Privacy Policy

Effective Date: June 27, 2026 · Previous version: June 21, 2026

TheInvestmentAnalyst.com ("we," "us," or "our") operates TickerOne (the "Game"), a daily stock prediction game available as native iOS and Android applications (with a web preview at theinvestmentanalyst.com/marketcall). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the Game.

1. Information We Collect

Information You Provide

• Account information: Email address and display name, provided when you create an account or sign in with Apple or Google.
• Game predictions: Your daily stock predictions, including predicted direction (up/down), confidence level, price-range calls, and optional wildcard selections.
• In-app messages between friends ("trash talk" feature): When you send a curated message to a friend (e.g., a taunt, reaction, or comeback nudge), we store the sender, recipient, message catalog key, and timestamp. The message body itself is selected from a fixed catalog and is not free-text user input.
• Friend connections: When you add or accept a friend, we store the relationship so you can see each other on the Friends leaderboard, send curated messages, and challenge each other to 1v1 Battles.
• 1v1 Friend Battle records (v1.0.6): When you challenge a friend or accept a challenge, we store the challenger, opponent, game date, status, both players' scores, and the winner. This is shown to both participants in their Battles inbox / history.
• Private League membership (v1.0.6): When you create or join a private league we store the league's name, owner, invite code, optional date bounds, and your membership row. Other league members can see you on the league leaderboard.
• Equipped avatar badge (v1.0.6): The avatar badge you select in Settings is stored against your account and displayed next to your display name on tournament and league leaderboards.
• Custom profile photo (optional): If you choose to upload a profile photo, the image is sent directly from your device to our image host (Cloudinary) using an upload preset — it does not pass through our application server. Cloudinary returns an image URL, which is what we store against your account. The photo is shown as your avatar next to your display name (for example on your profile card and the leaderboard). Uploaded images are automatically screened for inappropriate content; images that fail screening are rejected and not stored. You can remove or replace your photo at any time, and it is deleted when you delete your account.
• Achievements & cosmetic unlocks: We store which achievement badges and avatar cosmetics you have earned and unlocked (for example, streak, accuracy, points, championship and comeback badges). These are derived from your gameplay, carry no points value, and are used to display your earned badges and the cosmetics available to you.
• Referral relationships: If you sign up using a referral code, follow a referral link, or apply a code after signing up, we store the connection between you and the referring account so we can award the referral bonus. We do not expose the identity of one party to the other beyond what is needed to grant the reward.
• Pro bio (admin-flagged users only, v1.0.6): Users who are flagged as Pro Picks by an administrator may have a short biography (≤140 characters) attached to their profile, surfaced on the Pro Picks rail.
• Support reports: If you use the in-app "Report an Issue" form, the text of your report along with diagnostic context (see below).

Information Collected Automatically

• Game scores and statistics: Points earned, streaks, accuracy rates, leaderboard rankings, and historical performance data generated from your predictions.
• Signup cohort (v1.0.6): The year-month of your signup (e.g. "2026-05"), used to group you with people who joined in the same month for the Cohort leaderboard. Derived from your account creation date; not separately requested.
• Derived behavioural metrics (v1.0.6): The Stats screen surfaces analytical breakdowns derived from your prediction history — confidence calibration, direction-tilt rate, hot-hand bias, loss-chasing rate, alignment with Pro Picks, range adoption rate, win/loss asymmetry, skill-vs-luck Bayesian estimate, strength-by-confidence-and-direction matrix, and multiplier-capture share. These are computed on demand from data you already provided through gameplay; we do not store new categories of personal data to produce them, nor do we share these analyses with third parties.
• Login dates: The date of each login, used to calculate daily login rewards and streak tracking.
• Authentication tokens: A JSON Web Token (JWT) stored in your browser's localStorage (web) or Keychain/Keystore (native app) to keep you signed in. This is not a tracking cookie.
• Push notification tokens (native app only): On iOS and Android, we register your device with Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) to deliver notifications you have opted in to receive. The token is an opaque identifier generated by Apple/Google and cannot be used to track you across other apps.
• Notification preference flags: Per-category toggles for daily reminder, results-ready, streak warning, championship, milestones, re-engagement, and marketing email opt-in. Stored against your account so we honour your choices across devices.
• Notification targeting data: To decide whether to send a given push notification, and to whom, we may use data we already hold — your notification preferences, signup cohort, recent login activity, streak/championship status, and the behavioural metrics described above. For example, a re-engagement nudge targets recently inactive players, a cohort message targets a single signup month, and the tilt-alert (an optional well-being nudge) is sent when your recent calls show a loss-chasing pattern. These notifications respect your category toggles and quiet hours; no new categories of data are collected to target them.
• Live Activity tokens (iOS only): If you opt into Live Activities on iOS 16.1+, we register a short-lived activity token so we can update the lock-screen widget during market hours. Token expires when the activity ends or after the daily game resolves.
• Timezone (native app only): Your device's IANA timezone string (e.g. "Europe/London") is captured at registration so notifications respect your local quiet hours. No other location data is collected.
• IP address: Your IP address is recorded in server logs and used for rate limiting to protect against abuse. It is not used for advertising or tracking.
• Diagnostic context (support reports only): When you submit a support report, we attach platform information (iOS/Android/Web), app version, user-agent, current screen, recent client errors, and last failed API call.
• Crash logs and diagnostics: Both server (Sentry) and client (browser console) crashes are logged to help us debug failures. Crash reports include the stack trace, app version, platform, and your user ID if you were authenticated. They do not include passwords, prediction values, or your friend messages.

