01Who we are
TradeFluent is operated by Just Impact LTD OOD, a company registered in Bulgaria (company number 207883891) with its registered office at 9Zh Boris Rumenov Str., 1407 Sofia, Bulgaria. In this policy, "we", "us" and "our" mean Just Impact LTD OOD. We are the data controller for the personal data described here.
You can reach us about anything in this policy at team@justimpact.net.
02What this covers
This policy applies to the TradeFluent mobile apps for iOS and Android, the TradeFluent web app, and this website at tradefluent.app (together, the "Service"). It does not cover third-party sites or services we link to, such as the App Store or Google Play, which have their own policies.
03Data we collect
We collect only what the Service needs to work. Here is the full list.
Account data
- Email address and, if you choose to add one, a display name.
- Password, if you sign up with email. It is stored only as a salted hash by our authentication provider; we cannot read it.
- Sign-in identifiers if you use Google or Apple sign-in: the identifier, email address and name that Google or Apple share with us under your settings. With Apple you can choose to hide your email, in which case we receive a relay address.
- Account timestamps: when the account was created and when you finished onboarding.
Preferences
- The market you trade (stocks, crypto, or both). We use it to filter content.
- Your preferred time of day for a daily reminder.
Learning activity
- Practice sessions: start and end time, duration, which cards you saw, your quiz score and your discipline check-in answer.
- Streaks: current and longest streak, and the date of your last completed session.
- Cards viewed, scenario answers and topic quiz attempts with scores and timestamps, so the app can schedule review and enforce the 24-hour retake wait.
- Rulebook entries: the rules you write in your own words and the cards you attach to them. Rules are private to you. Please don't put other people's personal information in them.
Subscription data
- If you subscribe to Pro, the purchase is processed by Apple or Google. We receive the subscription status, plan (monthly or yearly), product identifier, start and renewal dates, and a pseudonymous subscriber identifier via RevenueCat. We never receive your card or bank details.
Analytics and diagnostics
- Product events such as "session completed", "scenario answered" or "rule created", with non-identifying properties like a score or a topic. We never send the text of your rules, your email or your name in event properties.
- Device and app information: app version, operating system and version, device model, language, and a pseudonymous analytics identifier that is linked to your account identifier.
- Crash and error reports with technical stack traces.
- Masked session recordings on the mobile apps: a replay of taps and screen transitions in which all text and images are obscured before leaving your device, used to diagnose bugs and confusing screens. See section 8 to opt out.
Notifications
- If you allow notifications, a push token for your device so we can deliver reminders. You can turn notifications off in your device settings at any time.
What we do not collect
We do not collect your location, contacts, photos, brokerage accounts, trades, positions or balances. TradeFluent never connects to an exchange or broker. We do not use advertising identifiers and do not show ads.
04Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and securing your account, signing you in | Account data | Performance of a contract (Art. 6(1)(b)) |
| Running the daily session, streaks, spaced review, quizzes and your Rulebook | Preferences, learning activity | Performance of a contract |
| Unlocking Pro features and honouring your subscription | Subscription data | Performance of a contract |
| Sending the daily reminder you asked for | Push token, time of day | Consent (Art. 6(1)(a)), withdrawable in device settings |
| Understanding how the app is used and improving it | Product events, device information | Legitimate interests (Art. 6(1)(f)): building a product that works. You can object, see section 8. |
| Finding and fixing bugs | Crash reports, masked session recordings | Legitimate interests: keeping the Service reliable |
| Answering your support requests | Email, the content of your message | Legitimate interests |
| Keeping purchase records | Subscription data | Legal obligation (Art. 6(1)(c)): accounting and tax law |
| Preventing abuse and enforcing our Terms | Account data, activity logs | Legitimate interests |
We do not use your data for automated decisions with legal or similarly significant effects, and we do not profile you for marketing.
05Who we share it with
We share personal data only with service providers that process it on our behalf under data processing agreements, and only as needed to run the Service. We do not sell personal data and never have.
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Database, authentication and file hosting | All account, preference, activity and subscription-status data |
| PostHog | Product analytics, error tracking, masked session replay | Product events, device information, crash reports, masked recordings, pseudonymous identifier |
| RevenueCat | Subscription management across App Store and Google Play | Pseudonymous subscriber identifier, purchase and renewal events |
| Apple | Sign in with Apple, App Store billing, push notifications on iOS | Sign-in identifiers, purchases (handled by Apple), push tokens |
| Google sign-in, Google Play billing, Firebase Cloud Messaging for push | Sign-in identifiers, purchases (handled by Google), push tokens |
We may also disclose data if the law requires it, to protect our rights or the safety of users, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.
06International transfers
Your data is hosted in [Supabase project region, e.g. the European Union]. Some of our providers, including PostHog, RevenueCat, Apple and Google, may process data in the United States or other countries outside the European Economic Area. Where that happens we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism. You can request a copy of the relevant safeguards by contacting us.
07How long we keep it
- Account, preferences and learning activity: for as long as your account exists. When you delete your account we erase this data within 30 days, except as noted below.
- Subscription records: for the period required by Bulgarian accounting and tax law, currently up to 10 years, in a form limited to what the law requires.
- Analytics events and crash reports: [12 months], after which they are deleted or fully anonymised. Masked session recordings are kept for [30 days].
- Backups: encrypted database backups roll over within 30 days.
- Support emails: up to 2 years after the matter is closed.
08Your rights
Under the GDPR and, where applicable, other privacy laws, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate or incomplete.
- Delete your data (see section 9).
- Restrict processing in certain circumstances.
- Port the data you gave us to another service in a machine-readable format.
- Object to processing based on our legitimate interests, including analytics and session replay. Email us and we will exclude your account from analytics going forward.
- Withdraw consent at any time where we rely on it, for example by turning notifications off.
- Complain to a supervisory authority. Ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg), but you may contact the authority where you live.
To exercise any of these, email team@justimpact.net from the address on your account. We respond within one month. We will never charge for a reasonable request.
09Deleting your account
You can delete your account and all associated data at any time:
- In the app: [Settings → Account → Delete account, once available].
- By email: write to team@justimpact.net from the email on your account with the subject "Delete my account".
Deletion removes your profile, preferences, sessions, streaks, quiz history and Rulebook within 30 days. Deleting your account does not cancel an active subscription; cancel it in your App Store or Google Play account settings first, or it will keep renewing.
10Security
All data travels over TLS. Data at rest is encrypted by our hosting provider. Every database table is protected by row-level security so that your data can only be read with your own session. Passwords are hashed, not stored. Access to production systems is limited to the people who operate the Service. No system is perfectly secure, so if we learn of a breach that affects you we will tell you and the relevant authority as the law requires.
11Age limit
TradeFluent is for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
12This website
tradefluent.app sets no cookies and runs no analytics or tracking scripts. Fonts are loaded from Google Fonts, which means your browser sends its IP address to Google when the page loads; Google's privacy policy applies to that request. Our hosting provider may keep standard server logs (IP address, time, page requested) for security, which are deleted within [30 days].
13Changes to this policy
If we change how we handle your data in a meaningful way, we will post the new version here with a new effective date and tell you in the app or by email before it takes effect. The version history is available on request.
14Contact
Just Impact LTD OOD
9Zh Boris Rumenov Str., 1407 Sofia, Bulgaria
team@justimpact.net