Privacy Policy

Last updated: [DATE]

In one line: you can use HigherHigh without an account at all. If you create one, we keep your email and your training progress — nothing else. We do not sell data and we run no advertising trackers.

1. Who is responsible

The data controller is [LEGAL NAME], registry code [REG NO], [ADDRESS], Estonia. For any privacy question or request write to [EMAIL].

2. What we collect, why, and on what legal basis

Data	Why	Legal basis (GDPR)
Email address, password hash	To create an account and let you sign in	Art. 6(1)(b) — contract
Display name, rating (RP), colour	To show you in the rankings	Art. 6(1)(b) — contract
Training progress: virtual balance, trade journal, settings, knowledge-base progress	To keep your progress across devices	Art. 6(1)(b) — contract
Anonymised trade parameters (prices, times, direction) sent for the AI review	To generate the written review of your trade	Art. 6(1)(b) — contract
Subscription status and period	To give paid features to those who paid	Art. 6(1)(b) — contract
Technical logs: IP address, browser, time of request	Security, abuse prevention, fault diagnosis	Art. 6(1)(f) — legitimate interest

We do not collect real-money account data, identity documents, location or biometrics. We do not profile you for advertising.

3. Payments

Payments are handled by [PAYMENT PROVIDER]. Card details never reach us — they go straight to the payment provider. We receive only the fact of payment, the plan, the period and an identifier that links the payment to your account. Invoices and tax documents are issued by the provider.

4. Who processes data on our behalf

Supabase — database and authentication.
Cloudflare — website hosting and protection.
[PAYMENT PROVIDER] — payments and invoices.
AI providers (for example Google Gemini) — generate the written trade review. They receive anonymised trade data only: never your email, name or account.

Some of these operate outside the EU. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or on an adequacy decision.

5. What stays in your browser

Settings, guest progress and knowledge-base progress live in your browser's localStorage. That is not a cookie and is sent nowhere unless you sign in. We use no advertising or analytics cookies. Clearing browser data removes this local copy; an account keeps the cloud copy.

6. How long we keep it

Account and progress — while the account exists.
After deletion — removed within 30 days, except what accounting law requires us to keep.
Payment records — as long as Estonian accounting law requires (currently 7 years).
Technical logs — up to 90 days.

7. Your rights

Under the GDPR you may: get a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. Write to [EMAIL] — we answer within 30 days. You may also complain to the Estonian Data Protection Inspectorate (aki.ee).

Fastest route for deletion: write from the address the account is registered to and ask for it to be deleted.

8. Children

The Service is for people 18 and older. We do not knowingly collect data from children. If such data reaches us, we delete it.

9. Security

Access is restricted at the database level (row-level security: an account sees only its own rows). Traffic is encrypted (HTTPS). Passwords are stored hashed by the authentication provider and are not visible to us.

10. Changes

This policy may be updated; the current version always lives on this page with its date. Material changes are announced inside the Service.

← Back to the app Terms of Use Refund Policy