Effective: 3 May 2026 · Last updated: 3 August 2026

Privacy Policy

Scope. This policy covers both the TradeRange website at traderange.net and the TradeRange apps distributed through the Google Play Store, the Apple App Store, and as a direct-download Android APK. Each app is a bundled version of the same website and follows the same practices described here, connecting to the same API (api.traderange.net). Points that are specific to the app are collected in Section 7.

Who operates and who distributes TradeRange. The TradeRange service — the website, the API at api.traderange.net, and the account, settings, and gameplay data described in this policy — is operated by the TradeRange maintainers under the tradely.dev community. Distribution of our applications and our advertising is handled by Eyether LTD, a company registered in the United Kingdom (Companies House company number 17357962). Eyether LTD is an independent partner and a separate legal entity from the TradeRange operators: it publishes and distributes the TradeRange apps through the Google Play Store and the Apple App Store, provides the direct-download Android APK, and administers the Google advertising associated with TradeRange, and it has access to our Google Analytics. Eyether LTD does not operate the service and is not given your OAuth identifiers, session credentials, or access to our core account and gameplay databases. Where Eyether LTD processes personal data in carrying out these distribution, advertising, and analytics functions, it does so as a separate, independent data controller under its own privacy obligations (see Section 6). Except where Eyether LTD is named expressly, the terms “we,” “us,” and “TradeRange” in this policy mean the TradeRange operators.

1. What We Collect

Discord + Google OAuth2 identifiers (pseudonymous) – When you log in using Discord or Google, we receive and store only the minimum identifiers needed to recognise you across sessions. For Discord: Discord ID, username, and avatar URL. For Google (OAuth 2.0): Google ID (sub), public profile name, and profile picture. We explicitly do NOT request or store your email address, phone number, real name, birthday, or any other personal data from Google. The email scope is never requested; if Google provides email by default in the ID token, we discard it immediately and do not write it to disk or logs. Your Google ID acts as a pseudonymous key, exactly like Discord ID.

Cookies and localStorage – Essential browser storage: we store a session token (expires after 30 days) and a CSRF protection token. No third-party tracking cookies are placed without explicit consent. These mechanisms are strictly necessary for authentication and game functionality.

Google Analytics (optional, consent-based) – Only after you accept the cookie consent banner, we load Google Analytics 4 (GA4). GA4 collects anonymised usage data (page visits, time on site, game interaction events). No Discord ID, Google ID, or any OAuth identifier is ever sent to Google. Our distribution and advertising partner Eyether LTD also has access to this Google Analytics data in its own right (see the Scope note above and Section 6); the data remains anonymised and carries no OAuth identifier. You may reject the banner, and GA will never load or transmit data. Withdraw consent: on the website, open Settings → Ads & analytics (from your profile) to change or fully withdraw your analytics and advertising consent at any time, or use the “Show the consent banner again” reset there. Clearing your browser cookies and localStorage also resets your preference and re-shows the banner.

Advertising (Google AdSense — website only) – The TradeRange website displays advertisements served by Google AdSense to keep TradeRange free and fund its continued development. To do this, Google and its advertising partners use cookies, device identifiers, and similar technologies, and may collect information such as your IP address, approximate location, browser and device characteristics, the pages you view, and your interactions with ads. Depending on your consent choice, ads may be personalised (based on this data and your prior activity) or non-personalised (based only on general context such as the page content and coarse location). We do not share your Discord ID, Google ID, username, or gameplay records with Google for advertising. Details, the legal basis, and how to opt out are in Section 6. The apps show no third-party ads — AdSense is not loaded inside the Android or the iOS app.

Operational logs (security & anti-abuse) – We log every core interaction: games played, answers submitted, leaderboard updates, API calls, page visits, button clicks, and any content you interact with. Each log entry includes timestamp, your OAuth identifier (Discord ID or Google ID), IP address (hashed after 24h for privacy, but retained raw for 7 days to detect attacks), browser fingerprint (user agent, accept-language, viewport). These logs are essential to detect cheating, brute force, scraping, and to maintain fair play. After 90 days, raw logs are automatically destroyed.

Data stored on your device (app) – The app — on both Android and iOS — additionally keeps data locally on your device for offline use and preferences: a cache of already-viewed articles and images; articles you explicitly download for offline reading (a complete copy of the article — its text, images, and the market data behind its charts — kept on your device for up to 7 days and then cleared automatically); your cookie-consent choice; and your notification settings. This stays on your device, is not transmitted to us as a separate collection, and is removed when you uninstall the app or clear its storage. See Section 7.

Device push token (app, optional) – If you enable notifications in the app, we collect and store a push notification token issued for your device/install by the push notification service used to deliver them, solely to send you the notifications you asked for. It is a pseudonymous device identifier, is not linked to your real-world identity, and is deleted when you disable notifications or uninstall the app.

No sensitive information – TradeRange never collects payment info, real addresses, government IDs, or any sensitive personal data. We do not collect device location, contacts, camera, microphone, or file access — the app does not request those permissions. Your OAuth identifiers are treated as pseudonymous and are not linked to your real-world identity within our systems.

2. How We Use & Protect Information

Operate the leaderboard, persist game progress, and personalise your session.
Detect and block automated scripts, multiple-account abuse, and score manipulation using heuristic analysis on logged actions.
Debug performance, improve game designs, and understand aggregate usage (with anonymized analytics only after consent).
Enforce Terms of Service (e.g., suspend accounts that violate fair play or API abuse).
Security protections: All data transmitted via TLS 1.3 (HTTPS). Logs are stored on encrypted volumes with access restricted to two core maintainers. API endpoints implement strict rate limiting, brute-force protection, and request signing where appropriate. No OAuth tokens are retained after session termination; we store only the opaque reference to your Discord/Google ID, not the access tokens themselves.

Advertising supports the free service. TradeRange is provided free of charge and is funded in part by advertising. We do not share your OAuth ID (Discord ID or Google ID), username, or gameplay logs with advertisers or data brokers. However, to show ads, our advertising partner (Google) and the vendors it works with set cookies and process device and usage data as described in Sections 1 and 6. Under some privacy laws (for example, the California CPRA), enabling interest-based advertising may be considered a “sale” or “sharing” of personal information. You control this: declining our consent banner (or opting out through the Google controls linked in Section 6) limits ads to non-personalised. Separately, we may disclose information (a) as required by law; (b) to protect the rights, safety, or property of TradeRange and its users; or (c) with your explicit consent.

3. Google OAuth & Limited Use Disclosure

TradeRange offers “Sign in with Google” solely for authentication and identification. Our usage of Google OAuth 2.0 adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We request only the profile scope (Google ID, name, profile picture). No email, Google Drive, Calendar, Contacts, or any other scope is requested.
Google user data (your Google ID, public profile info) is never transferred to third parties, used for advertising, or stored longer than necessary.
You can revoke TradeRange’s access to your Google account at any time via your Google Account permissions page. Revocation will prevent future sign-ins, but your existing gameplay data remains associated with the Google ID; to delete that data completely, please request deletion as described in Section 11.
We DO NOT combine Google authentication data with any external database for targeting or enrichment.

If you log in with both Discord and Google using separate sessions, they are treated as distinct accounts (no merging is performed unless you explicitly request help from maintainers).

4. Your OAuth Identifier Is Your Account Key

Your Discord ID or Google ID is the sole binding key to your TradeRange account: it ties together scores, settings, and history. If you delete your Discord/Google account or permanently lose access, you will not be able to recover your TradeRange progress unless you can re-authenticate with the exact same identifier. We strongly recommend linking a backup method (contact maintainers) – but due to pseudonymous design, no password recovery exists.

5. Cookies, Local Storage & Consent Banner (Enhanced Transparency)

Strictly necessary storage: a session token (localStorage) and CSRF cookie. These do not require consent because the service cannot function without them.

Consent banner (analytics & advertising): On first visit, the website asks whether you allow analytics and personalised advertising. Your choice is recorded (localStorage key tr_analytics_consent) and applied via Google Consent Mode. If you accept, we load Google Analytics 4 and allow personalised ads. If you decline, no analytics scripts load and no analytics data is sent; ads may still appear on the website but are limited to non-personalised ones. You may change or withdraw your choice at any time from Settings → Ads & analytics on the website (separate toggles for personalised ads and for analytics, plus a button to re-open the banner); clearing your browser cookies and localStorage also resets it, and an administrator can re-prompt everyone. Essential OAuth session storage remains until expiry (30 days) unless you manually log out. Ad and analytics cookies set by Google are governed by Google’s policies and expire per Google’s retention.

Advertising cookies: When ads are shown, Google and its partners may place cookies/identifiers on your device to measure performance, cap frequency, and (with consent) personalise ads. You can manage these through the controls listed in Section 6.

Do Not Track (DNT): We respect browser DNT signals: if DNT is enabled, our consent banner defaults to declining, so we do not load GA4 and ads stay non-personalised even without explicit interaction – you can still manually accept if desired.

