Privacy Policy

Introduction

This Privacy Policy describes how the Tradicted website (Tradicted.com), mobile app, browser extensions and plugin for ChatGPT handle your information. Your privacy is important to us and we are committed to being transparent about the data processed when you use our services.

For the purposes of data protection laws like the GDPR, the Data Controller is Robert Gorak, operating as a sole founder. The third-party services we use (Google and Cloudflare) process data on our behalf and on our instructions, under their own standard data processing terms for business customers.

We do not collect or store personal data on our own servers. Some features (such as our browser extensions and the website's trading journal export) process data entirely on your own device. Where data is processed off-device, it is handled by our service providers on our behalf, as described below.

Information We Process

A. Website (Tradicted.com)

Our website generally operates without cookies. We do not use Google Analytics or any other third-party tracking technology that sets cookies on your device for tracking.

Web Analytics

We use Cloudflare Web Analytics to monitor website traffic and performance. Cloudflare Web Analytics operates without the use of cookies or local storage. It does not collect personally identifiable information (PII), track IP addresses, or track users across different websites. The data collected is entirely anonymized and aggregated, logging only essential metrics such as page views, device types, operating systems, browser types, and generalized geographic location (country-level) to help us understand how our website is being used.

Product Analytics

We also run our own cookieless analytics. It counts aggregate events only. On our home page, our download page, our free lesson pages and our two browser-based trading simulators, we record one anonymous event when you open the page, reach a checkpoint part-way through a simulator session, finish a session or press Play Again. On any page of the site, we record one when you tap a store badge or a download link. Separately, our community banner can appear on any page of the site, and records one anonymous event when it is shown to you, when you click it and when you dismiss it.

Our free lessons, which play in your browser on our lesson pages, also record one anonymous event at each point the Tradicted app records for the same lesson: when you start a lesson, when each part of it appears, when you draw on a chart and when that drawing is checked, when you answer a question or make a call on a chart, when a hint or an explanation is shown, when you run one of its simulations, and when you finish or leave the lesson. Each of these events stores which lesson and which part of it, the answer or setting you chose where the step asks for one, whether it was right, how far into the lesson you were and how long it had taken, and whether you had finished that lesson before, together with the same device, operating system, country and referring-site categories described below. Like every other event here, it carries no identifier and cannot be linked to your other events or to you.

Each event stores the event name, a broad device category (mobile, tablet or desktop), a broad operating system category (for example iOS, Android, ChromeOS, macOS or Windows), your country, a broad category for the kind of site you arrived from (for example a search engine, a social network or an AI assistant), and the link or on-page placement you used. A simulator event also stores broad detail about that session on its own: how far through it you had got, whether it was your first attempt or a replay, a performance band such as low or high, and how many simulated trades you had placed. A banner event stores which wording and design of the banner you were shown, and how many times it had previously been dismissed in your browser.

We do not store your IP address, your full browser user agent, your full referring web address, or any identifier. The operating system and referring-site categories above are worked out in your browser and reduced to one of a small fixed list of values before anything is sent, so the underlying strings never leave your device. Individual events cannot be linked to each other or back to you, so we build no profile and keep no session history. The data is processed on our behalf by Cloudflare using Workers Analytics Engine and is kept for three months.

When you tap a link to the App Store or Google Play from this website, that link carries a short campaign label naming the placement you tapped it from, such as a simulator end screen or our home page. Apple and Google read that label in their own systems and report back to us, in their consoles, how many installs each placement produced. The label describes the placement and not you: everyone who taps the same link sends the same label, it contains no identifier, and nothing about you is passed to us alongside it. What we see is an aggregate count per placement, and Apple reports a placement only once at least five separate people have installed from it.

Hosting, Security and Content Delivery

Our website is hosted by Cloudflare, which also acts as our Content Delivery Network (CDN) and security provider. To protect our website from malicious activity, bot attacks, and DDoS attempts, Cloudflare monitors network traffic. As part of this security screening, Cloudflare may place strictly necessary security cookies (such as __cf_bm or cf_clearance) on your device. These cookies are solely used to distinguish between human users and malicious bots; they are not used for tracking, analytics, or advertising purposes, and are exempt from cookie consent requirements as they are strictly necessary for security.

