Privacy Policy

The short version: we collect the minimum needed to run a practice app — an email if you create an account, your practice activity, purchase records from the app stores, basic diagnostics, and first-party usage events (what you do in the app, sent only to our own server, which you can switch off in Settings). On the free plan, clearly labelled sponsored cards are served by Google AdMob, which may use your device's advertising identifier; FundedLot Pro removes ads entirely. We don't sell your data, we don't collect financial credentials, and you can delete your account and data at any time.

1. Who we are

FundedLot ("FundedLot", "we", "us") operates the FundedLot mobile application and the website fundedlot.com (together, the "Service"). For any privacy question or request, contact support@fundedlot.com.

2. What we collect

Information you provide.

• Account details — if you create an account: email address, display name, and authentication identifiers. You can use core practice features without an account.
• Support messages — emails you send us, including any attachments you choose to include.

Information created by using the app.

• Practice activity — your simulated trades, evaluations, journal entries, settings and coach results. This is simulation data on virtual funds; it is not real financial account data.
• Purchase records — when you buy an attempt pack or subscription, we receive transaction confirmations (product, time, status) from Apple, Google, and our purchase-management provider. We never see or store your card number.
• Device & crash data — device model, operating system version, app version and language, and, if the app crashes, a crash report: the error and its stack trace, the app version, your device model and OS version, and a Firebase installation identifier. Crash reports carry no advertising identifier, no e-mail address and no trade data. The app ships no third-party analytics SDK.
• Usage events (first-party analytics) — while Settings → Usage sharing is on, the app tells our own server what you do in it: for example that you installed or opened the app, viewed a screen, opened or closed a practice trade (the market, the size, and which account), started a challenge, viewed the Prop catalogue, or opened one of our in-app messages. Each event carries its time, the app version, the platform (Android, iOS or web) and your time-zone offset. Events are tied to a random identifier the app creates on your device — not your advertising identifier — and, while you are signed in, to your account ID. They never contain your name, e-mail address, phone number or balances: our server refuses any value that looks like an e-mail address or a phone number. Our server also records, for the same purposes, facts it already holds about your account: cloud and Prop trades, challenge orders and results, and withdrawal requests.
• Advertising identifier (free plan only) — on the free plan, Google AdMob may read your device's advertising identifier to serve and measure the sponsored cards; on iOS this happens only if you allow tracking when asked. Pro subscribers see no ads and the identifier is not used. Details and controls are in section 5.

What we do not collect: real brokerage or bank credentials, government identification, precise location, or your contacts. The app has no real-money trading, so it never asks for payment details outside the app stores' own billing systems.

3. How we use it

• To provide the Service: run simulations, sync your data across devices when signed in, and restore purchases.
• To operate coaching features: your practice history is analyzed inside the Service to produce mistake reports, grades and readiness estimates for you. The mistake detectors, grades and readiness estimate run on your device.
• To answer you with AI: when you open an AI Analyst report or use Ask-the-coach, the practice data those features need (recent simulated trades, the coach's findings, and the question you typed) is sent to our server, which generates the response with Anthropic's Claude models, accessed through Amazon Bedrock (Amazon Web Services) or Anthropic's API. Nothing is sent until you use one of those features.
• To fix and improve: crash reports, so we can find and fix the bug that caused them; and usage events, so we can see which features are used, where people get stuck, and whether a change helped — as counts, funnels and retention figures in our own admin tools.
• To talk to you inside the app: usage events decide which in-app messages you get — a welcome, how your challenge's rules work once you start one, a reminder if a challenge you started has no trade yet, next steps after a challenge is passed or ended, and a note if you have not opened the app for a week. They appear in the app's inbox; if you are signed in they may also arrive as a push notification (subject to your notification settings) or a service email. We do not send these push notifications or emails between 22:00 and 08:00 your local time.
• To communicate: service messages (e.g., purchase receipts, important changes) and replies to your support requests. Marketing emails, if we ever send them, will be opt-in with one-tap unsubscribe.
• To comply with law and enforce our terms.

We do not sell personal data for money. The only advertising-related processing is Google AdMob serving the sponsored cards on the free plan, described in section 5 — Pro subscribers are not subject to it at all.

