Privacy policy
1. Who we are
Dark Factory is a small, self-hosted platform operated by Nedyalko Mihaylov ("we", "the operator"), who is the controller of the personal data described here. Contact: nedialkom@gmail.com. Its application AI Wallet, at ai-wallet.duckdns.org, helps its users follow the investments they hold; anyone may create a free account there. There is no advertising and nothing to buy. The platform's Models API, for clients holding a key, has its own notice.
2. What we collect
| Data | Source | Why |
|---|---|---|
| Your email address and password (stored as a one-way hash) | You, when you create your account | To sign you in. |
| Your portfolio: instruments, transactions, dividends, your notes and investment strategy | You | The application's purpose: to value your holdings and research them for you. |
| Settings you enter, such as API keys for services you choose to connect and your own press-site sign-ins | You | To reach those services on your behalf. Stored encrypted. |
| Data from your Google account (only if you connect it) — see section 3 | Google, with your consent | To find new videos from the channels you subscribe to. |
| Technical logs: request times, errors, which feature was used | The servers | To keep the service running and to find faults. |
We do not use cookies for tracking or analytics. The application sets only what it needs to keep you signed in.
3. Data we receive from Google
Connecting a Google account is optional. If you connect one, you grant read-only access with these scopes and nothing else:
https://www.googleapis.com/auth/youtube.readonly— we read your channel's name, the list of channels you subscribe to, and the uploads of those channels.openidandemail— we read the email address of the connected account, to show you which account is connected.
How we use it
- Each morning the application lists new uploads on the channels you subscribe to, keeps those that discuss the investments you hold, and reads their public captions so the relevant videos appear in your dossier and daily report with links to the moments they are discussed.
- The list of your subscriptions and the fact that a video came from them are shown to you only. Other users never see what you subscribe to.
- The application cannot post, comment, like, subscribe, upload, or change anything in your Google or YouTube account.
What we do not do
- We do not sell Google user data or any other personal data.
- We do not use it for advertising, for credit decisions, or to profile you for anyone else.
- We do not transfer it to anyone except as needed to provide the feature to you, to comply with law, or with your explicit consent.
- We do not use it to develop, improve or train artificial-intelligence or machine-learning models.
- No person reads it, except with your consent, for security purposes, or where the law requires.
Dark Factory's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI processing
To decide which videos are relevant and to summarise them, the application sends public information about the videos — title, description and captions — to the AI model that serves your account. That model runs on the operator's own hardware or, if your account is configured so, at a third-party AI provider that processes it only to return the answer. Your Google account details and your list of subscriptions are not sent to AI models.
4. Where and how it is stored
- All data is stored on servers the operator owns and runs at home, in the European Union.
- The Google refresh token, the short-lived access tokens, API keys and site passwords are encrypted at rest. They are never displayed back to you, never written to logs, and never sent to an AI model.
- Connections to the application are encrypted (HTTPS). Access to the servers is limited to the operator.
5. How long we keep it
- Google tokens: until you disconnect. Disconnecting revokes the token at Google and deletes it from our servers immediately.
- Your subscription list: not stored as a list; we keep only which of the collected public videos came from your subscriptions, and delete that link when you ask us to delete your data.
- Public videos and their captions: kept as research material while your account exists; they are public content, not personal data about you.
- Your account and portfolio: until you ask us to delete your account. Backups expire after 14 days, so nothing of a deleted account outlives them.
- Technical logs: server logs are rotated automatically and metrics are kept for 15 days. Usage records — which outside source was called for your account, and when — are kept while your account exists, and deleted with it. Neither contains tokens or passwords.
6. Your choices and rights
- Disconnect your Google account at any time in the application (Settings → MCP Servers → YouTube → Disconnect), or revoke access at myaccount.google.com/permissions.
- You may ask for a copy of your data, its correction, or its deletion, and object to or restrict its processing, by writing to nedialkom@gmail.com. We answer within 30 days.
- In the European Union you also have the right to lodge a complaint with your data protection authority.
7. Children
The service is not directed to children under 16 and accounts are not created for them.
8. Changes
If this policy changes, the new version is published here with a new effective date, and users are told in the application before a change that affects how their Google data is used takes effect.