We also use Cloudflare Bot Management and AI Labyrinth to detect and deter malicious bots, scrapers, and unauthorized AI crawlers. These tools analyze traffic patterns and may serve decoy content to suspected bots; they do not process personal data belonging to genuine visitors.

B. Mobile App

When you first launch the app, an anonymous account with a unique Firebase User Identifier is created automatically. This lets you play and save your progress straight away, without having to register or provide any personal details such as an email address. Your gameplay and progress data is linked to this identifier. You can delete this anonymous account, along with all data associated with it, at any time using the automated "Delete Account" feature in the app's Settings menu (see the Your Rights section below).

User Identifier: A unique ID generated by Firebase Authentication to manage your account. It is created automatically on first launch as described above.
Email address (optional): If you choose to link or upgrade your anonymous account by signing in with email, Google Sign-In or Sign in with Apple, we process the associated email address for authentication to secure your account. It is not displayed publicly or shared. You can use the app without providing one.
Username: A display name you choose, used only for leaderboard purposes and linked to your User Identifier.
Gameplay and Progress Data: Your in-app activity, such as simulated trade history, simulated profit and loss figures, win/loss statistics, streaks, leaderboard scores, your timezone and typical play hour (used to schedule reminder notifications). This data is linked to your User Identifier and stored using Google Firebase (Realtime Database) on our behalf.
Emotional Check-in Data: The app occasionally asks how you are feeling about a practice session and offers a short fixed list of answers, such as Calm, Confident, Bored, Frustrated, Anxious or Nothing much. Answering is always optional and there is no free-text field. Your answers are stored on your own device and are what the Emotions section of My Analytics reads; we do not upload them to our database or link them to your account. The answer you tap is also counted in our app analytics (Google Analytics for Firebase) alongside the type of session it followed, so we can see which prompts are worth showing. That count carries the chosen label and nothing else: no note, no free text, and nothing identifying you. This is a self-reported mood label about a trading exercise, not health information, and we do not use it to infer anything about your health, nor for advertising of any kind.
Push Notification Data: If you enable notifications, we use Firebase Cloud Messaging and store a device messaging token (FCM token) so we can send you push notifications such as practice-streak reminders and leaderboard updates. You can turn these off at any time in the app's settings or your device settings.
Device and App Performance Data: Device model, operating system, language settings and technical data about app stability and crashes (Firebase Crashlytics).
App Interaction Data: Anonymous data on how you interact with the app's features, such as screens visited and buttons tapped (Google Analytics for Firebase).
Country: Your country and broad region are derived from your IP address by Google Analytics so that we can see roughly where the app is used. We have switched off the city-level and granular device collection that Analytics offers, so no finer location than this is collected. We never request, receive or track your GPS location, and the app asks for no location permission.

C. Trading Journal Export (Website)

The trading journal on our website includes an optional feature that lets you export your own trade journal as a Markdown file for use with an AI assistant (such as ChatGPT, Claude or Gemini) of your choice. This file is generated entirely in your browser and downloaded directly to your device. We do not transmit, collect, store or process the contents of this file on our servers, and it is not shared with any third party by us.

The file contains the trade data you choose to include, which may consist of tickers, simulated profit and loss figures, risk and reward values, trade dates, your self-assigned setup, psychology and grade tags, and any free-text notes you have written. Because this data originates from you and stays on your device, you remain in control of it at all times.

If you choose to paste, upload or otherwise provide this exported file to a third-party AI service, that service will process the file under its own privacy policy and terms, over which we have no control. We are not responsible for how any third-party AI provider handles data you submit to it. We recommend reviewing the relevant provider's privacy terms before sharing any file, and considering the contents before sharing it publicly.

D. Tradicted in ChatGPT

Tradicted is also available as a plugin in ChatGPT. When you ask ChatGPT about a trading topic, it can call our plugin's server at mcp.tradicted.com to list our free lessons, open one in a lesson card in the chat, or fetch a lesson's written version. ChatGPT decides when to make these calls and what to send. What you type into ChatGPT, and what ChatGPT does with our lessons, is covered by OpenAI's privacy policy, not this one.

