Privacy policy

Metena is a mobile decision-support application for crypto investing, developed and operated by Metena, a sole proprietorship (micro-entreprise) registered in France (SIREN 108 782 749) and based in Paris, hereinafter "Metena".

Contact: privacy@metena.app

2.1 Data you provide us

2.2 Exchange API key data

Your Exchange API keys are encrypted with AES-256-GCM before storage. The master encryption key is kept only on the infrastructure server (Hostinger, United Kingdom) and is never transmitted to a third party. These keys are read-only: Metena cannot place orders on your behalf. Metena uses them only to read your balances and history at the exchange.

2.3 Data collected automatically

2.4 What we do NOT collect

• Biometric data
• Precise geographic location
• Contacts, photos, or files from your device
• Browsing history outside the application
• Payment data (bank card): payment is handled by Apple or Google

• Service delivery: generation of daily AI briefs, price alerts, backtests, strategy suggestions
• Language models: to generate the Owl’s answers and the diagnostics, Metena sends Anthropic (Claude, United States) your messages to the Owl, your strategy, your positions and balances, your investor profile and the text of your dictations. When Anthropic is saturated or unavailable, the request may be handled as overflow by OpenAI and then Google (Gemini), in the United States, and as a last resort by Mistral AI (France). This only happens after your explicit consent in the app. You can withdraw this consent in Settings. Metena keeps AI requests and answers for 30 days for quality control and debugging.
• Voice dictation: the audio is transcribed into text on Metena’s server (Whisper, hosted by Metena). The audio is not sent to any third party. Only the transcribed text may be sent to the AI provider.
• Analytics: usage measurement by PostHog (hosted in the United States), only if you accept it. Events are linked to a random identifier, without IP-based geolocation. You can withdraw your consent in Settings. This data is never resold.
• Crash reports: when an error occurs, the app sends a technical report to Sentry (European Union). The report does not contain your identity, and sensitive fields are masked.
• Notifications: to send you notifications, Metena stores your device’s notification token and an installation identifier. They are passed to Expo, then to the Apple or Google notification service.
• Emails: emails sent by Metena, including a follow-up email after sign-up, go through Resend.
• Advertising: Metena shows no advertising and does not track your activity for advertising purposes. Your data is never resold.
• Website audience measurement: metena.app counts page views and clicks on its buttons as daily totals, with no cookie and without keeping any IP address or identifier. These totals are stored on Metena’s server.

Your account, your strategies and your keys are hosted in the United Kingdom and the European Union. Some data is processed in the United States: AI requests, usage measurement if you accept it, notifications and emails.

Metena does not sell or rent your personal data. The only data transfers are:

• AI providers: Anthropic (Claude, United States) first; OpenAI and Google (United States), then Mistral AI (France), as overflow. They receive the request context, processed in real time, only after your consent in the app.
• Supabase (EU): authentication (email, Google or Apple sign-in) and database
• Hostinger (United Kingdom): server infrastructure
• PostHog (United States): usage measurement, only with your consent
• Sentry (European Union): crash reports, without your identity
• Expo (United States), Apple and Google: notification token and installation identifier, to send notifications
• Resend: sending emails
• Moralis: public addresses of your wallets, to read their balances and history
• WalletConnect / Reown: connecting your wallet to the app. Reown analytics are disabled.
• Exchanges: Metena uses your read-only API keys to read your balances and history at the exchange concerned
• Apple / Google: in-app purchase payments are handled by Apple or Google (StoreKit 2 / Google Play Billing). Metena only receives the transaction identifier.

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct inaccurate data
• Right to erasure: request the deletion of your account and all your data. You can also delete your account directly in the app: the account data is erased and your strategies published on the marketplace are removed.
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data for analytics purposes
• Withdrawal of consent: withdraw at any time, in the app’s Settings, your consent to sending data to AI providers and to usage measurement

To exercise these rights: privacy@metena.app

Response time: 30 days maximum.

• Transport: HTTPS/TLS 1.3 on all communications
• Exchange key encryption: AES-256-GCM
• Authentication: JWT signed via Supabase Auth (HS256)
• Server access: SSH key authentication only
• No plaintext passwords in logs

Metena is intended for users aged 18 and over. We do not knowingly collect data on minors.

Any substantial change to this policy will be notified by email and via an in-app notification at least 14 days before it takes effect.

For any question regarding this policy: privacy@metena.app