Information We Do NOT Collect

• Payment or financial information (prizes are fulfilled externally via gift cards)
• Precise or approximate geolocation data
• Contacts, microphone, or device sensor data
• Your photo library or camera roll — if you upload a profile photo, we receive only the single image you choose to select or capture, never your wider library
• Browsing history outside the Game
• Advertising identifiers (IDFA on iOS, AAID on Android)

2. How We Use Your Information

We use the information we collect for the following purposes:

• Operate the Game: Create and manage your account, process your daily predictions, calculate scores, and maintain leaderboards.
• Daily login rewards: Track your login dates to award daily login bonuses and maintain streak counts.
• Prize fulfillment: Use your email address to contact winners and deliver prizes via Tremendous (a third-party gift card fulfillment service). Only your email address is shared with Tremendous for this purpose.
• Authentication: Issue and validate JWT tokens so you can remain signed in across sessions.
• Notifications: Send the push notifications and emails you have opted in to — including daily reminders, results-ready alerts, streak warnings, 1v1 Battle updates, championship and milestone notices, re-engagement nudges, and the optional tilt-alert well-being nudge. We target these using data we already hold (see "Notification targeting data" above) and honour your per-category preferences and quiet hours.
• Stats and insights: Compute the analytical breakdowns on your Stats screen (calibration, behavioural patterns, accuracy, streaks, and related metrics) from your own prediction history, so you can review your own performance. These analyses are shown only to you and are not shared with third parties.
• Game improvement: Analyze aggregate, anonymized game data (e.g., overall prediction accuracy trends) to improve the Game experience. We do not build individual behavioral profiles for advertising, and we do not sell your data.

3. Data Storage and Security

Your data is stored in a SQLite database on a server hosted by Railway.app, a cloud application hosting platform. We implement reasonable administrative and technical safeguards to protect your information, including:

• Encrypted HTTPS connections for all data in transit
• JWT-based authentication with token expiration
• Server-side input validation and sanitization

No method of electronic storage or transmission is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

4. Third-Party Services

The Game integrates with the following third-party services, each processing a specific slice of data on our behalf. We do not use advertising networks or tracking pixels.

Yahoo Finance API

We use the Yahoo Finance API to retrieve real-time and historical stock price data used in the Game. No user data is transmitted to Yahoo Finance; we only request publicly available market data.

LearnWorlds

The Game may be embedded within the LearnWorlds learning platform. If you access the Game through LearnWorlds, an SSO token may be passed to authenticate your session. LearnWorlds' own privacy policy governs data collected by their platform. LearnWorlds privacy policy.

Sign in with Apple / Google Sign-In (native app)

On iOS, you may sign in using Sign in with Apple. On iOS and Android, you may sign in using Google. In both cases, the third-party identity provider returns your email address (and optionally display name) to us. We do not receive your Apple ID password, Google password, or any other account data. You may revoke access at any time from your Apple ID settings or Google account permissions.

Apple Push Notification service (APNs) & Firebase Cloud Messaging (FCM)

To deliver push notifications on the native app, we register an opaque device token with Apple (iOS) or Google Firebase (Android). The token is an identifier for the device, not for you personally. Notifications can be disabled at any time from your device settings or the in-app preferences.

Tremendous (prize fulfillment)

Prize winners receive gift cards fulfilled through Tremendous. When you win a prize, we share your email address with Tremendous solely for gift card delivery. Tremendous' privacy policy governs their handling of that information.

Resend (transactional email)

Password reset emails, account-deletion confirmations, support-report receipts, and championship winner notifications are delivered via Resend, an email delivery service. Resend processes the recipient email address and message content on our behalf as a data processor.

Cloudinary (profile photo hosting & moderation)

If you upload a custom profile photo, the image is sent directly from your device to Cloudinary, an image hosting and delivery service, using an upload preset. Cloudinary stores and serves the image, resizes it, and runs automated content moderation to screen out inappropriate images. We store only the resulting image URL; the image bytes are processed by Cloudinary as a data processor on our behalf. We do not send Cloudinary any other personal data (such as your email). Cloudinary's privacy policy governs their handling of the image. You can remove your photo at any time, which removes it from your profile.

