Privacy

What we store, and why

This is the complete list. It is taken from the database tables the site actually uses.

Data	Why we hold it
Name	Shown on your dashboard, on the leaderboard and on a certificate. You choose it and can change it at any time. It does not have to be your legal name.
Email address	Your login, and how we reach you about the account. We do not send marketing.
Password	Stored only as a one-way hash, using PHP's password_hash. We cannot read it, recover it or tell you what it is.
Lesson progress and quiz scores	Which lessons you marked complete and what you scored, so progress survives logging out.
Simulated trades, positions, orders and balances	Your practice account. Fake money, real record, so you can review your own decisions.
Journal entries	The setup, thesis, outcome and lesson you wrote for each trade. Private to your account.
Watchlist and price alerts	The markets you follow and the levels you asked to be told about.
Your simulator settings	Practice balance, fee, risk per trade and leverage ceiling, so the site matches your plan.
Streak and experience points	The daily streak counter and XP shown on your dashboard.
Plan and its expiry	Which features your account can reach, plus a log of plan changes so billing questions can be answered.
Security records	The network (IP) address used when the account was created, the browsers that have logged in to it with the address they used, and a short log of failed logins, blocked sign-ups and refused uploads with the address they came from. Used only to protect accounts and to stop abuse.
Binance testnet key, if you link one	Held encrypted with AES-256-CBC. It controls fake testnet balances only. Delete it yourself from the testnet page whenever you like.

What we do not store

• No payment card details. We never see them.
• No identity documents. There is no verification process here.
• No wallet addresses, seed phrases or private keys. Never send us one, for any reason.
• No exchange API keys that can touch real money. The site has no way to use one.
• No browsing history from other sites, and no advertising profile.
• No precise location. Your rough country may be visible in server logs from your IP address, as it is on every website.

Cookies

One cookie, and it is not for tracking.

Name	Purpose	Lifetime
CTA_SESSION	Keeps you logged in and carries the form token that protects against cross-site request forgery.	Until you close the browser, or log out.

We also use your browser's local storage to remember whether you chose the light or the dark theme. That never leaves your device and we cannot read it.

Third parties

Your browser fetches market data and typefaces directly from the services below. That means those services can see your IP address, as they would for any site you visit. We send them nothing about you.

Service	What for
Binance public API	Live prices, candlesticks, order book and funding rates.
CoinGecko	Market capitalisation, rankings and coin logos.
alternative.me	The Fear and Greed index.
Google Fonts	The typefaces the pages are set in. Your browser downloads the font files from Google.

Our hosting provider processes requests on our behalf and keeps standard server logs. We use no analytics provider, no advertising network, no social media tracking and no content delivery network that profiles visitors.

Who can see your data

• You. Everything about your account is visible to you while logged in.
• Other users see only your display name, plan badge, experience points, streak and simulated equity, and only if the leaderboard is switched on. Your trades, journal, email and settings are never shown to anybody else.
• Administrators of this site can see account records in order to provide support, apply plans and deal with abuse. They cannot read your password. Every administrator action on an account is logged.
• Nobody else. We do not sell, rent or share personal data for marketing. We would disclose data if legally compelled, and we would tell you unless prevented from doing so.

How long we keep it

• Account data: while your account exists.
• After you ask for deletion: removed within 30 days, including simulated trades, journal entries, progress and any testnet key.
• Plan change records: kept for up to 24 months, so billing questions can be answered. These hold an account reference, not your content.
• Security records: a remembered browser is forgotten 180 days after its last login. The security log overwrites itself as it fills, normally within a few months.
• Server logs: kept by our host for a short period under their own policy.

Your rights

Wherever you live, we will honour these. Write to admin@mkpayz.com from your account email address and we will respond within 30 days.

Right	How to use it
See what we hold	Ask, and we send you a copy. You can also export your trades and journal yourself from the account page.
Correct it	Change your name and profile yourself. Ask us for anything else.
Delete it	Ask, and the account and everything attached to it is removed.
Take it elsewhere	Trades and journal entries export as CSV, which opens in any spreadsheet.
Object or restrict	Tell us what you object to and we will stop that processing or explain why we cannot.
Complain	Raise it with us first. You may also complain to the data protection authority in your country.

Security

• Passwords are stored as one-way hashes and are never recoverable.
• Pages are served over HTTPS, and the session cookie is marked secure and HTTP-only.
• Forms are protected against cross-site request forgery.
• Database queries use prepared statements, so submitted text cannot alter a query.
• A content security policy tells your browser to run scripts from this site only, so injected code does not run.
• Changing or resetting your password logs out every other browser that was using the account.
• Failed logins, sign-ups and password resets are rate limited, and administrators always need an emailed login code on a new browser.
• Profile photos are redrawn by the server before they are stored, so nothing hidden inside a file is kept.
• Stored testnet keys are encrypted at rest. If the server cannot encrypt, the site refuses to store the key at all rather than hold it weakly.

No site is perfectly secure. Use a unique password, ideally from a password manager, and if you suspect a problem tell us at once.

Children

This site is not intended for anybody under 18 and we do not knowingly create accounts for them. If you believe a minor has registered, tell us and we will remove the account.

Changes

If this page changes, the date at the top changes with it. Where a change materially affects how we handle your data, we will show a notice on the site.

Contact

Crypto Academy, admin@mkpayz.com.