Privacy Policy

Effective date: October 17, 2026

This Privacy Policy describes how Ten2Whale (“Ten2Whale,” “we,” “us,” or “our”) collects, uses, discloses and retains personal information in connection with the Ten2Whale website located at ten2whale.com, the Ten2Whale mobile applications for iOS and Android, and any related services, features or content (collectively, the “Service”). By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

The Service is a simulated trading game. All balances, trades and results are virtual and have no monetary value. We do not offer brokerage, investment or financial services, and we do not collect payment card, bank account or other financial account information.

1. Information We Collect

1.1 Information you provide. When you register for an account, we collect your email address, the username you select and a password. Passwords are processed by our authentication provider and stored only in hashed form; we do not have access to your password in plain text.

1.2 Gameplay data. We collect and store data generated through your use of the Service, including solo trading sessions, individual trades and order details, Daily Chart attempts and results, multiplayer battle records, achievements, virtual loans taken, and chart configuration (indicators and drawings). This data is necessary to operate the Service, calculate account balances and statistics, and produce leaderboards.

1.3 Device and technical data. When you access the Service, our servers and hosting provider automatically receive certain technical information, such as your IP address, browser or device type, operating system, and the date and time of requests. We use IP addresses on a transient basis for rate limiting and abuse prevention.

1.4 Push notification tokens. If you enable notifications in the mobile application, we collect a device push token issued by your device’s operating system so that we can deliver Daily Chart reminders. You may withdraw this permission at any time in your device settings; tokens are also removed when you sign out.

1.5 Guest play. If you use the Daily Chart without an account, we issue a signed, randomly generated identifier stored in a cookie. Only a hashed version of this identifier is retained on our servers, and it is used solely to enforce the one-attempt-per-day rule.

2. Cookies and Local Storage

We use a limited number of strictly necessary cookies and browser local storage entries to keep you signed in, maintain your session, enforce game rules and remember preferences such as your selected color theme. We do not use advertising cookies, cross-site tracking technologies or third-party analytics.

3. How We Use Information

We process personal information for the following purposes:

to provide, operate and maintain the Service, including authenticating users and administering accounts;
to calculate game outcomes, balances, statistics, achievements and leaderboard rankings;
to send service-related communications, such as account confirmation emails and, where enabled, push notifications;
to detect, investigate and prevent cheating, fraud, abuse and security incidents; and
to comply with applicable legal obligations.

Where the General Data Protection Regulation (“GDPR”) or similar laws apply, we rely on the following legal bases: performance of a contract (providing the Service you request), our legitimate interests (securing the Service and preventing abuse), consent (push notifications), and compliance with legal obligations.

4. Public Information

Certain information is displayed publicly within the Service, including your username, virtual account balance, returns, gameplay statistics, achievements and battle record, which appear on leaderboards and on your public player profile. Your email address is never made publicly available.

5. Disclosure of Information

We do not sell, rent or trade personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only to the following categories of recipients:

Service providers. Vendors that process data on our behalf to operate the Service: Supabase (authentication, database and file storage), Render (application hosting), Expo (push notification delivery) and Google Fonts (font delivery, which receives your IP address when fonts are loaded).
Legal and safety. Where we believe in good faith that disclosure is required by law, regulation, legal process or governmental request, or is necessary to protect the rights, property or safety of Ten2Whale, our users or others.
Business transfers. In connection with a merger, acquisition, reorganization or sale of assets, in which case personal information may be transferred subject to this Privacy Policy.

6. Data Retention

We retain account information for as long as your account remains active. Gameplay records are retained to preserve the integrity of game history and leaderboards. Upon deletion of your account, the gameplay records associated with it are de-identified as described in Section 7 and may be retained in that form indefinitely.

7. Account Deletion

You may delete your account at any time from within the Service by selecting Settings → Delete account. Upon deletion, we permanently delete your authentication credentials, email address, username and push notification tokens. Gameplay records previously associated with your account are de-identified, such that they are no longer linked to your email address or username, and are removed from all leaderboards and public profiles. Account deletion is irreversible. If you are unable to access your account, you may submit a deletion request to the contact address below.

8. Your Rights

Depending on your place of residence, you may have rights under applicable data protection laws, including the GDPR and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). These may include the right to access, correct or delete your personal information, to object to or restrict certain processing, to data portability, and to withdraw consent where processing is based on consent. You may update your username and password in Settings at any time. To exercise any other right, contact us at the address below; we may need to verify your identity before responding. We will not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data protection authority.

9. Data Security

We implement reasonable administrative, technical and organizational safeguards designed to protect personal information, including encryption in transit (HTTPS/TLS), hashed password storage, access controls and rate limiting. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. International Data Transfers

Our service providers may process and store information in the United States and other countries whose data protection laws may differ from those of your jurisdiction. By using the Service, you understand that your information may be transferred to and processed in those countries.

11. Children’s Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Your continued use of the Service after any changes take effect constitutes your acknowledgment of the revised Privacy Policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, or wish to exercise your rights, please contact us at support@ten2whale.com.