Privacy Policy

1. Data we collect

FX Bank Forecast collects only the data necessary to operate and improve the platform.

• Email address. Collected when you voluntarily subscribe to coverage updates via the footer form. Used solely to send editorial updates. Not shared or sold.
• Usage and analytics data. We operate a first-party analytics system on our own infrastructure. When you browse this site we record: URL path (including any UTM campaign parameters present in the URL such as utm_source, utm_medium, and utm_campaign); country derived from your IP at the network edge; the referring URL if your browser sends one; browser user-agent string (used to classify device type, browser family, and operating system at a coarse level — e.g. desktop / Chrome / Windows); a pseudonymous session UUID stored in the fx-session cookie; and a daily-rotating HMAC-SHA256 hash of your IP address. The raw IP is never written to any database or log. The hash rotates at midnight UTC, preventing cross-day linkage. No third-party analytics service receives this data; all storage is in our own infrastructure (Supabase PostgreSQL, AWS ap-southeast-1). Do-Not-Track (DNT=1) is honoured: when your browser signals DNT, no pageview is recorded and no session cookie is set. We may internally compare pageview records against our subscriber records using the pseudonymous IP hash to understand how many visitors subsequently sign up. This comparison is performed server-side only; no individual-level cross-table data is exposed in any API response or interface. We log clicks on outbound links to external sites so we can understand which sources our readers find useful. We log only the destination URL, not any content from the linked page.
• Authentication credentials. If you create an account, your email address and a hashed password (or OAuth token) are stored in Supabase. Passwords are never stored in plaintext.
• Payment data. Billing is handled entirely by Stripe. We do not store card numbers or bank account details. We retain only a Stripe customer identifier and subscription status.

2. How we use it

• To deliver coverage update emails you requested.
• To understand which content is read most, so editorial resources are allocated appropriately. This relies on analytics consent.
• To authenticate your account and manage subscription access.
• To comply with legal obligations, including fraud prevention and applicable financial regulations.

We do not use personal data for automated decision-making or profiling. We do not sell, rent, or broker data to third parties.

3. Cookies

We use a minimal set of cookies. Strictly necessary cookies are set automatically; analytics cookies are set only with your consent.

You can review the full cookie inventory on our Cookie Policy page. You can update your preferences at any time via the “Manage preferences” link in the cookie notice.

4. Third parties

We engage the following sub-processors. Each is subject to its own privacy programme.

5. Your rights

Depending on your jurisdiction, you may have the following rights:

GDPR (EU and UK) and CCPA rights apply to relevant residents. Requests are processed within 30 days.

POST /api/privacy/delete
Content-Type: application/json

{ "email": "you@example.com" }

6. Contact

Data-related enquiries, access requests, and deletion requests should be directed to:

coverage@fxbankforecast.com

If you are located in the EU or UK and believe your rights have not been respected, you have the right to lodge a complaint with your local supervisory authority.

7. Self-service deletion

Data subjects may exercise the right to erasure directly. Two channels are supported and processed by the same internal workflow.

• Programmatic. POST a JSON body to /api/privacy/delete with exactly one of sessionId, ipHash, or email. Every matching pageview, event, and subscriber row is removed in a single transaction. The endpoint is rate-limited and does not require authentication — the identifiers themselves are the authorisation.
• Email. If you prefer not to use the API, send a deletion request to privacy@fxbankforecast.com. Requests are processed within 30 days as required by GDPR Art. 12(3).

Note: the ipHash path only deletes analytics rows. Subscriber records use a different hash scheme and are matched solely by the email identifier.

8. Product experiments

We may run product experiments (A/B tests) where visitors see slightly different versions of the site. Variant assignment is sticky to your fx-session cookie and uses no other identifying information. Experiment data is deleted when you delete your session.