Privacy Policy
We collect only what is needed for learning and security. We do not sell data, do not show ads and do not use third-party visitor counters. You can export or delete your data yourself in Settings.
1. Who is responsible for your data
The data controller is BALANCE MNE DOO (Montenegro; registration number: 5-1320658/001; address: Ive Lole Ribara br. 29-6, Budva, Crna Gora). Data questions: an email address will appear here shortly. We process data in accordance with the personal data protection legislation of Montenegro and, for users in the European Union, also the EU General Data Protection Regulation (GDPR).
2. What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email, name, password (we store only a strong argon2 hash) | Account and sign-in | Performance of contract |
| Display preferences (font, size, theme, time zone) | Showing lessons the way you prefer | Performance of contract |
| Learning progress, exam answers, experience points, achievements, practicums | Learning, spaced repetition, access to next lessons | Performance of contract |
| Paper trades, trust capital, backtests | Educational practice | Performance of contract |
| Trading journal and notes (free text) | Your records and feedback about the Platform | Performance of contract |
| Personal notebook: entries and where they were made (e.g. “Lesson 3”) | Your insights and ideas — visible only to you | Performance of contract |
| Sign-in with Google (only if you use it): Google account identifier, email and name | Password-free sign-in | Performance of contract |
| Country of residence (only if you entered it yourself — the question is optional, and we don't detect it by IP address) | Per-country academy statistics (anonymised cohort reports) and showing only the sections allowed in your country — for example, the optional Bybit partner section | Legitimate interest |
| Tags of the link you arrived by (utm_source, utm_medium, utm_campaign — e.g. “telegram”). Saved to your account at sign-up, not stored in your browser | Understanding which channels bring students, without advertising cookies or trackers | Legitimate interest |
| The home page variant you saw (A or B, the link parameter v). Saved to your account at sign-up, not stored in your browser. Home page views are counted separately — only a daily total per variant and link tags, with no account, IP address or browser data | Comparing which home page text is clearer, without cookies or third-party counters | Legitimate interest |
| Trade reviews in the journal (whether the plan was followed, marked violations, notes) and usage events of the journal, Discipline Score and weekly review (which section was opened and when, number of trades, discipline score). No IP address and no trade contents in the events | Showing you your Discipline Score and weekly review; understanding whether these tools help you keep practising after the course | Performance of the contract; legitimate interest |
| Bybit account UID and the result of the link check (only if you linked an account earlier; linking is no longer requested) | Accounting for affiliate commission on accounts opened through our link. Access to the modules does not depend on linking | Legitimate interest |
| Leaderboard participation (only if you turned it on): your name, level and experience are visible to other students. Email is never shown | Student leaderboard | Consent — can be switched off at any time with the “Hide me” button |
| Device push subscription and reminder time (only if you enabled reminders) | Reminding you to study so your streak is not broken | Consent — switched off in Settings |
| Trading plan and the result of checking trades against it | Showing where you broke your own rules; access to the test exchange | Performance of contract |
| Bybit test exchange API key (AES-256 encrypted; only if you connected it) | Sending your practice orders to the test exchange | Performance of contract |
| Security log: sign-in time, IP address, important actions | Protecting accounts, investigating breaches and abuse | Legitimate interest |
| Two-factor authentication secret (AES-256 encrypted) | Second sign-in step, if you enabled it | Performance of contract |
| Time and version of the accepted Terms | Proof of consent | Legal obligation |
We do not collect payment data, identity documents, geolocation, phone contacts or advertising data. Please do not write passwords, card numbers, document details or health information in the journal, notebook or notes.
3. Where data is stored and who helps process it
- Hetzner Online GmbH (Germany, EU) — the server that runs the Platform and stores the database.
- Google (Sign in with Google) — if you use the “Sign in with Google” button, Google provides us with your email, name and account identifier. Your Google password is never shared with us.
- Google (Google Drive) — storage of backups. Each copy is encrypted on our server before upload (AES-256) and only we hold the key: Google sees only an encrypted file. Processing may take place outside Europe.
- Bybit — we request public prices from the exchange. If you connected the test exchange (testnet), we use your key to request the balance and positions of the test account and to send your practice orders. Your email, name and other personal data are not shared with the exchange. Keys with withdrawal permission are not accepted. If you opened an account through the partner link and provided your UID, we check via the Bybit partner dashboard that the account is linked to the Platform. Under the terms of the affiliate programme, Bybit shows the partner information about such accounts (for example, trading volume and fees); we use it only to account for the affiliate commission and do not store it on the Platform.
- Fonts and photographs are stored on our server — your browser does not contact third-party services when opening pages. Lesson read-aloud works through your browser on your device.
We do not sell or share data with third parties for their own purposes. We may disclose data only upon a lawful request from public authorities.
4. How long we keep data
- Account and learning data — for as long as the account exists.
- After account deletion — erased from the live database immediately and from encrypted backups within 60 days.
- Security log — 12 months, after which entries are deleted automatically.
5. How we protect data
Encrypted HTTPS connection; passwords stored only as argon2 hashes; two-factor authentication; secrets and keys encrypted with AES-256-GCM; limited sign-in attempts; protected session cookie; encrypted backups; server access only for an authorised administrator.
To help students, the Platform administrator can see learning progress: completed lessons and steps, exam results and topics with mistakes, level, trust capital and activity dates. The administrator cannot see the texts of the personal notebook or trading journal — only the number of entries.
6. Your rights
- Access and portability — export all your data in a single file: Settings → My data.
- Rectification — name and preferences can be changed in the interface; anything else on request.
- Erasure — the “Delete account” button in Settings.
- Restriction and objection to processing based on legitimate interest — on request.
- Withdrawal of consent — at any time, without affecting processing carried out before.
We respond to requests within 30 days. If you believe your rights have been violated, you may lodge a complaint with the Agency for Personal Data Protection and Free Access to Information of Montenegro (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama) or, if you live in the EU, with the supervisory authority of your country.
7. Age
The Platform is intended for persons over 18. If we learn that an account was created by a minor, we will delete it.
8. Cookies
We use only technical cookies without which sign-in is impossible. See Cookies for details.
9. Changes to this Policy
We will notify you of material changes in advance in the interface. The date of the current version is shown at the top of the page.