Privacy Policy

01Who we are

TradeFluent is operated by Just Impact LTD OOD, a company registered in Bulgaria (company number 207883891) with its registered office at 9Zh Boris Rumenov Str., 1407 Sofia, Bulgaria. In this policy, "we", "us" and "our" mean Just Impact LTD OOD. We are the data controller for the personal data described here.

You can reach us about anything in this policy at team@justimpact.net.

02What this covers

This policy applies to the TradeFluent mobile apps for iOS and Android and this website at tradefluent.app (together, the "Service"). It does not cover third-party sites or services we link to, such as the App Store or Google Play, which have their own policies.

03Data we collect

We collect only what the Service needs to work. Here is the full list.

Account data

• Email address and, if you choose to add one, a display name.
• Password, if you sign up with email. It is stored only as a salted hash by our authentication provider; we cannot read it.
• Sign-in identifiers if you use Google or Apple sign-in: the identifier, email address and name that Google or Apple share with us under your settings. With Apple you can choose to hide your email, in which case we receive a relay address.
• Account timestamps: when the account was created and when you finished onboarding.

Preferences

• The market you trade (stocks, crypto, or both). We use it to filter content.
• Your preferred time of day for a daily reminder.

Learning activity

• Practice sessions: start and end time, duration, which cards you saw, your quiz score and your discipline check-in answer.
• Streaks: current and longest streak, and the date of your last completed session.
• Cards viewed, scenario answers and topic quiz attempts with scores and timestamps, so the app can schedule review and enforce the 24-hour retake wait.
• Rulebook entries: the rules you write in your own words and the cards you attach to them. Rules are private to you. Please don't put other people's personal information in them.

Subscription data

• If you subscribe to Pro, the purchase is processed by Apple or Google. We receive the subscription status, plan (monthly or yearly), product identifier, start and renewal dates, and a pseudonymous subscriber identifier via RevenueCat. We never receive your card or bank details.

Analytics and diagnostics

• Product events such as "session completed", "scenario answered" or "rule created", with non-identifying properties like a score or a topic. We never send the text of your rules, your email or your name in event properties.
• Device and app information: app version, operating system and version, device model, language, and a pseudonymous analytics identifier that is linked to your account identifier.
• Crash and error reports with technical stack traces.
• Masked session recordings on the mobile apps: a replay of taps and screen transitions in which all text and images are obscured before leaving your device, used to diagnose bugs and confusing screens. See section 8 to opt out.

Notifications

• If you allow notifications, a push token for your device so we can deliver reminders. You can turn notifications off in your device settings at any time.

What we do not collect

We do not collect your location, contacts, photos, brokerage accounts, trades, positions or balances. TradeFluent never connects to an exchange or broker. We do not use advertising identifiers and do not show ads.

04Why we use it and on what legal basis

We do not use your data for automated decisions with legal or similarly significant effects, and we do not profile you for marketing.

05Who we share it with

We share personal data only with service providers that process it on our behalf under data processing agreements, and only as needed to run the Service. We do not sell personal data and never have.

We may also disclose data if the law requires it, to protect our rights or the safety of users, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

06International transfers

Your data is hosted in [Supabase project region, e.g. the European Union]. Some of our providers, including PostHog, RevenueCat, Apple and Google, may process data in the United States or other countries outside the European Economic Area. Where that happens we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism. You can request a copy of the relevant safeguards by contacting us.

07How long we keep it

• Account, preferences and learning activity: for as long as your account exists. When you delete your account we erase this data within 30 days, except as noted below.
• Subscription records: for the period required by Bulgarian accounting and tax law, currently up to 10 years, in a form limited to what the law requires.
• Analytics events and crash reports: [12 months], after which they are deleted or fully anonymised. Masked session recordings are kept for [30 days].
• Website analytics (only if you accepted cookies on tradefluent.app): [14 months] in Google Analytics.
• Backups: encrypted database backups roll over within 30 days.
• Support emails: up to 2 years after the matter is closed.

08Your rights

Under the GDPR and, where applicable, other privacy laws, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data (see section 9).
• Restrict processing in certain circumstances.
• Port the data you gave us to another service in a machine-readable format.
• Object to processing based on our legitimate interests, including analytics and session replay. Email us and we will exclude your account from analytics going forward.
• Withdraw consent at any time where we rely on it, for example by turning notifications off.
• Complain to a supervisory authority. Ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg), but you may contact the authority where you live.

To exercise any of these, email team@justimpact.net from the address on your account. We respond within one month. We will never charge for a reasonable request.

09Deleting your account

You can delete your account and all associated data at any time:

• In the app: [Settings → Account → Delete account, once available].
• By email: write to team@justimpact.net from the email on your account with the subject "Delete my account".

Deletion removes your profile, preferences, sessions, streaks, quiz history and Rulebook within 30 days. Deleting your account does not cancel an active subscription; cancel it in your App Store or Google Play account settings first, or it will keep renewing.

10Security

All data travels over TLS. Data at rest is encrypted by our hosting provider. Every database table is protected by row-level security so that your data can only be read with your own session. Passwords are hashed, not stored. Access to production systems is limited to the people who operate the Service. No system is perfectly secure, so if we learn of a breach that affects you we will tell you and the relevant authority as the law requires.

11Age limit

TradeFluent is for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

12This website

tradefluent.app uses Google Analytics only if you accept it in the cookie banner. If you reject it, or make no choice, the analytics script is not loaded and no cookies are set.

If you accept, Google Analytics sets first-party cookies (_ga and _ga_*, kept for up to 2 years) and collects the pages you view, how you arrived (the referring site or campaign), your approximate location (country and city, derived from your IP address, which Google Analytics does not store), your device, browser and screen size, and whether you click the App Store or Google Play buttons. We use this to understand which pages and sources bring people to the app. We do not use it for advertising, and Google's advertising features are switched off. The legal basis is your consent (Art. 6(1)(a)). Google processes this data on our behalf, and we keep it for [14 months]. You can change your choice at any time with Cookie settings, also at the bottom of every page; withdrawing consent deletes the analytics cookies.

Fonts and every other file on this site are served from tradefluent.app itself, so unless you accept Google Analytics, loading a page does not contact any third party. Our hosting provider, Cloudflare, may keep standard server logs (IP address, time, page requested) for security, which are deleted within [30 days].

13Changes to this policy

If we change how we handle your data in a meaningful way, we will post the new version here with a new effective date and tell you in the app or by email before it takes effect. The version history is available on request.

14Contact

Just Impact LTD OOD
9Zh Boris Rumenov Str., 1407 Sofia, Bulgaria
team@justimpact.net