You can read the Trading Academy courses without signing up and without giving any personal data. We process personal data only when you create an account. Here is what it is and what we do with it.
Who processes the data#
The data controller is Tom Sramek, who runs trading-academy.app. Contact: tom@tomsramek.com.
Without an account#
When you only read the courses, we do not know who you are. The site uses no ads and no tracking tools, and it sets no cookies. We count visits only anonymously – see Visit statistics.
The server may briefly record technical details of requests, such as the IP address and time, for security and troubleshooting.
If you switch between the light and dark theme, your choice is stored only in your browser (local storage). It never reaches us.
With an account#
When you create an account, we process:
- your e-mail address – to send you a sign-in link and to recognise you,
- your name and profile picture – only if you sign in with Google and Google passes them on,
- your Google account identifier – if you sign in with Google,
- sign-in details – when you signed in, the IP address and browser type of each signed-in device, to protect the account from misuse,
- your course progress – which lessons you completed and when, and your quiz results (best and last score, number of attempts). Badges are calculated from it and not stored separately.
We do not use or store passwords. You sign in with a link from an e-mail or with Google.
Why, and on what legal basis#
- Running your account – to provide the account you asked for and save your progress (performance of a contract, Art. 6(1)(b) GDPR).
- Backups – so that a server failure does not wipe out your account and progress (legitimate interest, Art. 6(1)(f) GDPR).
- Security – limiting sign-in attempts and protecting accounts from misuse (legitimate interest, Art. 6(1)(f) GDPR).
- Visit statistics – to know which courses and lessons help people and which need improving (legitimate interest, Art. 6(1)(f) GDPR).
We do not sell the data, use it for advertising or for automated decision-making.
Visit statistics#
We measure visits with Cloudflare Web Analytics (opens in a new tab) by Cloudflare, which also runs the site. The data is not sent to anyone else.
- No cookies – nothing is stored in your browser, which is why the site has no cookie banner.
- No identification – no browser fingerprint and no IP address is used to recognise a visitor, so visits cannot be linked to you or your account.
- What is counted – the page visited, where you came from, the type of browser, system and device, the country and how fast the page loaded. None of it contains your name or e-mail.
Cookies#
After you sign in we set a single cookie: better-auth.session_token. It keeps you signed in for 7
days and is strictly necessary for the account, so it needs no consent and the site has no cookie
banner. Scripts on the page cannot read it (HttpOnly). It disappears when you sign out.
Who else has access#
We work with a few providers who process the data only on our behalf:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | the server, database, backups and stats | EU / USA |
| Forward Email LLC | sending the e-mail with the sign-in link | USA |
| Google (Google Ireland Limited) | signing in with Google, if you choose it | EU / USA |
When you sign in with Google, Google's side of the processing follows its privacy policy (opens in a new tab).
Donations#
If you decide to support the academy, the payment happens on the Buy Me a Coffee website (Buy Me a Coffee, Inc., USA) and follows their privacy policy (opens in a new tab). Our site only has a plain link – no script or cookies of theirs. About a donation we see only what Buy Me a Coffee shows us: the name or nickname you enter, the amount and an optional message. We do not link this to your academy account and never publish it.
For how long#
- Your account and progress are kept until you delete the account. You can delete it yourself on the My account page, or write to us.
- Sign-in details are deleted when you sign out. Expired records (after 7 days) are removed regularly.
- Sign-in links work for 15 minutes and are deleted once used or expired.
- Backups are kept for 30 days. After you delete your account, your data may remain in older backups for up to 30 days, until they are deleted. We use backups only to restore the site after a failure.
Your rights#
You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability (an export), and the right to object to processing based on legitimate interest. Just write to tom@tomsramek.com – we reply within a month.
If you believe we handle your data wrongly, you can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (opens in a new tab), or to the authority in your country.
Changes#
We may update this policy when the way the site works changes. The current version is always on this page with the date of the last update.