4. Who we share it with

Only service providers that make the app work, bound by their own confidentiality and data-protection obligations:

• App stores & billing — Apple App Store, Google Play, and our subscription-management provider, to process and validate purchases.
• Cloud infrastructure — hosting, databases, and authentication providers that store account and sync data.
• AI processing — Anthropic's Claude models, accessed through Amazon Bedrock (Amazon Web Services) or Anthropic's API, receive the practice data described in section 3 to generate AI Analyst reports and Ask-the-coach answers. They receive no advertising identifier and no account credentials.
• Crash reporting — Firebase Crashlytics (Google), which receives the crash reports described in section 2. It is configured without advertising identifiers. No third-party product-analytics tool is used: usage events are stored in our own database on our cloud infrastructure provider (Google Cloud Firestore) and are never given to advertisers.
• Advertising (free plan) — Google AdMob, to serve and measure the sponsored cards; section 5 lists what it receives and how to opt out.

We may also disclose information if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to data collected under it).

5. Advertising on the free plan & your choices

The free plan is supported by a small number of clearly labelled sponsored cards, served by Google AdMob. They never appear on trading screens, in coaching reports, or on the paywall. FundedLot Pro removes them entirely, and Pro subscribers' devices never initialise the advertising SDK.

• What Google receives. To serve and measure ads, Google may process your device's advertising identifier (IDFA on iOS — only after you allow tracking in the system prompt; Google Advertising ID on Android), your IP address and the approximate location derived from it, device and app information, and interactions with the ads themselves. Google processes this data under its own privacy policy; see also how Google uses information from apps that use its services.
• Consent. In the EEA, the UK and Switzerland the app shows Google's consent form before any ad loads, and you can change your choice at any time from Settings → Legal & compliance → Ad privacy options. On iOS, Apple's App Tracking Transparency prompt controls whether the advertising identifier is shared; declining it means ads are not personalised.
• Opting out elsewhere. iOS: Settings → Privacy & Security → Tracking. Android: Settings → Google → Ads (delete or reset your advertising ID, or opt out of ads personalisation).
• "Sale" or "sharing" under US state laws. Personalised advertising through a third party can count as "sharing" for cross-context behavioural advertising under the CCPA/CPRA and similar laws. We do not sell personal data for money. To opt out of such sharing, decline tracking (iOS), turn off ads personalisation (Android), use the in-app ad privacy options, or upgrade to Pro, which serves no ads at all.
• Content. We ask Google to apply a "PG" maximum ad-content rating. Sponsored cards are never financial advice and never an endorsement by us.

Usage sharing. You can switch first-party usage events off at any time in Settings → Usage sharing ("Share app usage to improve FundedLot"). When you do, the app stops sending usage events, our server deletes the events it already received from that device and stops sending it in-app messages. Switching it back on starts again from that moment.

6. Retention

Usage events are deleted automatically 90 days after we receive them. A short summary per device (when the app was installed, the days it was used, which steps such as a first trade were reached) is deleted 180 days after the device was last used, and in-app messages 180 days after they were sent. Daily totals per event type, which identify no device or person, are kept for trend charts. Deleting your account also deletes your usage events, device summaries and messages.

Account data and practice history are kept while your account exists. If you delete your account, associated personal data is deleted or irreversibly anonymized within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons (kept only as long as required). Local-only practice data lives on your device and is removed when you delete the app or clear its data.

7. Your rights

Depending on where you live (including under the GDPR, UK GDPR, CCPA/CPRA, and India's DPDP Act), you may have rights to access, correct, export, restrict, object to processing of, or delete your personal data, and to withdraw consent where processing is based on consent. Exercise any of them by emailing support@fundedlot.com from the address linked to your account — we respond within the timelines your local law sets. Account deletion is also self-serve: see account & data deletion. You may also lodge a complaint with your local data-protection authority.

8. International transfers

Our providers may process data in countries other than yours. Where required, transfers are protected by recognized safeguards such as standard contractual clauses or equivalent mechanisms.

9. Security

Data is encrypted in transit, access is restricted to what operating the Service requires, and authentication is handled by established identity providers. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

10. Children

The Service is for adults preparing for trading evaluations and is not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe a minor has created an account, contact us and we will delete it.

11. Cookies & the website

fundedlot.com does not set advertising or analytics cookies.

If you sign in on the website, you use the same FundedLot account as in the app (Google Firebase Authentication handles the email and password; we never see your password). Your browser keeps the sign-in session in its own local storage until you sign out, and may keep an unsaved draft of your plan there. The plan you save on the website (goal, firm, phase, account size or capital, platform, markets, regions, session, rules and what gets in your way) is stored with your account on our server, the same as when you fill it in the app, and is used to size signals for you and to brief your mentor.

12. Changes

We will post any changes on this page and update the effective date. For material changes affecting app users, we will notify you in the app or by email before they take effect.

13. Contact

Privacy questions and requests: support@fundedlot.com.