6. Third-Party Services & Infrastructure

Google AdSense (advertising — website only) – We use Google AdSense to display ads on the TradeRange website, which helps keep the service free and fund future development. When you visit a page that contains an ad slot, Google — acting as an independent third party under its own Advertising and Privacy policies — and its ad-technology partners may set and read cookies and similar identifiers and process data such as your IP address, approximate (non-precise) location, device and browser information, and ad interactions.

Personalised vs non-personalised ads. If you accept our consent banner, ads may be personalised using the data above and your prior activity. If you decline (or are in a region where we do not have consent), we instruct Google to serve non-personalised ads, which rely only on general context like the current page and coarse location. We implement Google Consent Mode so your choice is passed to Google automatically.
Legal basis. In the EEA/UK, personalised advertising and non-essential ad cookies are used only with your consent (GDPR Art. 6(1)(a)); you may withdraw consent at any time (see below). Elsewhere, advertising supports our legitimate interest in funding a free service, subject to your opt-out choices.
What we do not share. We never provide Google or advertisers with your Discord ID, Google ID, username, email (we hold none), or your gameplay/leaderboard records for ad targeting.
Your controls & opt-out. You can decline our banner or toggle personalised ads off under Settings → Ads & analytics; manage or turn off ad personalisation in your Google Ad Center / Ads Settings; opt out of third-party vendor cookies at aboutads.info/choices and youronlinechoices.eu; and see Google’s list of ad-technology providers here. Administrators can also disable ads platform-wide.
App exclusion. The TradeRange apps (both Android and iOS) do not load AdSense or show third-party ads; this section applies to the website only.

Cloudflare (network proxy & CDN) – All traffic to traderange.net passes through Cloudflare’s reverse proxy and CDN network before reaching our servers. This means Cloudflare processes every HTTP request you make, including your IP address, request headers, and response metadata, in order to provide DDoS mitigation, TLS termination, and caching. Cloudflare operates under its own Privacy Policy. We do not control what Cloudflare logs or retains at the network layer. We encourage you to review Cloudflare’s policies if you have concerns about edge-network data handling.

YouTube video embeds – The Learn & Analysis section of TradeRange may embed YouTube videos directly in article content. When a page containing an embedded video loads, YouTube (Google) may set cookies and collect data about your visit — including your IP address and viewing behaviour — even if you do not click play. This occurs under Google’s Privacy Policy. We use standard YouTube embed URLs; we do not use YouTube’s enhanced privacy mode in all cases. If you wish to prevent YouTube tracking, you can use browser extensions that block third-party embeds, or avoid articles that contain video content.

Financial data APIs (Binance, CoinGecko, etc.) – TradeRange games rely on real-time or historical market data from external public APIs. When you play a game that shows stock/crypto prices, your browser may directly request data from providers such as Binance, CoinGecko, or other public endpoints. This means:

Your IP address and standard HTTP metadata (user-agent, referrer) may be exposed to those third-party APIs.
We never share your Discord ID, Google ID, username, or any TradeRange account data with these financial APIs.
Each API call is required for the game to function; no personal identifier is appended to the request.
We encourage you to review privacy policies of third-party financial APIs (Binance Privacy, CoinGecko Privacy).

If you prefer not to expose your IP to these external services, please refrain from using games that fetch live market data (most of TradeRange’s games).

Eyether LTD (app distribution & advertising partner) – Eyether LTD, a company registered in the United Kingdom (Companies House company number 17357962), is an independent partner — a separate legal entity from the TradeRange operators — responsible for distributing the TradeRange applications and administering our advertising. Specifically, Eyether LTD publishes and distributes the app through the Google Play Store and the Apple App Store (holding the associated developer/publisher accounts), provides the direct-download Android APK, and manages the Google advertising connected with TradeRange, and it has access to our Google Analytics property. In performing these functions Eyether LTD may process limited personal data — such as the store, advertising, and aggregated analytics data those platforms make available to a distributor — as an independent data controller under its own privacy obligations; the underlying store, advertising, and analytics processing carried out by Google and Apple remains governed by their respective privacy policies referenced in this section. Eyether LTD does not operate the TradeRange service and is not given access to your OAuth identifiers, session credentials, or our core account and gameplay databases. For privacy questions that concern distribution, advertising, or analytics specifically, you may contact us using the details in Section 14 and we will coordinate with Eyether LTD as needed.

Google Play (Android app distribution) – The TradeRange Android app is distributed through the Google Play Store (published by our distribution partner Eyether LTD, described above). Downloading, installing, and updating the app is handled by Google Play under Google’s Privacy Policy. We do not receive your Google Play account details; we only receive the pseudonymous OAuth identifier described above if you choose to sign in.

