Privacy Policy
Last updated: 10 September 2026. The German version is authoritative.
1. Controller
Global Skyil LLC, 1209 Mountain Road PL NE STE R, Albuquerque, NM 87110, USA – contact for data protection enquiries: [email protected]
2. General
Zonentracker is a private helper tool for HKCM customers to manage their own target zones and positions. We collect only the data necessary to operate the service, do not pass any data to advertisers, and do not use analytics or tracking tools.
3. Hosting
The application is provided via Vercel Inc. (USA). When you access the site, Vercel automatically processes technical server log data (including IP address, timestamp, page requested, browser information) to ensure operation. As Vercel is a US provider, the transfer takes place on the basis of EU standard contractual clauses. Details: vercel.com/legal/privacy-policy.
4. Registration, account & login
To create an account we need your email address and a password (stored encrypted; we never see it in plain text). This is managed via Supabase (Supabase Inc.), with database and authentication servers in London, United Kingdom. For the United Kingdom there is an adequacy decision by the EU Commission confirming a level of data protection comparable to the EU. Details: supabase.com/privacy. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) – without this data no account can be created.
5. Data you enter (target zones, positions, notes)
All target zones, positions and notes you enter are visible only to you – other users have no technical access to them (row-level security at the database level). You enter these values manually yourself; Zonentracker does not create any automated copy of the HKCM analyses. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
6. Price data
To display current prices we query ticker symbols (e.g. "AAPL") from Finnhub Inc. and publicly available Google sources (Google Sheets/Google Finance). No personal data is transmitted in the process – only the ticker symbol itself.
7. Email delivery
Confirmation links, password reset links and codes to confirm account deletion are sent by Supabase Auth on our behalf. For the technical delivery, Supabase uses Resend (Plus Five Five, Inc., USA) as the email service. The transfer to Resend takes place on the basis of EU standard contractual clauses. No separate email marketing service is used; we do not send promotional emails.
8. Security check (CAPTCHA)
When logging in, registering, resetting your password and deleting your account we use Cloudflare Turnstile to prevent automated attacks (e.g. password guessing). Cloudflare processes technical data about your browser/device in the process. Details: cloudflare.com/privacypolicy. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in secure operation.
9. Cookies & tracking
We use only technically necessary session cookies (for login). There are no analytics, marketing or tracking cookies and no sharing with advertising networks.
10. Retention & deletion
Your data is stored for as long as your account exists. You can delete your account yourself at any time in the settings – all associated data (target zones, positions, notes, settings) is then permanently removed.
11. Your rights
You have the right to access, rectification, erasure and restriction of processing of your data, as well as the right to data portability and to object. To exercise these, contact [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.