Privacy Policy

The data controller (veri sorumlusu under KVKK) for Flick Trader is TODO: legal entity or individual name, of TODO: registered address TODO: tax office / registration number, if a registered company.

For anything in this policy, including the rights described in section 9, contact TODO: contact email address.

Account data. Sign-in is handled by Clerk, which is where your account record lives. Depending on how you sign up, that record holds:

• your email address;
• if you sign in with Google: the name, profile picture and email address on your Google account. We request only basic profile and email — never your Gmail, Drive, Contacts or Calendar;
• if you sign up with a password: a cryptographic hash of it, stored by Clerk. We never see the password itself;
• session and security metadata generated by Clerk, such as sign-in timestamps, IP address and device/browser information, used to keep you signed in and to detect abuse.

Inside the application we use almost none of it. The app reads whether you are signed in, and Clerk’s own account menu displays your name and picture. That is the extent of it.

Server logs. Our host, Vercel, records standard request logs for the pages and market-data proxy endpoints you load — IP address, timestamp, URL, user-agent. These are operational records used to keep the service running and to investigate abuse. We do not build profiles from them.

Stated plainly, because the absences are the point:

• No analytics or tracking. No Google Analytics, no Meta pixel, no PostHog, Mixpanel, Segment, Amplitude, Hotjar or session recording. No advertising cookies, no cross-site tracking, no fingerprinting. There is no such code in this application.
• No exchange API keys. Flick Trader does not connect to your exchange account. See section 4 for one exception you should know about.
• No funds and no orders. We hold no money or assets and place no orders. All trading in the product is simulated.
• No financial or identity documents. We ask for no bank details, card numbers, national ID or address. The service is free and there is no payment flow.
• Nothing sent to an AI provider. The two AI-assisted features are disabled in production behind a build-time flag and render a “coming soon” placeholder, so no content of yours reaches Anthropic or any other AI provider. If that ever changes, this policy will be updated before the feature is switched on.
• We sell nothing. We do not sell, rent or trade personal data, and we run no advertising.

Flick Trader has no application server and no database. The strategies you build, the paper bots you deploy, your watchlists and your journal entries are written to localStorage in the browser you used, under these keys:

Three consequences worth understanding before you rely on it:

• It does not sync. Work created on your laptop will not appear on your phone, or in a different browser on the same machine.
• Clearing your browser data deletes it. So does using private/incognito mode, and so can a browser reclaiming storage. There is no copy on our side to restore from — we cannot recover it, because we never had it.
• Anyone with access to your device can read it. It is stored unencrypted, like all browser storage.

It also means these are genuinely private: your strategies and journal entries are not readable by us, not backed up by us, and not disclosable by us to anyone.

All market data comes from free, public sources. How each one is reached matters for your privacy, so the table records it:

• Via our server. Your browser calls our own endpoint, and our server on Vercel calls the provider. The provider sees our server’s address, not yours.
• Direct from your browser. Your browser calls the provider itself, so the provider receives your IP address and user-agent, and its own privacy policy applies to that request.

We send these providers no information about you. The requests carry only what is needed to ask for a price: a ticker symbol, a currency pair, a date range.

These companies process data on our behalf so the service can operate:

If you choose “Sign in with Google”, Google also processes that sign-in under its own privacy policy.

A note on the fonts: the interface loads two typefaces from Google’s font CDN, which means your browser makes a request to Google carrying your IP address on every page load, whether or not you have an account. We consider this a defect rather than a feature — the fonts should be served from our own domain — and we intend to self-host them. Until we do, it is disclosed here rather than left unmentioned.

Flick Trader sets no analytics, advertising or preference cookies of its own. The only cookies are the session cookies set by Clerk when you sign in. They are strictly necessary: they are what keeps you signed in from one page to the next, and the service cannot offer an account without them.

Because we set no non-essential cookies, there is no consent banner to click. If you sign out, or clear cookies for this site, the session cookies are removed.

Separately from cookies, the app uses your browser’s localStorage for the content described in section 4. That is storage on your device, not a cookie, and none of it is transmitted to us.

For readers in Türkiye (KVKK art. 5) and in the EEA/UK (GDPR art. 6), the grounds are:

• Performance of a contract / necessity for the service. Account data and session cookies, without which we cannot give you an account.
• Legitimate interests. Server logs, used to keep the service available and to prevent abuse.
• Consent. Where you choose to sign in with Google and share your basic profile with us. You can withdraw it by deleting your account.

Under KVKK art. 11 you have the right to learn whether your personal data is processed and to request information about it; to learn its purpose and whether it is used consistently with that purpose; to know the third parties it is transferred to, in Türkiye or abroad; to have incomplete or inaccurate data corrected; to request erasure or destruction; to have corrections and erasures notified to third parties the data was transferred to; to object to a result produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.

If you are in the EEA or the UK, the GDPR gives you a broadly overlapping set: access, rectification, erasure, restriction, portability, objection, and the right to complain to your supervisory authority.

In practice, for this service:

• Access, correction and portability of your account data — your account is the email address, and optionally the name and picture, held by Clerk. You can view and change these in the account menu in the app.
• Erasure of your account — open the account menu, choose Manage account, and delete it. Deleting it removes the account record from Clerk.
• Erasure of everything you created — because it is stored in your browser rather than by us, you delete it yourself and the deletion is immediate and complete. Clear site data for this domain in your browser settings, or remove the four flick: keys listed in section 4. Note that deleting your account does not clear this, and clearing this does not delete your account — they are separate, because they live in different places.

To exercise any right that is not self-service, write to TODO: contact email address. We will respond within 30 days, the KVKK deadline. You also have the right to complain to the Turkish Personal Data Protection Authority (KVKK Kurumu).

• Account data — for as long as your account exists. Deleting the account deletes it.
• Session cookies — until they expire or you sign out.
• Server logs — kept for a short operational period by our host and then rotated out.
• Everything you create in the app — kept by your browser until you delete it. We have no retention period for it because we never hold a copy.

Our authentication provider and our host are established in the United States, and the market-data providers listed in section 5 operate from various countries. So personal data — principally your account record and standard request logs — is transferred outside Türkiye and outside the EEA.

Under KVKK art. 9, transfers abroad require an adequacy decision, an approved undertaking, or another lawful mechanism. Confirming which one applies is one of the items awaiting the legal review noted at the top of this page. TODO: confirm the KVKK art. 9 transfer mechanism with counsel

Flick Trader is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has an account, contact us at TODO: contact email address and we will delete it.

The service is served over HTTPS. Authentication, password storage and session management are handled by Clerk rather than built in-house. Our largest security property is structural rather than procedural: we operate no database of user content, so there is no store of strategies or journals to breach.

We hold no security certification and claim none. Flick Trader is not SOC 2 attested and not ISO 27001 certified. No online service can be guaranteed secure.

When this policy changes we update the date at the top of the page. If a change materially affects what we collect or who receives it, we will make that clear in the app rather than relying on a silent edit.

Questions about this policy, or a request under section 9: TODO: contact email address, addressed to TODO: legal entity or individual name at TODO: registered address.