Privacy Policy

Last updated: 20 May 2026

Trade with Shafy (“we”, “us”, “our”) operates the website tradewithshaffy.com and the “Trade with Shafy” mobile application (the “Service”). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect only the information needed to provide you with the Service. The categories are:

• Account data: full name, email address, phone number, country, username, password (stored hashed using bcrypt), payment method preference, and an optional social handle — collected when you register.
• Auth tokens: short-lived (15 minutes) JWT access tokens and long-lived (30 days) opaque refresh tokens are issued to authenticate your sessions on the mobile app. Refresh tokens are stored only as a SHA-256 hash on our servers.
• Device tokens: when you grant notification permission, we store the Expo push token for your device so we can deliver new-signal alerts and admin notifications.
• Payment requests: name, email, phone, country, the selected plan, your chosen payment method, and any transaction note you submit when ordering a plan. We do not handle or store credit card numbers — all payment processing is done outside the platform (bank transfer, USDT, etc.).
• Activity data: course progress, certificates earned, community posts, comments, reactions, reviews you submit, and affiliate-related records (sales, commissions, withdrawal requests) tied to your account.
• Technical data: IP address and basic request headers, used solely for rate-limiting and abuse prevention. We do not run third-party analytics or advertising trackers.

2. How We Use Your Information

We use the information we collect to:

• Authenticate you and keep you signed in on the web and mobile app.
• Provide access to courses, signals, community posts and the affiliate dashboard.
• Process plan orders and affiliate commission payouts.
• Send you push notifications for new signals, live sessions, withdrawal updates and other account-related events (only after you grant permission).
• Prevent fraud and abuse (rate-limiting, credential stuffing detection).
• Communicate with you about important updates or in response to your support requests.

3. How We Share Your Information

We do not sell your personal information. We share data only with the limited third parties needed to operate the Service:

• Neon (PostgreSQL hosting) — stores account, content and activity data.
• Vercel — hosts the web application.
• Expo Push Service — receives your push token and the notification payload (title + short message) so it can deliver alerts to your device.
• Google Play Console / Apple App Store — for crash reports and download analytics aggregated by the store itself; we do not transmit personal data to them beyond what they collect automatically as the app distribution platform.

We may also disclose information if required by law or in response to a valid legal request.

4. Data Security

We take security seriously. Passwords are hashed with bcrypt (cost factor 12). Refresh tokens are stored only as SHA-256 hashes. All traffic to and from the Service is encrypted in transit over HTTPS/TLS. On the mobile app, your access and refresh tokens are stored in the operating system's secure storage (Keychain on iOS, Keystore on Android) via expo-secure-store.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

5. Push Notifications

On first use, the mobile app will ask for permission to send push notifications. If you grant permission, we store your Expo push token and use it to send alerts about new signals, signal closures, live sessions, withdrawal status changes and other relevant account events.

You can revoke notification permission at any time via your device's system settings; the app will continue to function without notifications.

6. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated personal data.
• Withdraw consent for processing where consent was the legal basis.
• Opt out of push notifications (via device settings).
• Export a copy of your data in a machine-readable format.

To exercise any of these rights, contact us at shafqatrafique45978@gmail.com from the email registered with your account. We respond within 30 days.

7. Account Deletion

To delete your account and all associated personal information, email shafqatrafique45978@gmail.com from your registered email address with the subject “Delete my account”. We will permanently delete your account, profile data, course progress, community posts, and affiliate records within 30 days. Records we are legally required to retain (e.g. financial transaction logs for tax compliance) may be kept in an anonymised form.

8. Children's Privacy

The Service is not intended for users under 18 years of age. Forex trading is a high-risk financial activity restricted to adults. We do not knowingly collect personal information from children. If you are a parent and become aware that your child has provided us with personal information, please contact us so we can delete it.

9. Trading Risk Disclaimer

Trade with Shafy provides educational content, market analysis and trading signals for informational purposes only. We are not licensed financial advisors. Trading Forex and other financial instruments carries a high level of risk and may not be suitable for all investors. Past performance is not indicative of future results. You should never invest money you cannot afford to lose, and you should consult a licensed financial professional before making any investment decision.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page and, where appropriate, by an in-app or email notice. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy or our handling of your data, please contact: