Privacy Policy

Last updated: [EFFECTIVE_DATE]

⚠ DRAFT — replace all [BRACKETED] values, confirm the subprocessor list, and have a lawyer review before launch. This page is not legal advice.

This Privacy Policy explains how [COMPANY_NAME] ("we") collects, uses, and shares information when you use Trade2Learn (the "Service"). By using the Service, you agree to this Policy.

Information we collect

Account information: your email address and a securely hashed version of your password (we never store your password in plain text).
Content you create in the app: watchlists, savings goals, simulated (paper) portfolios and trades, reminders, notification preferences, and feedback or support messages you send us.
Research inputs: the ticker symbols and questions you submit to AI-powered features, which are sent to our AI provider to generate responses.
Payment information: when you buy coins, our payment processor (Stripe) handles your card details. We do not receive or store full card numbers; we retain a record of completed purchases (such as a transaction identifier and coins granted).
Technical data: a session cookie to keep you signed in, and standard log data such as IP address and request timestamps used for security and rate limiting.

How we use information

to provide, operate, and secure the Service and your account;
to generate the research, comparisons, and lessons you request;
to process coin purchases and prevent duplicate or fraudulent charges;
to send transactional messages such as password-reset emails;
to enforce our Terms, prevent abuse, and comply with legal obligations.

We do not sell your personal information.

Third parties we share data with (subprocessors)

We share limited data with service providers only as needed to run the Service:

Provider	Purpose	Data shared
Anthropic	AI research/answers	Your ticker symbols and questions
Stripe	Payments	Payment and purchase details
[EMAIL_PROVIDER, e.g. Resend]	Transactional email	Your email address and message content
[HOSTING_PROVIDER, e.g. Railway]	Hosting/infrastructure	Data processed by the Service
Market/public-data sources	Quotes, charts, disclosures	No personal data (ticker requests only)

We may also disclose information if required by law or to protect our rights, users, or the public.

Cookies

We use a single, essential, HTTP-only session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

Data retention

We keep your account data while your account is active. When you delete your account from within the app, we delete your account and associated app data (such as portfolios, goals, watchlists, and sessions). Some records may be retained where required for legal, tax, or fraud-prevention purposes (for example, payment records held by our payment processor).

Security

We protect your data with measures including password hashing (scrypt), signed HTTP-only session cookies, transport encryption (HTTPS) in production, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your rights

You can access and update your account information in the app, and you can delete your account (and its associated data) at any time from the app's settings. Depending on where you live, you may have additional rights to access, correct, delete, or port your data; to exercise them, contact us at [CONTACT_EMAIL].

Children's privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

International users

The Service is operated from [GOVERNING_LAW_STATE], United States. If you use it from elsewhere, you understand your information may be processed in the United States.

Changes to this Policy

We may update this Policy from time to time. We will update the "Last updated" date above and, for material changes, provide additional notice where appropriate.

Contact

Questions about this Policy or your data: [CONTACT_EMAIL].