Privacy policy

1. Overview

Alphacent is a trading simulator for education, covering crypto, stocks, ETFs, indices, and commodities. All trading in the app uses paper money, so we never touch your real finances. This policy explains what data we do collect, why, who processes it, and the rights you have over it. It applies to the Alphacent app for iOS and Android and to this website. NextCent OÜ (registry code 16303286), a private limited company registered in Estonia at Maakri tn 30, 10145 Tallinn, Estonia, is the data controller ("we", "us"). Our Terms of service describe the service itself.

Here is the short version:

We do not sell your personal data, and the app currently shows no third-party advertising.

2. What we collect

Account data. When you sign up we collect your email address and the display name you choose. If you use Sign in with Apple or Google sign-in, we receive the identifier those services share with us (and, with Apple, possibly a private relay email instead of your real one). Passwords for email accounts are stored only as secure hashes by our authentication provider.

Profile and gameplay data. The app records what you do inside the simulator so it can work: simulated trades and balances, course and quiz progress, XP, levels, badges, streaks, missions, challenge results, and leaderboard entries. Your display name and rank appear on leaderboards visible to other users.

Device and usage data. We collect basic technical data such as device model, operating system version, app version, language, and diagnostic events like crashes and errors. We also process signals needed to validate trades and prevent cheating on our servers.

Push notification tokens. If you allow notifications, your device gives us a token (APNs on iOS, FCM on Android) so we can deliver them. The token identifies your device for delivery and nothing else.

Purchase data. When you buy Alphacent Pro or a practice-cash pack, Apple or Google processes the payment. We receive purchase receipts and subscription status through RevenueCat so we can unlock what you bought. We never see or store your card number or bank details.

Support messages. If you contact us, we keep the correspondence so we can help you and improve the app.

3. What we do not collect

Because everything in Alphacent is simulated, there is a lot we never touch:

• no real brokerage, exchange, wallet, or bank account connections;
• no real trading activity or real portfolio data;
• no card numbers or bank details (Apple and Google handle payment);
• no precise location;
• no contacts, photos, microphone, or camera access;
• no data brokers, and no buying of data about you from anyone.

4. Why we use your data

We use your data only for the purposes below. For users in the EU, UK, and similar jurisdictions, the legal basis under the GDPR is noted for each.

• Providing the service (contract): running your account, the simulator, courses, missions, leaderboards, and purchases you make.
• Keeping the service safe and honest (legitimate interest): validating trades and rankings on our servers, preventing cheating and abuse, fixing crashes and bugs, and securing accounts.
• Notifications (consent): sending push notifications such as trade alerts, streak reminders, and leaderboard updates. You choose whether to allow these, and you can turn them off at any time in the app or your device settings.
• Legal obligations (legal obligation): keeping records we are required to keep, such as purchase records for tax and accounting.

We do not use your personal data for third-party marketing, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.

5. Who processes your data

We use a small set of service providers to run Alphacent. They process data on our behalf under contracts that restrict what they can do with it:

• Supabase: hosting, authentication, and our database. Your account and gameplay data live here.
• RevenueCat: purchase validation and subscription status.
• Apple and Google: app distribution, payment processing, and push notification delivery (APNs and FCM).
• Market data providers: the live price data shown in the app. Price data flows one way, into the app. We send them no personal data about you.

Beyond these providers, we share personal data only if the law requires it (for example, a valid legal request), to protect our users or enforce our Terms of service, or as part of a merger or acquisition, in which case this policy continues to apply to your data until you are told otherwise.

6. Advertising

Alphacent does not show third-party advertising.

7. How long we keep data

• Account, profile, and gameplay data: kept while your account exists, deleted when you delete your account.
• Device, diagnostic, and usage data: kept up to 12 months, then deleted or aggregated so it no longer identifies you.
• Push tokens: kept until you disable notifications or delete your account.
• Purchase records: kept as long as tax, accounting, and audit rules require, even after account deletion.
• Support correspondence: kept up to 24 months after the issue is closed.

Backups may hold deleted data for a short additional period before they cycle out; deleted data in backups is not restored to live systems.

8. Your rights and choices

Delete your account in the app. Go to Settings and choose account deletion. This permanently removes your account, profile, simulated balances, and gameplay data. If you cannot access the app, email us and we will delete it for you.

Depending on where you live, you also have the right to:

• access a copy of the personal data we hold about you;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• receive your data in a portable format;
• object to or restrict certain processing, including anything based on legitimate interest;
• withdraw consent at any time where processing is based on consent (for example, push notifications), without affecting processing that already happened.

To exercise any of these rights, email support@alphacent.app. We answer within the time the law requires (one month under the GDPR, 45 days under the CCPA, extendable where allowed). If you are in the EU or UK, you can also complain to your data protection authority.

California residents. We do not sell or share personal information as the CCPA/CPRA defines those terms, and we have not done so in the preceding 12 months. You still have the rights to know, delete, correct, and not be discriminated against for exercising them; use the contact above.

Notifications. You can turn push notifications off in the app's settings or your device settings whenever you like; the app keeps working without them.

9. International transfers

Our service providers may store or process data in countries other than yours, including the United States. Where data moves out of the EU, UK, or Switzerland, we rely on safeguards recognized by law, mainly the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions or the EU-US Data Privacy Framework certification of a provider. You can ask us for more detail on the safeguards that apply to your data.

10. Children

Alphacent is not directed at children under 13, and our Terms of service require users to be at least 13 (or older where local law sets a higher age of digital consent). We do not knowingly collect personal data from children under 13. The app contains no real money trading, no gambling, and no third-party advertising, but it is still built for teens and adults learning about markets.

If you are a parent or guardian and believe a child under 13 has created an account, email support@alphacent.app and we will delete the account and its data promptly.

11. Security

We protect your data with measures appropriate to what we hold: encryption in transit (TLS) and at rest, hashed passwords, row-level access controls in our database, server-side validation of sensitive actions, scoped service credentials, and the principle of collecting as little as the app needs. No system is perfectly secure, but a breach of Alphacent could never expose real financial accounts, because the app never has them.

If a breach affects your personal data in a way that creates real risk to you, we will notify you and the relevant authorities as the law requires.

12. Cookies on this website

This website shows a cookie notice because that is the standard way to tell visitors about browser storage, but in practice it is very quiet: the site sets no tracking or advertising cookies, runs no analytics, and loads nothing from third parties. When you dismiss the notice, the site stores a single value in your browser's local storage so it does not ask you again. That value stays on your device, identifies nothing about you, and you can remove it at any time by clearing your browser's site data.

Essential storage of this kind does not require consent under EU rules, and there are no optional cookies to manage.

13. Changes to this policy

We will update this policy when the app or the law changes. If a change is material, we will tell you in the app or by other reasonable means before it takes effect. The "Last updated" date at the top always shows the current version, and we keep the substance honest: if we ever wanted to use your data in a genuinely new way, we would ask first, not bury it in an update.

14. Contact

Alphacent is the controller responsible for your personal data. For anything in this policy, data requests, or privacy questions, contact us at support@alphacent.app. We read everything.