Apple App Store (iOS app distribution) – The TradeRange iOS app is distributed through the Apple App Store (published by our distribution partner Eyether LTD, described above). Downloading, installing, and updating the app is handled by Apple under Apple’s Privacy Policy. We do not receive your Apple ID or App Store account details; we only receive the pseudonymous OAuth identifier described above if you choose to sign in.

Push notification delivery – If you enable notifications in the app, we use a push notification service to deliver them. On Android this is carried over the operating system’s messaging service (operated by Google); on iOS it is carried over the Apple Push Notification service (APNs) (operated by Apple). We may also use a third-party push provider to send messages on our behalf. The provider we use may change over time. Whichever service is used issues a per-install device token and relays the messages we send to your device, under its own privacy terms. We share only the push token and the notification content with that service — never your OAuth identifier, gameplay data, or any other account information.

7. Mobile App: On-Device Storage, Notifications & Permissions

The TradeRange apps for Android and iOS are bundled versions of the website and follow the same data practices as the rest of this policy, with the app-specific additions noted below. Except where a point is called out as platform-specific, these apply to both platforms:

On-device storage. To support offline use, the app keeps a local cache on your device of its interface and of content you have already opened (articles and their images), plus small preference values (your cookie-consent choice and notification settings). This data stays on your device, is not sent to us as a separate collection, and is cleared when you uninstall the app or clear its storage.
Downloaded articles (offline reading). When you tap Download on an article, the app saves a complete offline copy of it on your device — the article’s text, its images, and the market data behind its price charts — in the app’s local database, so you can read it fully without a connection. These downloads are limited in number and each one auto-clears about 7 days after you save it; you can also remove a saved article at any time from within the app. This content stays on your device, is not sent to us as a separate collection, and is cleared when you uninstall the app or clear its storage. Re-opening a downloaded article while online fetches the latest version over the network as usual.
Notifications. If you allow it, the app can show you notifications — both reminders scheduled on your device (for example, the daily-reset reminder) and push notifications we send from our servers (for example, announcements or new content). To deliver push notifications we register your device with a push notification service — this is the platform’s messaging service (Google’s on Android, Apple’s APNs on iOS) and may involve a third-party push provider we use to send messages — and store the resulting device push token so we can reach your device. The token is a pseudonymous per-install identifier, is not linked to your real-world identity, and is removed when you disable notifications or uninstall the app. Both Android and iOS ask for your permission before any notification is shown, and you can turn notifications off in the app’s Settings or in your device settings.
App updates (Android direct-download version only). The Google Play and Apple App Store builds are updated through their respective stores; the iOS app has no self-update mechanism and no direct-download version. Only the Android build downloaded directly from traderange.net (rather than Google Play) keeps itself up to date. It periodically asks our servers for the latest published build; that request sends only the app’s installed version number and the standard request metadata described elsewhere in this policy — no additional personal data. If you choose to update, the new signed APK is downloaded from our servers over HTTPS through Android’s download manager and installed by the system installer with your explicit confirmation. Updates are never silent: installing them relies on Android’s “install unknown apps” permission, which you grant to the app and can revoke at any time in your device settings. We keep an aggregate count of how many times each build is downloaded; this number is not linked to you or your account.
Permissions. The app requests only network access and, optionally, permission to post notifications. It does not request location, contacts, camera, microphone, or file access.
In-app browser. Sign-in and external links open in a secure system in-app browser (a Custom Tab on Android, a Safari-based view / SFSafariViewController on iOS). Pages you open there are subject to their own privacy policies, and sign-in is subject to Discord’s or Google’s policies.

8. Data Retention & Deletion Improvements

Log retention: Full interaction logs (including IP addresses and OAuth identifiers) are kept for a maximum of 90 days. After 90 days, raw logs are permanently deleted. Aggregated, non-identifiable statistics (e.g., “daily active players”) may be retained indefinitely for platform analytics without any user-specific details.

Gameplay data (scores, leaderboard entries): Stored until you request deletion. When you request account deletion, we will remove your OAuth identifier, all scores, game history, and associated metadata within 30 days. Anonymised leaderboard entries (without identifier) may remain for historical integrity but will not be linkable to you.

Google Analytics data (if consented): Retained in accordance with GA4’s default 14-month retention period. No OAuth identifiers are included. You may also request deletion of your GA4 event data by clearing consent (clearing cookies) and contacting us, but GA4 data is aggregated and not personally attributable.

