Privacy Policy

1. WHO WE ARE

TCT_SIM is operated by The Crude Trader ("we", "us", "our") and is accessible at thecrudetrader.in/sim/. For privacy-related queries contact us at: privacy@thecrudetrader.in

2. WHAT DATA WE COLLECT

We collect only what is necessary to run the service:

• Account data — your name, email address, and profile picture, obtained via Google Sign-In (OAuth 2.0). We never see your Google password.
• Username — an optional display name you choose.
• Usage data — trades you place, challenge votes, patterns you study, speed settings. This powers your stats and the leaderboard.
• Technical data — IP address (for rate limiting and watermarking), browser/device type (User-Agent), timestamps.
• Analytics — anonymised page views and event data via Google Analytics 4 (GA4) with IP anonymisation enabled. GA4 may set cookies on your device.

We do not collect: real financial data, payment card details, phone numbers, or any personally sensitive information beyond what Google provides during sign-in.

3. HOW WE USE YOUR DATA

• To authenticate you and maintain your session (JWT + refresh token).
• To display your trade stats, challenge streak, and leaderboard position.
• To generate your shareable stats card (opt-in — only when you tap "Share My Stats").
• To enforce rate limits and detect abuse (IP address).
• To trace unauthorised redistribution of our scenario content (watermark signatures).
• To improve the product via aggregated, anonymised analytics.

4. LEGAL BASIS (GDPR / DPDP ACT 2023)

For users in the EU/EEA, our legal basis is legitimate interests (operating the service) and consent (for analytics cookies). For users in India, we comply with the Digital Personal Data Protection Act 2023. You may withdraw consent at any time by contacting us.

5. DATA SHARING

We do not sell, rent, or trade your personal data. We share data only with:

• Google — for OAuth sign-in and GA4 analytics (subject to Google's privacy policy).
• Amazon Web Services (AWS) — our database backups are stored encrypted on AWS S3, Mumbai region.

All third-party processors are bound by data processing agreements.

6. DATA RETENTION

• Account data is retained for as long as your account is active.
• Trade and challenge data is retained indefinitely to power your lifetime stats.
• DB backups are retained for 2 days (8 snapshots, every 6 hours) on AWS S3.
• You may request deletion of your account and all associated data at any time (see Section 8).

7. COOKIES

We use:

• Session cookie — a secure, HTTP-only refresh token cookie to keep you signed in.
• Google Analytics cookies — anonymised usage tracking (_ga, _ga_*). You may opt out via your browser settings or Google's opt-out tool.

We do not use advertising, tracking, or third-party marketing cookies.

8. YOUR RIGHTS

You have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data (username, display name).
• Erasure — request deletion of your account and all associated data.
• Portability — receive your data in a machine-readable format.
• Object — opt out of analytics at any time.

To exercise any right, email privacy@thecrudetrader.in. We will respond within 30 days.

9. SECURITY

We use industry-standard protections: HTTPS/TLS everywhere, HTTP-only signed cookies, JWT with short expiry, bcrypt-hashed tokens, rate limiting, and encrypted S3 backups. No security measure is 100% foolproof — if you discover a vulnerability please disclose it responsibly.

10. CHILDREN

TCT_SIM is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

11. CHANGES TO THIS POLICY

We may update this policy. Material changes will be announced on the site. The "Last updated" date at the top of this page will always reflect the current version.

12. CONTACT

The Crude Trader
Email: privacy@thecrudetrader.in
Website: thecrudetrader.in