Privacy Policy

We collect the least we need to run a learning game: a sign-in email, your progress, and a public nickname if you join the leaderboard. We don't sell your data, we don't run ads, and we don't track you across other sites.

The controller of your personal data is support@hardwood-trading.com. To ask us anything about your data, see Contact.

On your device. Lesson progress, practice results, XP, chips, hearts, streaks, your onboarding answers (goal, level, time, what trips you up), theme, best Sport Table score and how many practice cards you played today are stored in your browser (localStorage). This is what makes the features you use work, even without an account. Details in Cookies & storage.

Onboarding survey. If you answer the five optional questions at the start (why you're here, your level, what you watch, minutes a day, what trips you up), we keep the answers on your device and also send them, once, to our own database so we can see who our learners are and improve the lessons. The answers are preferences, not personal details. They are stored without any identifier unless you allowed usage statistics (then they are linked to your random device ID and first source) or you are signed in (then to your account). You can skip the survey; completing it earns a one-time chip bonus. Basis: legitimate interest in improving the product; for the identifiers, your consent or the account contract.

Guest session. When you open the site we create an anonymous session (a random ID; no email, no name) so the app can work. It sits in a cookie that is strictly necessary for the site to function. Basis: our legitimate interest in providing a working service you asked for.

Account. If you create a free account we collect your email address and sign you in with a link or one-time code sent to it. There are no passwords. When you are signed in, a copy of your progress (the items above plus your results history) is stored on our servers so it follows you across devices. Basis: performing our contract with you. Giving us an email is optional, but without it you can't have an account.

Leaderboard. Signed-in accounts appear publicly under a nickname they choose themselves (please don't use your real name or email) with weekly and total XP, streak, number of practice cards and accuracy. Your email is never shown. Guests do not appear. Basis: performing our contract with you (it is a feature of the service you use).

Payments. Paid plans and chip packs open soon. Payments are handled by Stripe. We never see or store your card number. We keep what we need to run your plan and meet accounting law: which plan you have, dates, amount, tax, and the Stripe customer and payment IDs. Basis: contract and legal obligation.

Emails. We send you sign-in emails and, once payments open, receipts and renewal or billing notices. These are needed to run your account. We don't send marketing email unless you ask for it.

Support and feedback. If you contact us, or use the feedback button (which opens your own email app), we receive what you send. Please don't include anything sensitive.

Page-view analytics. We use Vercel Web Analytics to see which pages are visited and where visitors come from. It is aggregate, sets no cookies and does not build a profile of you. Basis: legitimate interest in improving the product.

Usage statistics. If you press Allow on our statistics banner, we store a random device ID and the source you first arrived from (for example a utm_source in a link), and record events such as pages viewed, lessons started or finished, practice cards answered and plan or button clicks, with your device type. We do not record anything you type. If you sign in with an account, these events are tied to that account so we can see how the product is used and which plan you chose. Basis: your consent for guests; for signed-in accounts, our legitimate interest in running and improving the service, which you can object to at any time by choosing No thanks on the Cookies & storage page. Declining erases the device ID and source and stops all further recording. On request we delete the event records linked to your account.

Security. Our hosting and database providers keep technical logs (such as IP address and request times) to run the service and defend against abuse. Basis: legitimate interest in security.

Supabase (accounts and database), Vercel (hosting and analytics), Resend (sending emails) and, when paid plans open, Stripe(payments). They process data on our behalf, under contracts that limit what they can do with it. Stripe also acts as an independent controller for its own fraud-prevention and financial-regulation duties. We don't sell personal data or share it for advertising. We may disclose data if the law requires it.

Some of these providers process data outside your country, including outside the EEA and UK. Where that happens it is under the safeguards required by law, such as the EU–US Data Privacy Framework or standard contractual clauses.

Account data: while your account exists. If you delete your account (or ask us to), we delete your email, synced progress and leaderboard entry. Payment and tax records: for as long as the law requires (typically several years). Server logs: a short period set by the provider. Data on your own device stays there until you clear your browser data.

You can ask us to access, correct, export or delete your data, to restrict or stop processing it (including where we rely on legitimate interest), and, if we ever rely on consent, to withdraw it. We make no decisions about you by automated means that have legal or similarly significant effects. To exercise a right, contact us; we'll answer within one month. If you are unhappy, you can complain to your local data protection authority.

Hardwood Trading is not directed at anyone under 18 and we don't knowingly collect data from them. If you think a child has given us data, tell us and we'll delete it.

If this policy changes in a way that matters, we'll update the date above and, for accounts, tell you before it takes effect.