Privacy policy

When you request access:

• your email address
• a display name
• your phone number, so there is a way to reach you besides email
• a password, which is hashed by our authentication provider. CTH never stores or sees it in plain text.

Created automatically for your account:

• a node identifier, used as a non-personal reference inside the platform
• account role and status, which control what you can access
• a last-seen timestamp and a streak counter, used to show your own activity back to you

Created by you as you use the platform:

• lesson progress: which lessons you completed and where you stopped
• journal entries: asset, direction, entry and exit prices, stop, target, margin, leverage, fees, resulting P&L, and any notes you write

Journal entries describe your trading. We treat them as sensitive and they are readable only by you and by nobody else, including other members.

• To give you access to a members-only platform and to keep out people who are not members
• To show you your own progress and your own trading data
• To contact you about your membership, your account, or a security matter
• To keep the platform secure and to investigate abuse

The legal basis is performance of our contract with you for the first two, our legitimate interest in a secure service for the last, and your consent where we ask for it explicitly.

CTH sets one kind of cookie: the session cookie issued by our authentication provider, which keeps you signed in and is required for the platform to work at all.

There are no analytics cookies, no advertising cookies and no third-party trackers, which is why you are not asked to accept anything on arrival.

Clearing that cookie signs you out. Nothing else is stored in your browser except small interface preferences on your own device.

Two processors, both under contract:

• Supabase, which provides the database, authentication and file storage. Your data is held in the European Union (Frankfurt).
• Vercel, which hosts and serves the site. Server-side rendering runs in the European Union (Frankfurt).

That is the complete list. No analytics provider, no advertising network, no email marketing platform, no CRM.

We do not sell personal data, and we do not share it with anyone for their own purposes. We may disclose data if legally required to, and we will tell you unless we are prohibited from doing so.

• Every table enforces row-level security in the database itself, so authorisation does not depend on the application asking the right question
• Uploaded media sits in private storage and is served only through short-lived signed links
• Passwords are hashed by the authentication provider
• Sessions end after fifteen minutes of inactivity
• Admin actions are recorded in an internal activity log

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Account and profile data: for as long as your account exists.

Journal entries and lesson progress: for as long as your account exists, because they are yours and you may want them later.

After an account is closed we delete personal data within RETENTION PERIOD, e.g. 30 days, except where we must keep records longer to meet a legal or accounting obligation.

The admin activity log retains a record of administrative actions for security purposes.

You can ask us to:

• give you a copy of your data
• correct anything inaccurate
• delete your account and the data attached to it
• restrict or object to certain processing
• send your data to you or another provider in a portable format

Write to PRIVACY CONTACT EMAIL. We will respond within thirty days.

If you are in the EU or UK and you think we have handled your data badly, you can complain to your national data protection authority.

CTH is not for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has an account, tell us and we will remove it.

If this policy changes materially we will tell active members by email before the change takes effect.

Questions, requests or complaints: PRIVACY CONTACT EMAIL.