Privacy Policy
What personal data Twirrle collects, why, how long we keep it, who we share it with and your rights.
1. Who is responsible
Twirrle (“Twirrle”, “we”, “us”) is the controller of the personal data described here. Contact us through Help & support in the app or at contact@twirrle.com for any privacy question or request.
2. What we collect
- Account data: e-mail address, display name, language, the date you accepted the Terms and confirmed your age.
- Sign-in data: a password hash (we never store your password), passkey public keys, two-step verification secrets (encrypted), recovery codes (hashed), active sessions with a device label and an approximate location.
- Technical data: IP address (used for security and to decide your region; stored in keyed-hash form where possible), browser type, timestamps of requests.
- Activity: positions (amount, leverage, entry, exit, auto profit and auto loss, result), limits and breaks you set, notifications, favourites and price alerts, chat messages, support requests and our replies.
- Money: ledger entries, deposit addresses assigned to you, deposits and withdrawals with their blockchain transaction ids and destination addresses.
- Verification data, only if we ask for it: identity documents, proof of address, source-of-funds information and the results of sanctions and wallet screening.
3. Why we use it (legal bases)
- To provide the Service you asked for: accounts, positions and their results, checks, balances, deposits, withdrawals, notifications and support (contract).
- To keep the Service and your account secure, prevent fraud and abuse and enforce our Terms (legitimate interests).
- To meet legal duties: anti-money-laundering checks, sanctions screening, record keeping, answering lawful requests from authorities (legal obligation).
- To protect you: limits, reality checks, breaks and self-exclusion, and spotting signs of harm (legitimate interests and, where required, legal obligation).
- To improve the Service using aggregated, non-identifying statistics. We do not sell personal data and we do not use advertising trackers.
5. What others can see
Your display name, avatar, practice-book statistics and badges may appear on the leaderboard and your public profile. Practice positions are private: only you see them. Real-money positions, once real money opens, may appear in the public tables (live trades, leaders, best trades) under your display name. Chat messages are visible to other users in the room.
6. International transfers
Our providers may process data outside your country. Where this happens we rely on adequacy decisions or standard contractual clauses and equivalent safeguards.
7. How long we keep it
- Ledger, positions and money records: for as long as the law requires for accounting and anti-money-laundering purposes (typically 5–10 years after the account is closed). The ledger is append-only and cannot be edited.
- Sessions: until they expire or you sign out; security logs for a limited period.
- Support requests: for as long as needed to handle them and defend claims, then deleted or anonymised.
8. Your rights
Depending on where you live, you may ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Some data must be kept by law even if you ask us to delete it. Send requests through Help & support; we may need to verify your identity. You may also complain to your data-protection authority.
9. Security
We use encryption in transit, encrypted secrets at rest, passkeys and two-step verification, strict access controls with step-up confirmation for staff, append-only audit logs and regular backups. No system is perfectly secure; tell us at once if you suspect misuse of your account.
10. Children
The Service is for adults only. We close accounts we learn belong to someone under 18 and delete their data unless we must keep it by law.