate consent, as these are necessary for contract performance (Art. 6(1)(b) GDPR).
We reserve the right to update this privacy policy to reflect changes in our practices, third-party services, or for other operational, legal, or regulatory reasons. We will notify registered users of material changes via email. The updated version will be indicated by the “Last updated” date at the top of this page. We encourage you to review this policy periodically.