Privacy Policy

1.Who looks after your data

The data controller is [COMPANY NAME], [COMPANY NUMBER / VAT], [ADDRESS]. Data Protection Officer (DPO): [NAME AND EMAIL].

This policy applies to the website and the Android and iOS apps, and follows the LGPD (Brazil), the GDPR (European Union and United Kingdom) and other applicable laws.

2.What data we collect

Sign-up: name, username, email, password (stored encrypted), date of birth, country and language.

Verification: the result of the age check and, for badges, of the identity check, plus the legal name. Document photos and the selfie stay with the verification partner; the Network does not keep these photos.

Connected accounts: trades, results and, if you allow it, balance, read from MT4/MT5 with the investor password, which is kept encrypted by the connection provider.

Content: posts, analyses, TradingView images, comments, scraps, messages, reactions, votes and courses.

Usage and device: IP address, device type, operating system, language, access and error logs.

Payments and creators: purchase data (the card stays with the payment provider) and, for creators, tax and payout details.

Youth mode: the guardian's email and link, and the settings they choose.

3.What we use it for and on what legal basis

Providing the service (creating the account, showing the feed, Journal and Calendar, delivering messages): performance of the contract.

Confirming age and identity, keeping access logs and responding to authorities: legal obligation.

Security, preventing scams, spam and fake accounts: legitimate interest.

Push notifications, news emails and non-essential cookies: consent, which you can withdraw at any time.

Payments and payouts to creators: performance of the contract and tax obligations.

Emails: account notices (sign-up, password, verification) and important notices about the Terms and Privacy are mandatory. The newsletter and new-follower notices only with your consent, and you can turn them off in Settings or via the link in the email itself.

4.What is public

Name, @, photo, cover, bio and the posts on your profile, if it is public.

The Journal, Calendar and results, according to what you turn on in Settings. The cash balance is hidden by default.

Published analyses are locked and remain visible while the account exists. When you delete the account, they may be anonymised.

5.Who we share it with

We do not sell your data.

We only share what is necessary with providers working for us: hosting and database, age and identity verification, MT4/MT5 connection, payments, AI translation, email delivery (Resend) and notifications.

Authorities and courts, when there is an order or legal obligation, and to protect users against fraud.

For people who buy a course, the creator's seller details are shown, as required by law.

6.Companies and services we use

Supabase (Supabase Inc.): database, sign-in, files (photos, videos, audio) and real-time features. Data is stored on servers in the European Union (Ireland).

Vercel (Vercel Inc.): hosting for the website and apps; requests go through Vercel's global network and are processed in the European Union.

Resend (Resend Inc., USA): sending account emails and alerts.

MetaApi (Agilium Labs): read-only connection to MT4/MT5 using the investor password, only for those who connect an account.

Google: Sign in with Google, YouTube thumbnails and videos in posts, and alerts in Chrome and on Android (Firebase Cloud Messaging).

Apple: Sign in with Apple and alerts in Safari, on iPhone and iPad (Apple Push Notification service).

Mozilla: alerts in Firefox.

Cloudflare (Cloudflare Inc.): live streaming (Cloudflare Realtime) and private storage of course videos and PDFs (Cloudflare R2).

Providers for age and identity verification, payments and AI translation will be listed here by name before each feature goes live. [review]

Each company only receives what its service needs and is contractually bound to protect the data.

7.Each feature and the data it uses

Stories: the photo, the video (up to 30 s), the text and the position/rotation you choose; who viewed and when. They stay up for 24 hours and only signed-in people see them, through temporary links. Files and the viewer list are deleted within 48 hours after they expire.

Story camera: photos, videos, PiP (front and back) and Boomerang are made on your device. Only the final result is uploaded; nothing is recorded until you tap the button.

Story replies: they become a message in your conversation with the author, linked to the story, and follow the chat rules.

Chat and groups: texts, photos, videos, voice messages, shared posts, replies, the trend up (double tap) and when each person read. Only members of the conversation can see them. Files are kept in a private space and open through temporary links.

Online: while the website or app is open, others can see you are online. This is not stored in the database. You can turn it off in Settings; when off, you won't see others either.

Device alerts (push): we store your browser's or device's technical address to deliver alerts while they are on. The alert text passes through Google's, Apple's or Mozilla's push service, depending on your browser.

Signed-in devices and security: we store browser, system, country (from the network) and a device identifier to show where your account is open, warn you of new sign-ins and let you sign out remotely.

