Privacy policy

1. Overview

Alphacent is an educational app. It teaches how markets work through courses, quizzes, and a trading simulator covering crypto, stocks, ETFs, indices, and commodities. Everything you do in the simulator uses virtual money only, so we never touch your real finances. Alphacent is not a financial app: it is not a broker or an exchange, it offers no financial products, and nothing in it is financial advice. This policy explains what data we do collect, why, who processes it, and the rights you have over it. It applies to the Alphacent app for iOS and Android and to this website. NextCent OÜ (registry code 16303286), a private limited company registered in Estonia at Maakri tn 30, 10145 Tallinn, Estonia, is the data controller ("we", "us"). Our Terms of service describe the service itself.

Here is the short version:

We do not sell your personal data. The free version of the app can offer optional reward videos from Google AdMob, which you only see if you choose to watch one (section 6). We do advertise Alphacent itself on Meta's apps (Facebook and Instagram), and on iOS we measure those ads with Meta's help, as section 6 explains.

2. What we collect

Account data. When you sign up we collect your email address and the display name you choose. If you use Sign in with Apple or Google sign-in, we receive the identifier those services share with us (and, with Apple, possibly a private relay email instead of your real one). Passwords for email accounts are stored only as secure hashes by our authentication provider.

Profile and gameplay data. The app records what you do inside the simulator so it can work: simulated trades and balances, course and quiz progress, XP, levels, badges, streaks, missions, challenge results, and leaderboard entries. Your display name and rank appear on leaderboards visible to other users.

Device and usage data. We collect basic technical data such as device model, operating system version, app version, language, and diagnostic events like crashes and errors. We also process technical data our servers need to validate trades and prevent cheating.

App usage analytics. We use PostHog, a product analytics service (EU cloud), to see how the app is used so we can improve it: which screens and features people use, where they stop during onboarding or checkout, and where errors happen. Before you create an account, these events are tied to a random identifier on your device. After you sign up, they are linked to your account. We use them to improve Alphacent and to judge whether our own marketing works, not to target ads at you. We do not record your screen. We also keep the two answers you give during onboarding (your experience level and your daily goal) with your analytics profile. Your location is recorded as your country only, worked out from your IP address; we do not store the IP address.

Install campaign (from app version 2.0). When you install the app from an ad or a link, the app records which campaign brought you, for example a campaign name. We do not store your advertising ID or ad click IDs for this. On iOS, RevenueCat also receives Apple's ad attribution token so we can see whether an Apple ad brought you. In the web version of the app, we record the campaign tags in the link you followed. This is recorded only after you sign in, and turning off Share Usage Analytics stops it.

In-app surveys (from app version 2.0). Now and then the app may ask an optional multiple-choice question. Answers are stored with your analytics profile and never shared with advertisers.

Push notification tokens. If you allow notifications, your device gives us a token (APNs on iOS, FCM on Android) so we can deliver them. The token identifies your device for delivery and nothing else.

Purchase data. When you buy Alphacent Pro or a practice-cash pack, Apple or Google processes the payment. We receive purchase receipts and subscription status through RevenueCat so we can give you what you bought. We never see or store your card number or bank details. Our server keeps a record of subscription and purchase events (product, price, period, and store country) and copies them from RevenueCat to PostHog, for purchases made in any app version. The copy to PostHog stops when you turn off Share Usage Analytics (app version 2.0 or later) or ask us by email, and it never restarts for a deleted account.

Ad measurement data (iOS only). The iOS app includes Meta's software development kit (SDK) so we can measure our own ads. It sends Meta no events and no identifiers unless you tap Allow in Apple's tracking prompt and Share Usage Analytics is on. Section 6 explains exactly what is shared and how to change your choice. The Android app and this website send nothing to Meta.

Support messages. If you contact us, we keep the correspondence so we can help you and improve the app.

