Privacy Policy

Effective date: 2026-04-27 Data controller: Built By Billy (UK sole trader). Contact: billy@builtbybilly.uk.

This Privacy Policy explains what personal data Grounded in Gold collects, why we collect it, how long we keep it, and the rights you have over it. It applies to anyone who creates an account on Grounded in Gold.

1. Who we are

Grounded in Gold is operated by Built By Billy, a UK sole trader. We are the data controller for the personal data described in this policy. You can reach us at billy@builtbybilly.uk.

2. The data we collect

We collect only the data needed to run the app:

Account data — display_name, email, role (trader / admin), creation timestamp.
Trading inputs — your trader_setups row (account balance, risk %, lot sizes, entry mode, etc).
Plans — your monthly_plans rows and daily_rows JSONB state.
Engagement events — non-PII counters (e.g. "trader saved setup at 2026-04-27 13:24") used for the admin coach view.
Disclaimer acceptances — version accepted, timestamp, IP address, user agent (legal evidence of informed consent).
Login attempts — used for per-IP rate limiting; cleared on every npm run demo:reset.
Community content — any post or comment you choose to write.

We do not collect: payment data (we use no payment processor at this time), marketing-funnel cookies, third-party analytics identifiers, or device fingerprints beyond user agent.

3. Why we collect it (legal basis)

Contract (Art 6(1)(b) UK GDPR) — account, trading inputs, plans, community posts. We need this data to provide the service you signed up for.
Legal obligation (Art 6(1)(c)) — disclaimer acceptances, login attempts. Required for compliance evidence and abuse prevention.
Legitimate interest (Art 6(1)(f)) — engagement events used to power the admin coach view (improving the service for paying customers). You can opt out by deleting your account.

4. Who we share data with

We share data with:

Hosting and database providers — Supabase (database, auth) and Vercel (hosting). Both operate under data-processing agreements.
Authorities — when legally compelled (court order, regulator request).

We do not:

Sell your data
Share data for marketing
Pass data to trading platforms, signal providers, or affiliates
Use third-party advertising networks

5. International transfers

Supabase and Vercel may process data in regions outside the UK (typically the United States or European Union). Both are bound by Standard Contractual Clauses or equivalent UK-GDPR-compatible transfer safeguards.

6. How long we keep it

Account data — for as long as your account exists. Deleted when you exercise your Right to Erasure.
Trading inputs and plans — same as account data.
Disclaimer acceptances — retained indefinitely as evidence of informed consent, even after account deletion (anonymised by removing the user_id link, the version + timestamp + IP + user-agent record is preserved).
Login attempts — cleared on each npm run demo:reset and pruned automatically by the rate-limit window (60 seconds for blocking; 30 days for audit).
Engagement events — pruned at the same cadence as account data; deleted on account deletion.

7. Your rights under UK GDPR

You have the right to:

Access (Art 15) — request a copy of your data. Email billy@builtbybilly.uk and we'll respond within 30 days.
Rectification (Art 16) — correct inaccurate data. Most fields can be edited in /settings.
Erasure (Art 17) — delete your account and all linked data. Use the in-app "Delete account" flow (wired via /api/gdpr/delete) or email us. Disclaimer acceptances are anonymised but the evidence record is retained.
Portability (Art 20) — request a structured export of your data. Email us; we'll send a JSON dump within 30 days.
Object (Art 21) — object to processing based on legitimate interest. Email us; the practical effect is account deletion.
Complaint (Art 77) — lodge a complaint with the UK Information Commissioner's Office (https://ico.org.uk) if you believe your rights have been infringed.

8. Cookies

Grounded in Gold uses only essential cookies: a Supabase auth cookie that keeps you logged in. We do not use marketing, analytics, or third-party tracking cookies.

9. Children

Grounded in Gold is not intended for children under 18. We do not knowingly collect data from children under 18. If you believe a child has registered, email billy@builtbybilly.uk and we will delete the account.

10. Security

We use Supabase Row-Level Security (RLS) to ensure each user can only read and write their own data. Auth is handled by Supabase (industry-standard PBKDF2 / Argon2 password hashing). All connections to the app use HTTPS/TLS. We do not store payment data.

11. Changes to this policy

We may update this policy when our practices change. Material changes (new data categories collected, new third-party processors) will be communicated via the disclaimer modal — you'll need to re-accept before continuing to use the app.

12. Contact

Email billy@builtbybilly.uk with any questions about this policy or to exercise any of your rights.