9. Your Privacy Controls

TradeRange provides the following privacy controls, accessible from your profile page (labelled Settings in the app):

Hide profile picture: Your avatar will not appear on leaderboards, public profiles, or anywhere else on the site. It remains stored on our servers (sourced from Discord/Google) but is not displayed publicly.
Anonymous mode: Your username is replaced with anon on all leaderboards and public views. Your scores are still counted and contribute to game statistics, but cannot be linked to your identity by other users. You can disable anonymous mode at any time to restore your visible username.
Account deletion (14-day grace period): You may delete your account from your profile page. When you confirm, your account is immediately frozen – it becomes unusable, is hidden from leaderboards and public profiles, and all sessions on other devices are signed out – and a 14-day countdown to permanent deletion begins. During those 14 days you may restore your account at any time simply by signing in again and selecting “Restore my account”, which fully reactivates it with your data intact. If you do not restore it, then when the countdown ends your account and all associated data (OAuth identifier, avatar, scores, gameplay records, portfolios, sessions, and settings) are permanently and irreversibly deleted from our systems by an automated process. This deletion cannot be undone once the grace period has elapsed.

Discord server opt-out: Server administrators may use the /opt-out bot command to hide their server from the public TradeRange server directory. The bot remains active in the server; only the public listing is affected. To reverse an opt-out, server administrators must contact TradeRange maintainers via the tradely.dev server.

10. Improved Protections Against Abuse & Data Minimisation

Data minimisation by design: We never collect email addresses, even if Google provides them via ID token (we discard). No “forgot password” or marketing lists.
IP masking: In analytics and long-term logs, IP addresses are hashed after 7 days using a salted SHA-256 to prevent reconstruction while still allowing abuse detection.
Rate limiting and anomaly detection: Our API tracks request patterns per OAuth identifier and IP. Suspicious behaviours (automated score submission, extreme request rates) trigger temporary blocks and manual review.
Access controls: Only two core maintainers have access to production logs and databases. All access is audited and logged. We use environment-specific secrets and never hardcode tokens.
Incident response: In case of a data breach, we will notify affected users via Discord announcements / email on file (if any) and provide a public disclosure within 72 hours where legally required.

11. Your Rights (GDPR / CCPA Aligned)

Because we intentionally collect no real-world personal data (only pseudonymous OAuth identifiers and gameplay logs), traditional access/correction rights have limited scope. However, we fully honour:

Right to deletion: Email [email protected] from any address or contact a maintainer on our Discord (tradely.dev). We will delete your OAuth ID and all associated gameplay data within 30 days. Confirmation provided.
Right to object / restrict processing: You may stop using TradeRange at any time. Request that we cease processing your new logs (only possible by account deletion). You may also object to analytics by rejecting the consent banner.
Right to withdraw consent (analytics & ads): On the website, use Settings → Ads & analytics to change or withdraw your analytics and advertising consent independently, or reset it there to re-show the banner. Clearing browser cookies and localStorage also brings the banner back.
Right to opt out of personalised advertising / “sale” or “sharing”: Decline the consent banner to keep ads non-personalised, and/or use the Google and industry opt-out controls in Section 6 (Google Ads Settings, aboutads.info, youronlinechoices.eu). California residents may treat this as a request to opt out of the “sale”/“sharing” of personal information for cross-context behavioural advertising.
Right to data portability: Since we store only scores and game metadata, we can export your leaderboard history and settings as a JSON file upon request. Email us.
Right to lodge a complaint: Supervisory authority (e.g., ICO for UK or local DPA). We will assist.

12. Children Under 13

TradeRange is not directed at children under 13. We do not knowingly collect information from children. If we discover that a user under 13 has logged in via Discord or Google, we will immediately delete all associated data. Discord and Google also enforce age restrictions; you must comply with their policies.

13. Changes to This Privacy Policy

We may update this policy to reflect new features, legal requirements, or enhanced protections. Material changes will be announced on our Discord server (tradely.dev) and via a prominent notice on the TradeRange website. Continued use after the effective date constitutes acceptance. We archive previous versions and make them available upon request.

14. Contact & Data Protection Inquiries

TradeRange is maintained by volunteers under the tradely.dev community. For privacy questions, data requests, or security reports:

Discord: discord.tradely.dev (preferred for quick responses)
Email: [email protected] (for formal requests, deletion, or GDPR/CCPA inquiries)
Mail (legal correspondence): available via email request

Our game website is traderange.net – all legal coordination and project governance operate under tradely.dev. We respond to all privacy requests within 15 business days.