Privacy Policy — Metena
Dernière mise à jour : June 2026
1. Who we are
Metena is a mobile decision-support application for crypto investing, developed and operated by Metena, a sole proprietorship based in Paris, France, hereinafter "Metena".
Contact: privacy@metena.app
2. Data we collect
2.1 Data you provide us
| Data | Purpose |
|---|---|
| Email address | Authentication via Supabase Auth |
| Investor profile (horizon, risk tolerance, assets…) | Personalization of AI analyses |
| Investment strategies | Storage and analysis of your portfolio |
| Trading journal | Improving your behavioral edge |
| Exchange API keys (Binance, Coinbase, Kraken) | Automatic synchronization of your balances |
2.2 Exchange API key data
Your Exchange API keys are encrypted with AES-256-GCM before storage. The master encryption key is kept only on the infrastructure server (Hetzner, Germany) and is never transmitted to a third party. These keys are read-only — Metena cannot place orders on your behalf.
2.3 Data collected automatically
| Data | Purpose |
|---|---|
| Anonymized usage events (screens visited, features used) | Product analytics via PostHog (self-hosted EU) |
| Random analytics identifier | Aggregation of usage metrics — not linked to your identity |
2.4 What we do NOT collect
- Biometric data
- Precise geographic location
- Contacts, photos, or files from your device
- Browsing history outside the application
3. How your data is used
- Service delivery: generation of daily AI briefs, price alerts, backtests, strategy suggestions
- LLM (Mistral AI): your questions and your strategy context are sent to the Mistral AI API (France) to generate the Owl's responses. Mistral AI does not store prompts after processing, in accordance with its privacy policy.
- Analytics: aggregated and anonymized usage measurement to improve the product — never resold
4. Hosting and data location
| Service | Host | Location |
|---|---|---|
| Backend API + database | Hetzner Cloud | Frankfurt, Germany (EU) |
| Authentication + PostgreSQL | Supabase | EU West region (Frankfurt) |
| Analytics | PostHog CE (self-hosted) | Hetzner Frankfurt, Germany (EU) |
| LLM (request processing) | Mistral AI | France (EU) |
No personal or financial data is hosted outside the European Union.
5. Retention period
| Data | Retention |
|---|---|
| User account and associated data | Until account deletion + 30 days |
| Exchange API keys | Deleted immediately upon disconnection |
| Server logs | Rolling 7 days |
| Anonymized analytics events | 24 months |
6. Data sharing
Metena does not sell or rent your personal data. The only data transfers are:
- Mistral AI (France): AI query context, real-time processing, not stored
- Supabase (EU): authentication and database
- Hetzner (Germany): server infrastructure
- Apple / Google: only the data strictly necessary to validate in-app purchases (via StoreKit 2 / Google Play Billing)
7. Your rights (GDPR)
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access: obtain a copy of your personal data
- Right of rectification: correct inaccurate data
- Right to erasure: request the deletion of your account and all your data
- Right to portability: receive your data in a structured format
- Right to object: object to the processing of your data for analytics purposes
To exercise these rights: privacy@metena.app
Response time: 30 days maximum.
8. Security
- Transport: HTTPS/TLS 1.3 on all communications
- Exchange key encryption: AES-256-GCM
- Authentication: JWT signed via Supabase Auth (HS256)
- Server access: SSH key authentication only
- No plaintext passwords in logs
9. Minors
Metena is intended for users aged 18 and over. We do not knowingly collect data on minors.
10. Changes
Any substantial change to this policy will be notified by email and via an in-app notification at least 14 days before it takes effect.
11. Contact
For any question regarding this policy: privacy@metena.app