Two-step verification: the authenticator app key is stored, encrypted, by the sign-in service (Supabase Auth). We never see your codes.

Notifications: what happened, who did it and when, to build the bell and the alerts.

Calendar and trade sheet: asset, prices, times, result, the TradingView snapshot (we keep a copy), up to 3 images, thesis and execution are shown to people who see your calendar (if it is public). The day plan is shown with it; the day review and each trade's review (emotions, mistakes, discipline, lessons) stay private unless you share them. Images are kept in a private space and open through temporary links. Deleting a trade deletes its images.

Lives: the streamer's video and audio pass through Cloudflare (Cloudflare Realtime) to viewers and are not recorded. We keep the title, who streamed, where, start and end, and the comments (deleted 1 day after it ends). Who is watching right now is counted in real time and not stored. For the OBS key we keep only an encrypted version (hash).

Courses: course details (title, description, cover, modules, lessons), who enrolled, progress in each lesson, reviews and reports. Lesson videos and PDFs are stored on Cloudflare R2 in a private space and only open through temporary links for enrolled students. The author sees how many students they have; the sales team sees the content to approve it.

Ranking and achievements: only MT4/MT5-verified results of adults (18+) with a public journal; positions are recalculated every hour.

Moderation and appeals: reports, decisions (with the reason and an excerpt of the removed content) and appeals, to guarantee your right to contest.

Communities: name, description, category and rules are public inside the network and go through a prohibited-terms filter.

Instant story: each person can view it once, after which the story and its file no longer open for them. To discourage captures, we show the viewer's @ over the image and hide the content when the app loses focus. Mobile browsers don't allow blocking system screenshots; in the Android and iOS apps, capture is blocked where the system allows. Capturing or sharing an Instant story without permission breaks the Terms.

Encrypted chat: new texts and files are encrypted on your device before they leave it; we only store the encrypted version, which we cannot read. We can still see who talks to whom, when, and the type of attachment (photo, video or voice). We store your public key and a copy of your private key locked with your PIN, which we cannot open. Your PIN is never sent: only a check code derived from it, to limit attempts (10 wrong tries lock the vault).

Reports: who reported, who was reported, the reason, the written details and a copy of the reported content (comment or story text, and the story file until the decision). For a message report, the up to 20 messages the reporter's device sends unencrypted. Only the moderators see this; the reported person doesn't learn who reported them.

8.Artificial intelligence

We use AI to translate posts automatically, always labelled, and to help detect scams and spam.

[decide] We do not use private messages to train AI models.

9.Minors

Data of people aged 13 to 17 is processed with the guardian's consent and in the young person's best interest.

There is no behaviour-based advertising for minors, and their data is kept out of general administration dashboards.

10.Transfers to other countries

Some providers process data outside your country. When this happens, we use the safeguards provided by law, such as standard contractual clauses. [review]

11.How long we keep it

While your account exists: profile, posts, comments, messages, communities, journal, achievements and preferences.

Stories: up for 24 hours; files and views deleted within 48 hours after that.

Chat files: while the message exists; when an account is deleted, its messages are deleted and the files disappear within 2 days.

Alert delivery logs: 90 days. Read notifications: 180 days. Security events and unused devices: 1 year.

Moderation decisions and appeals: while the account exists, to allow appeals and evidence in case of abuse.

Access logs: for the period required by law (in Brazil, at least 6 months).

After you delete your account, we delete or anonymise data within [PERIOD] days, except what the law requires us to keep, such as tax data from sales.

Reports and what comes with them (including messages sent with a chat report): while the decision can be appealed and for up to [PERIOD] afterwards, to prove the decision and prevent abuse. A reported story is deleted after the decision.

12.Your rights

You can request access, correction, a copy (portability), deletion, restriction or objection to the use of your data, and withdraw consents.

Almost everything can be done in Settings › Your data. The rest via the DPO's email.

You can also complain to the data protection authority: the ANPD in Brazil or your country's authority in Europe (in Italy, the Garante; in the UK, the ICO).

13.Security

We use encryption, two-step verification, role-based access and audit logs. No system is 100% secure: if an incident affects you, we will tell you as required by law.

14.Cookies and similar technologies

Essential: to sign in and keep the session. Always on.

Preferences: language and theme.

Usage analytics: only with your consent in the European Union and the United Kingdom.

15.Changes and contact

We will announce important changes in the app and by email.

Questions: [CONTACT EMAIL] · DPO: [NAME AND EMAIL].