Each call tells our server which of those three things to do and, at most, which lesson or package of lessons it is for. Both are short codes in a fixed format, such as sr_l1, so a call cannot carry anything you wrote. ChatGPT also attaches some details of its own to each call: your language setting, an approximate location (city, region, country and time zone), a hint about your browser or app, and anonymized identifiers for your account and for the conversation. Our server does not use any of these details and does not store or log them.

The plugin's server stores nothing and keeps no record of the calls it answers. It answers each call from our public lesson pages and then forgets it. If a call fails, for example because our list of lessons could not be loaded, the server writes one error line naming the step that failed. Nothing else from the call goes into that line: not the lesson asked for, and none of the details ChatGPT attaches. Cloudflare keeps these error lines for us for up to seven days.

The lesson card shows the lesson's title and a picture of it, loaded from www.tradicted.com. When you start the lesson, the card loads our lesson player from www.tradicted.com inside it, the same player as on our lesson pages. In ChatGPT the player records none of the lesson events described under Product Analytics and sends nothing to us. It tells the card only that the lesson has loaded, that you finished it, and that you asked for the next lesson or for a quiz. When you finish, the card lets ChatGPT know which lesson you finished, so it can offer a quiz or the next lesson. Quiz me sends that request as a message from you in the chat. Next lesson asks our server for the next lesson, the same kind of call described above, opens it in the same card and lets ChatGPT know which lesson is open now. Where ChatGPT does not allow that, it sends the request as a message from you instead.

As on our lesson pages, the player saves which lessons you have started and finished, and when, plus any example trade amount you picked, in your browser's storage for www.tradicted.com. It stays on your device and is never sent to us. Depending on your browser and the ChatGPT app, it may be kept apart from our website's storage, cleared when you leave, or not saved at all, so your progress may not carry over between chats. Requests for the picture and the player reach Cloudflare like any other visit to our website, as described under Hosting, Security and Content Delivery above.

To stop ChatGPT from calling our server, disconnect or remove the Tradicted plugin in ChatGPT's settings. To delete the saved lesson progress, clear the site data for www.tradicted.com in your browser, or the ChatGPT app's data on your device.

How We Use Your Information

The data processed by our service providers is used for the following purposes:

To authenticate your account and ensure its security.
To display your chosen username on leaderboards.
To save your gameplay and progress data so it is available across sessions.
To send push notifications you have enabled, such as practice-streak reminders.
To answer the calls ChatGPT makes to our plugin, and to find and fix the ones that fail.
To analyze website and app usage and performance to identify bugs and improve the user experience.
To fulfill our legal and security obligations.

Our legal bases differ by purpose. Running your account, saving your progress, keeping the service secure and diagnosing crashes rest on our legitimate interests in providing a working, stable app, and on the necessity of that processing to deliver the service you asked for. Push notifications rest on your consent, given when you enable them and withdrawable at any time in the app's settings or your device settings.

Usage analytics is separate from all of that. It is not necessary to run the app and we use it only to understand how the app is used and to improve it, never for advertising, profiling with legal effects or any automated decision-making. Its legal basis depends on the region your device is set to:

In the European Economic Area and the United Kingdom, usage analytics rests on your consent. It is off when you install the app. After the app's introduction you are asked once whether to share usage data, and collection starts only if you choose Allow. You can change your answer at any time in the app under Settings → Privacy → "Share usage data".
Everywhere else, usage analytics is on by default and rests on our legitimate interest in improving the app. You are not asked the consent question, but you can switch usage analytics off at any time with the same Settings → Privacy → "Share usage data" switch, and it stays off until you turn it back on.

We tell these regions apart by the region setting on your device, not by your location. Crash reports are not part of usage analytics. They stay on whatever you choose, so a screen that breaks still reaches us.

Data Sharing with Third Parties

We do not sell or share your personal data with third parties for monetary or other consideration, and we do not use any advertising SDKs in the app.

We share data only with the following essential third-party services who act as our data processors:

Google Firebase: Used for authentication, database storage of your gameplay data, push notifications (Cloud Messaging), analytics and crash reporting in the mobile app.
Cloudflare: Hosts the website and our ChatGPT plugin's server and provides Content Delivery Network (CDN), DDoS protection, bot management (including AI Labyrinth), and Web Analytics.

