This is a translation, provided so that you can read it. The binding version is the German Datenschutzerklärung, and where the two differ, the German text applies.
This notice covers the website stonqs.app. What the app does on your own computer is on the Privacy page.
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is Vladimir Varvorkin, postal address on the legal notice, e-mail: hello@stonqs.app. No data protection officer has been appointed, because none is required.
2. In short
This website sets no cookies, uses no analytics or tracking tools, and loads nothing from other servers (no external fonts, videos, maps or scripts). Small scripts read, in your browser, your preferred languages and your operating system, so that you are shown the right translation and the right download; none of this leaves your device. The only thing stored in your browser is your choice of language, and only if you make one yourself (see 3.). Personal data arises only in delivering the pages technically and when you send us an e-mail. There is no contact form, no sign-up and no newsletter.
3. What the website reads and stores in your browser
The site exists in English, Russian and German. When you open the English home page, a script reads the list of preferred languages set in your browser and sends you to the matching version, where there is one. On the home page and the download page a script also reads the browser identification (user agent), only to derive the operating system from it (macOS, Windows or Linux): the home page names it on the download button, which then downloads the matching file directly (on Windows, the link to the Microsoft Store takes its place), the download page puts your system first.
Your browser sends both of these with every page request anyway (in the "Accept-Language" and "User-Agent" headers). The scripts read them in your browser, evaluate them only there, and transmit them neither to us nor to anyone else; they are not stored, not linked with one another and not used to recognise you.
If you pick a language yourself in the header, the site puts that choice into your browser's local storage under the key "stonqs.lang", so that the automatic redirect does not overrule your decision; it is read when the English home page is opened. What is stored is the language code and the moment you chose it, so "en" and a date, and no identifier that could be used to recognise you. Once the entry is older than twelve months it is deleted the next time the English home page is opened and is no longer honoured.
For the unsigned macOS build the site names a Terminal command, on the download page and in a note that opens when a Mac build is downloaded; beside it is a "Copy" button. Press it and the site writes that command to your device's clipboard, and only then; the clipboard is never read.
Reading and storing this is access to your device within the meaning of § 25 (1) TDDDG. We rely on § 25 (2) no. 2 TDDDG, under which no consent is needed where the access is strictly necessary to provide a service you expressly requested: you open a page in order to read it in a language you understand and to download the software for your system. The access goes no further than that, and the only thing stored is what you pick in the menu yourself. No personal data is processed in doing so, because none of it leaves your device.
You can prevent all of it at any time: delete the stored entry in your browser's settings (stored website data), and if you switch JavaScript off for this site, nothing is read and nothing is stored. Everything stays reachable then: you choose the language and the download yourself, and only the example portfolio on the home page cannot be adjusted without JavaScript.
4. Hosting and server log data
The site is delivered through Cloudflare, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When a page is opened, Cloudflare processes technically necessary data: IP address, date and time, the address requested, the referrer and the browser identification (user agent). Without them the page cannot be delivered and cannot be protected against attacks.
The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is providing the website securely and reliably. For delivering the website Cloudflare processes the data on our behalf under its data processing agreement (Art. 28 GDPR). Where Cloudflare processes data for its own purposes, in particular to protect its network against attacks and abuse, Cloudflare is itself the controller for that. Processing in the USA is possible; Cloudflare is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). Should that decision lapse or be declared invalid, we base the transfer on the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which are part of Cloudflare's data processing agreement.
We keep no log files ourselves and see only aggregate figures such as the number of visits, with no link to any individual. Cloudflare keeps this data only as long as delivering the website and fending off attacks requires; it names no fixed period. The details are in Cloudflare's privacy policy.
5. Contact by e-mail
If you write to an address at stonqs.app, Cloudflare Email Routing receives the message and delivers it to a mailbox at Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. Your e-mail address, the content of the message and the technical headers are processed in doing so. Both services process the data on our behalf under a data processing agreement (Art. 28 GDPR). When Cloudflare receives the message, processing in the USA is possible; the basis is the adequacy decision on the EU-US Data Privacy Framework named under 4. (Art. 45 GDPR), and should it lapse, the EU Commission's standard contractual clauses apply here too (Art. 46 (2) (c) GDPR). The message is stored only in data centres in Switzerland; for Switzerland too an adequacy decision of the European Commission exists (Art. 45 GDPR).
We use this data only to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is being able to answer enquiries. The message is deleted once the enquiry is settled and there is no reason to keep it, as a rule after a year at the latest.
6. GitHub and the Microsoft Store
The download buttons and other links lead to GitHub, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. This website loads nothing from GitHub; only when you click such a link do you call GitHub directly, and the GitHub General Privacy Statement applies. If you contact us through GitHub Issues or Discussions, what you write there is publicly visible. We use these posts only to respond to them; the legal basis is Art. 6 (1) (f) GDPR, our legitimate interest being to deal with questions and bug reports. You can edit or delete your posts there yourself.
The app also asks GitHub whether a newer version exists; it fetches the list of releases and sends nothing about you or your portfolio with it. That check can be switched off in the settings. The same privacy statement applies.
For Windows, the website also points to the Microsoft Store, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; for users in the European Economic Area, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, is responsible as well. The Store badge is an image served by this website itself; only when you click it do you call the Microsoft Store directly, and the Microsoft Privacy Statement applies. If you install the app there, the Store's terms apply, and Microsoft may process data of your Microsoft account in doing so.
An app installed from the Microsoft Store does not ask GitHub for its update check: it asks the Microsoft Store, through an interface of Windows, whether a newer version exists. The app itself passes on nothing about you or your portfolio; which device and account data Windows and the Store send to Microsoft in doing so is up to Microsoft. We receive no data from it. The app's check can be switched off in the same way. Independently of that, the Microsoft Store looks for and installs updates according to your settings in the Store app, where you can also pause automatic updates. The Microsoft Privacy Statement applies.
7. The app
The app you download runs on your device. Your transactions, holdings, accounts and the figures worked out from them stay there and are not transmitted to us; we run no server that could receive them, and the app contains no analytics. Your portfolio sits in a database file in your profile folder; give the profile a password and that file is encrypted.
Prices, exchange rates, inflation figures and the search for an instrument are fetched by the app directly from the providers you turn on yourself in the settings, which are listed one by one on the Privacypage, or from an address you enter yourself as a custom source. Until you have chosen a source, the app asks none. Those providers see your IP address and what was asked for, so a ticker or a currency pair, but not your holdings or amounts; their own privacy terms apply.
The AI assistant is something you set up yourself: with a key from a provider of your choice, or with a server you run yourself, such as a model on your own machine. Only then can it transmit anything, and even then only what you let it read or change; it asks first. What the provider does with it is in that provider's privacy terms.
8. Obligation to provide data
You are not obliged to give us any data. Without the technical data named under 4. the website cannot be shown, however, and without your e-mail address we cannot reply.
9. Your rights
You have the right to
- access the data held about you (Art. 15 GDPR),
- rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
- data portability (Art. 20),
- lodge a complaint with a data protection supervisory authority (Art. 77).
An informal e-mail to hello@stonqs.app is enough. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also turn to the supervisory authority where you live.
10. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (f) GDPR (Art. 21 (1) GDPR).We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal e-mail to hello@stonqs.app is enough for an objection.
There is no automated decision-making and no profiling.
As at: October 2026