Sentry (error tracking)

We use Sentry to capture server-side errors for debugging purposes. Captured errors include the stack trace, request path, and may include your user ID if you were authenticated at the time. Sentry does not receive your email, password, or prediction content.

Railway.app (hosting)

Our application server and database are hosted on Railway.app. Railway processes data on our behalf as a hosting provider. Their privacy policy governs their infrastructure services.

Plausible Analytics (web preview only)

The web preview at theinvestmentanalyst.com/marketcall may load Plausible Analytics, a privacy-friendly, cookieless analytics service, to give us aggregate usage statistics (such as page views and outbound link clicks). Plausible does not use cookies, does not collect or store any personal or identifiable data, and does not track you across sites or devices; all metrics are aggregated and cannot be used to identify you. Plausible is loaded only on our production web domain and is not used in the native iOS or Android apps. See Plausible's data policy for details.

5. Cookies and Local Storage

The Game does not use cookies for advertising or cross-site tracking, and sets no tracking cookies. We use browser localStorage solely to store your JWT authentication token, which keeps you signed in. This token is not shared with any third party and is automatically invalidated upon expiration.

The only analytics we use is Plausible (web preview only), which is cookieless and collects no personal or identifiable data (see Section 4). It is not used in the native apps.

6. In-App Direct Messaging

When you use direct messaging, the following applies:

• Who you can message: Only people you are connected to — an accepted friend, or a member of a private league you are both in. You cannot be messaged by strangers.
• What is stored: The message text, the sender, the recipient, and a timestamp. Direct messages are stored in plaintext on our server (they are not end-to-end encrypted).
• Why it is stored this way: Storing messages in readable form on the server is necessary to enable safety and moderation — automated profanity filtering, and the ability to act on user reports, including reviewing reported messages, and blocking users. This helps us keep the community safe and meet platform safety requirements.
• Who can see it: Your messages are visible to you and the recipient. Our staff may access message content only as needed to investigate a report, enforce our rules, comply with law, or address a security issue. We do not use the content of your direct messages for advertising or to build behavioural profiles.
• Reporting and blocking: You can report a message and block another user at any time. Blocking is enforced both ways and stops further messaging between you. Reported content may be retained for as long as needed to handle the report and any resulting action.
• Retention: Direct messages are retained for up to 12 months and are then deleted on a rolling basis. All of your direct messages are deleted when you delete your account (except where a copy must be retained to handle an open safety report or to comply with a legal obligation).

Because direct messaging is a social feature intended for connected users, please do not share sensitive personal information in messages.

7. Children's Privacy & Age Rating

The Game is not directed at children under the age of 13 and is rated for users 12 and over. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as promptly as possible. If you believe a child under 13 has provided us with personal information, please contact us at the address below.

The Game is a skill-based prediction game. While it uses terminology familiar from financial markets (predictions, confidence, streaks, multipliers), no real money is wagered by players. Prizes are awarded by us on a monthly basis to leaderboard leaders and are not tied to any individual user stake.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Game. Specifically:

• Account data (email, display name): Retained until you delete your account.
• Game data (predictions, scores, statistics, streaks, wildcards, friendships, cohort, equipped avatar, achievements, league/tournament membership, and 1v1 Battle records): Retained for the duration of your account to maintain historical records, leaderboard integrity, and streak data. Hard-deleted when you delete your account.
• Custom profile photo (the uploaded image and its URL): Retained while it is set on your account. Removed when you remove or replace it, and deleted when you delete your account.
• Direct messages (once messaging is enabled — see Section 6): Retained for a limited period, then deleted on a rolling basis; deleted when you delete your account, except where a copy must be kept to handle an open safety report or to comply with a legal obligation.
• Authentication tokens: Expire after 30 days and are replaced upon each new login session.
• Push notification logs: Retained for 90 days for open-rate analytics and then deleted. Hard-deleted when you delete your account.
• Support reports: Retained for 12 months after resolution for audit purposes. Hard-deleted when you delete your account.
• Server-side request logs: Retained by our hosting provider (Railway) for up to 30 days per their default retention.
• Referral ledger entries: Retained indefinitely for accounting purposes but user references are anonymised when either party deletes their account.

You can delete your account and all associated data at any time via the in-app menu (Menu → Delete my account), or by contacting us using the information in Section 11 below.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal data. Note that deleting your account will permanently remove your game history and leaderboard records.
• Data portability: Request a machine-readable export of your data.
• Objection: Object to certain processing of your data where applicable under local law.

To exercise any of these rights, please contact us using the information below. We will respond to your request within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy within the Game and updating the "Effective Date" at the top of this page. Your continued use of the Game after any changes constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

TheInvestmentAnalyst.com
Email: support@theinvestmentanalyst.com
Website: https://theinvestmentanalyst.com

For UK users exercising rights under the UK GDPR, you may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

For EU users exercising rights under the GDPR, you may also lodge a complaint with your national data protection authority.