These services are compliant with major data protection regulations, including GDPR.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and the categories of third parties with whom it is shared.
Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To submit a data request, contact us at info@Tradicted.com. We will respond within 45 days as required by law.

International Data Transfers

Google and Cloudflare may process data outside the European Economic Area (EEA) and the United Kingdom, including in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of data protection for transfers from the EEA to the United States. Cloudflare’s own data processing terms incorporate the European Commission’s Standard Contractual Clauses for transfers outside the EEA.

Data Retention

Authentication Data: Retained until you delete your account.
App Analytics: Event and user-level analytics records are kept for 14 months from your most recent activity in the app, after which they are deleted automatically. Aggregate reports derived from them, which are counts only and describe no individual, are kept for longer.
Crash Reports: Retained per Google's Firebase Crashlytics retention policy.
Cloudflare Analytics: Anonymized and aggregated metrics retained per Cloudflare's policies. Our own website event records are kept for three months. We also keep daily totals derived from them for longer, so that we can compare traffic across seasons; those totals are counts only and contain nothing about any individual visit.
ChatGPT Plugin: The plugin's server keeps nothing from the calls it answers. Its error lines are kept for up to seven days.

Your Rights

Under the GDPR and similar data protection laws, you have the right to:

Access the personal data we process about you.
Request rectification or erasure of your data.
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent at any time.
Lodge a complaint with your local data protection supervisory authority.

To delete your account and all associated Firebase data, use the automated "Delete Account" feature within the app's settings menu. For any other request, please contact us at info@Tradicted.com.

Browser Extensions

We publish browser extensions (such as our Risk-Reward Calculator) on the Chrome Web Store, Microsoft Edge Add-ons and Opera Add-ons. These extensions do not collect, transmit or store any personal data. All calculations and any saved history are processed and stored locally on your own device using your browser's local storage. No data is sent to our servers or to any third party, the extensions contain no analytics or advertising, and they do not track your browsing activity.

Any data you create in an extension (for example, saved calculation history) remains on your device and can be cleared at any time through the extension's own controls or by removing the extension from your browser. Each extension is also subject to the data-handling disclosures shown on its respective store listing.

Children's Privacy

Our services are not intended for use by children under the age of 13 (or the relevant age of digital consent in your region). We do not knowingly collect personal information from children. If we learn that we have inadvertently collected such information, we will take steps to delete it.

Cookies and Tracking Technologies

Website

Our website generally operates without cookies, with the exception of strictly necessary security cookies. We use Cloudflare as a security provider, which may place essential security cookies (such as __cf_bm or cf_clearance) on your device solely to protect against malicious activity and bot attacks. These are not used for tracking or advertising.

For analytics we use Cloudflare Web Analytics together with our own first-party event counters, described under Product Analytics above. Both are cookieless: neither sets a cookie, neither collects personal identifiers, and neither tracks you across other websites.

Separately from analytics, parts of the site save small amounts of information in your browser's own local storage. This is not a cookie, it is never sent to us or to anyone else, and it is readable only by this website. We use it to remember that you dismissed our community banner so we do not keep showing it, to remember which version of a message you were shown so it stays consistent on your next visit, and to save the work you enter into tools such as the trading journal and the calculators so it is still there when you return. When you play one of our free lessons, it also remembers which lessons you have started and finished, and when, so the lesson pages can show your progress and link you back to the lesson you were on. If a lesson asks you to pick an example trade amount, it remembers that amount too. This is part of the lesson you chose to start, so it is not used for anything else. It also remembers that you have opened the course once, so the dot next to the course link in the menu goes away. For the length of a visit only, the site also notes in your browser's session storage that the course link in the menu has played its one-time highlight, so it does not repeat on every page; your browser deletes that when the tab is closed. All of it stays on your device and you can clear it at any time through your browser settings. Because we set no tracking cookies and process no personal data for tracking or marketing purposes, no tracking cookie consent banner is required.

Mobile App

The app does not use browser cookies. Firebase uses a device identifier to manage your account and analytics.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated where appropriate.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: info@Tradicted.com