3. What we do not collect

Because everything in Alphacent is simulated, there is a lot we never touch:

• no real brokerage, exchange, wallet, or bank account connections;
• no real trading activity or real portfolio data;
• no card numbers or bank details (Apple and Google handle payment);
• no precise location;
• no advertising identifier from your device, unless you tap Allow in Apple's tracking prompt on iOS (see section 6);
• no contacts, photos, microphone, or camera access;
• no data brokers, and no buying of data about you from anyone.

4. Why we use your data

We use your data only for the purposes below. For users in the EU, UK, and similar jurisdictions, the legal basis under the GDPR is noted for each.

• Providing the service (contract): running your account, the simulator, courses, missions, leaderboards, and purchases you make.
• Keeping the service safe and honest (legitimate interest): validating trades and rankings on our servers, preventing cheating and abuse, fixing crashes and bugs, and securing accounts.
• Improving the app (legitimate interest): using product analytics to see which features people use and where they get stuck, so we can fix and improve them.
• Measuring our own advertising (consent, and legitimate interest): on iOS, working out which of our Facebook and Instagram ads lead to installs and subscriptions. We do this only if you allow tracking, with your advertising identifier and app and purchase events, based on your consent. If you do not, nothing is sent to Meta. Recording which campaign brought you (section 2) is based on our legitimate interest in knowing whether our advertising works. See section 6.
• Optional reward videos (consent): if the free version of the app offers a reward video and you choose to watch one, Google AdMob delivers and measures it. See section 6.
• Notifications (consent): sending push notifications such as trade alerts, streak reminders, and leaderboard updates. You choose whether to allow these, and you can turn them off at any time in the app or your device settings.
• Legal obligations (legal obligation): keeping records we are required to keep, such as purchase records for tax and accounting.

We do not sell your personal data, we request only non-personalized ads for the optional reward videos, and we do not make automated decisions about you that have legal or similarly significant effects. Our own marketing use is limited to measuring our own ads, as described above.

5. Who processes your data

We use a small set of providers to run Alphacent. Except where noted for Meta below, they process data on our behalf under contracts that restrict what they can do with it:

• Supabase: hosting, authentication, and our database. Your account and gameplay data live here.
• RevenueCat: purchase validation and subscription status. On iOS, if you allow tracking and Share Usage Analytics is on, RevenueCat also passes your purchase event to Meta for ad measurement (see section 6).
• PostHog (EU cloud): product analytics. It receives events about how you use the app, linked to your account after you sign up, and the copy of your purchase events described in section 2, so we can improve the app.
• Apple and Google: app distribution, payment processing, and push notification delivery (APNs and FCM).
• Market data providers: the live price data shown in the app. Price data flows one way, into the app. We send them no personal data about you.
• Meta (Meta Platforms Ireland Ltd.): on iOS only, receives the ad measurement data described in section 6. Unlike the providers above, Meta also handles that data under its own terms and privacy policy.
• Google (AdMob): delivers and measures the optional reward videos in the free version of the app, only when you choose to watch one. Google also handles that data under its own terms and privacy policy (see section 6).

Beyond these providers, we share personal data only if the law requires it (for example, a valid legal request), to protect our users or enforce our Terms of service, or as part of a merger or acquisition, in which case this policy continues to apply to your data until you are told otherwise.

6. Advertising and ad measurement

Our own ads. We advertise Alphacent itself on Meta's apps, such as Facebook and Instagram, and we target those ads to adults aged 18 and over. To find out which ads lead to installs and subscriptions, the iOS app works with Meta Platforms Ireland Ltd. ("Meta"). This applies to the iOS app only. The Android app and this website send nothing to Meta.

What the iOS app does. The iOS app includes Meta's software development kit (SDK). Shortly after you create an account, the app shows Apple's App Tracking Transparency prompt, which asks whether Alphacent may track your activity across other companies' apps and websites. What Meta receives depends on your answer and on the Share Usage Analytics switch in the app's Settings:

• If you tap Allow and Share Usage Analytics is on: Meta receives a small set of app events: that the app was opened, that an account was created, and that a free trial started. These come with your device's advertising identifier (IDFA), Meta's anonymous app ID for your install, and your IP address and basic device information. RevenueCat also sends Meta your purchase event (the product, the price, and the currency) with the same identifiers. Meta uses this to show us which ads led to installs and subscriptions.
• If you tap Ask App Not to Track, have not been asked yet, or turn off Share Usage Analytics: the app sends Meta no events, we do not share your purchases with Meta, and no advertising identifier is collected. Meta's software in the app still downloads its settings from Meta's servers when the app starts, so those servers see the connection's IP address, as any server would. Apple's SKAdNetwork can still report anonymous, aggregated install counts to the ad network.

What we do not share. Meta receives only the events described above. We do not send Meta your email address, your name, or your simulated trades, and we do not sell your personal data.

Your choice. Apple's prompt states why we ask: we use your advertising ID to see which of our ads brought you to Alphacent, and our ad partner may use it to measure and limit the optional reward videos. The app works the same either way. You can change your answer at any time in iOS Settings > Privacy & Security > Tracking, or turn off Share Usage Analytics in the app's Settings (app version 2.0 or later). Either one stops what the app sends to Meta, and the sharing of your advertising identifier and purchase events with Meta, from that point on. Data Meta has already received stays with Meta under its own terms. You can also review and limit how Meta uses information from apps like ours in the ad settings of your Facebook or Instagram account.

How Meta handles the data. Meta handles the data it receives under its own Privacy Policy and business tools terms. We do not control how long Meta keeps it or what else Meta uses it for under those terms.

Optional reward videos. The free version of the Alphacent app can offer short video ads from Google AdMob. They are always optional: you only see one when you tap to watch it in exchange for virtual practice cash. Alphacent Pro members never see them, the ad software is never started for Pro members, and no feature is ever unlocked by watching an ad. The website shows no ads.

We request non-personalized ads only. Google still receives technical data needed to deliver an ad, limit how often you see it, measure it and prevent fraud, such as your IP address, device and app information, an app-specific identifier on Android (the Android advertising ID is not used), and on iPhone, only if you allowed tracking in Apple's prompt, your device's advertising identifier. We do not send Google your name, email or account ID.

If you are in the European Economic Area, the UK or Switzerland, we rely on your consent: Google's consent form asks for your choice before any ad loads, and you can change it any time in Settings, Ad Privacy Choices. If you are in a US state with a privacy law, you can limit Google's use of your data in the same place when the app shows it. Google's processing is described in its own privacy policy and advertising policies. How we use Meta's measurement tools is described above.

7. How long we keep data

• Account, profile, and gameplay data: kept while your account exists, deleted when you delete your account.
• Device, diagnostic, and usage data, including PostHog analytics: kept up to 12 months, then deleted or aggregated so it no longer identifies you. Analytics profiles with no activity are deleted within 12 months.
• Ad measurement and reward video data: Meta and Google keep the data they receive under their own terms, not ours, and we do not control how long. Turning tracking off stops new sharing but does not delete what Meta already holds. You can manage it in your Facebook or Instagram account settings.
• Push tokens: kept until you disable notifications or delete your account.
• Purchase records: kept as long as tax, accounting, and audit rules require, even after account deletion.
• Support correspondence: kept up to 24 months after the issue is closed.

Backups may hold deleted data for a short additional period before they cycle out; deleted data in backups is not restored to live systems.

8. Your rights and choices

Delete your account in the app. Go to Settings and choose account deletion. This permanently removes your account, profile, simulated balances, and gameplay data. If you cannot access the app, email us and we will delete it for you. Analytics events that were linked to your account are deleted on the schedule in section 7; email us if you want them removed sooner.

Depending on where you live, you also have the right to:

• access a copy of the personal data we hold about you;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• receive your data in a portable format;
• object to or restrict certain processing, including anything based on legitimate interest;
• withdraw consent at any time where processing is based on consent (for example, push notifications and tracking for ad measurement), without affecting processing that already happened.

To exercise any of these rights, email support@alphacent.app. We answer within the time the law requires (one month under the GDPR, 45 days under the CCPA, extendable where allowed). If you are in the EU or UK, you can also complain to your data protection authority.

California residents. We do not sell your personal information. On iOS, if you allow tracking and Share Usage Analytics is on, we share device identifiers and app events with Meta to measure our own ads (see section 6). We do this only with your permission, and you can withdraw it at any time in iOS Settings. You have the rights to know, delete, correct, and not be discriminated against for exercising them; use the contact above.

Analytics. To stop app usage analytics, the install campaign record, the copy of your purchase events to PostHog, and the events sent to Meta, turn off Share Usage Analytics in the app's Settings (app version 2.0 or later). On any version, you can also email us and we will stop it for your account.

Notifications. You can turn push notifications off in the app's settings or your device settings whenever you like; the app keeps working without them.

Tracking and ad measurement (iOS). You can change your answer to Apple's tracking prompt at any time in iOS Settings > Privacy & Security > Tracking. Section 6 explains what changes.

9. International transfers

Our service providers may store or process data in countries other than yours, including the United States. Where data moves out of the EU, UK, or Switzerland, we rely on safeguards recognized by law, mainly the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions or the EU-US Data Privacy Framework certification of a provider. Meta transfers the data it receives under its own safeguards, described in its privacy policy. You can ask us for more detail on the safeguards that apply to your data.

10. Children

Alphacent is not directed at children under 13, and our Terms of service require users to be at least 13 (or older where local law sets a higher age of digital consent). We do not knowingly collect personal data from children under 13. The app contains no real money trading and no gambling, and its only ads are optional reward videos in the free version that you choose to watch, but it is still built for teens and adults learning about markets. Our own ads for Alphacent on Facebook and Instagram are targeted to adults aged 18 and over only.

If you are a parent or guardian and believe a child under 13 has created an account, email support@alphacent.app and we will delete the account and its data promptly.

11. Security

We protect your data with measures appropriate to what we hold: encryption in transit (TLS) and at rest, hashed passwords, row-level access controls in our database, server-side validation of sensitive actions, scoped service credentials, and the principle of collecting as little as the app needs. No system is perfectly secure, but a breach of Alphacent could never expose real financial accounts, because the app never has them.

If a breach affects your personal data in a way that creates real risk to you, we will notify you and the relevant authorities as the law requires.

12. Cookies on this website

This website shows a cookie notice because that is the standard way to tell visitors about browser storage, but in practice it is very quiet: the site sets no tracking or advertising cookies, runs no analytics, and loads nothing from third parties. When you dismiss the notice, the site stores a single value in your browser's local storage so it does not ask you again. That value stays on your device, identifies nothing about you, and you can remove it at any time by clearing your browser's site data.

Essential storage of this kind does not require consent under EU rules, and there are no optional cookies to manage.

13. Changes to this policy

We will update this policy when the app or the law changes. If a change is material, we will tell you in the app or by other reasonable means before it takes effect. The "Last updated" date at the top always shows the current version, and we keep the substance honest: if we ever wanted to use your data in a genuinely new way, we would ask first, not bury it in an update.

What changed in version 1.3. We added PostHog product analytics to this policy, explained how the iOS app works with Meta to measure our own ads, added Meta to the list of recipients, and made clearer that Alphacent is an educational app with a virtual-money simulator.

What changed in version 1.4. For app version 2.0: the iOS app now sends Meta events only if you allow tracking and Share Usage Analytics is on, and no events otherwise (section 6). We added the new Share Usage Analytics switch and how to opt out (section 8), the install campaign record, optional multiple-choice surveys, the two onboarding answers, country-only location, and the server copy of purchase events (section 2). We added the optional reward videos from Google AdMob (sections 5 and 6) and the deletion of inactive analytics profiles within 12 months (section 7).

14. Contact

Alphacent is the controller responsible for your personal data. For anything in this policy, data requests, or privacy questions, contact us at support@alphacent.app. We read everything.