Privacy policy

Climb From Zero is made and operated by Bitfuzed (PVT) LTD (“BitFuzed”, “we”, “us”). This policy covers the game on iPhone, iPad and Android, the desk (the same game in a web browser) and this website, and explains what we do with your information.

1. Your game

Everything you do in the game happens on our game server, which decides every price fill, so that a stop-loss can fill while your phone is off and your game is the same on every device. For each game the server keeps:

• a random player ID and the time the game was created and last played;
• the character name and gender you choose (the name can be anything; it doesn’t need to be yours);
• your progress: story scenes seen, chapters, lessons and quizzes finished, practice and history rounds and their results, missions, achievements, XP and level;
• your pretend trading: orders, positions, closed trades, the reason you write for each trade and what you expect from it, your journal notes, your trading rules and the note you add to them, the in-game items you buy, and the game’s pretend balances;
• your practice journal: the replay rounds you finish, with their chart, your drawings, your practice trades and the notes you write about them;
• the lines, zones and notes you draw on charts on the desk, Robin’s reviews of your trades, your best drill scores and which Library parts you’ve read;
• settings that change how the game plays.

We use this only to run the game for you.

2. Signing in

A new game starts as a guest. You can also sign in, which lets you get back to your game on a new phone and on your desk:

• Guest: the app keeps a random session token on your device. Our server keeps only a one-way fingerprint (hash) of it.
• Username and password: the username you pick, and your password stored only as a salted, one-way hash (PBKDF2). We can’t read your password.
• Google or Apple: handled by Firebase Authentication, a Google service, which keeps your account’s user ID, the sign-in provider and the email address and basic profile Google or Apple share. With Sign in with Apple you choose what Apple shares; if you pick Hide My Email, we get a private relay address from Apple. Our server keeps your Firebase user ID, the provider and that email address, linked to your game. We use the email only to show you which account your game uses and to answer you if you write to us.

Web (desk) sessions end after 30 days without use. Signing out ends the session on that device.

3. Climb Pro purchases

Climb Pro is sold and billed by the App Store or Google Play. We never see your name on the store account, your card or your payment details. When you buy or restore, the app sends our server the store’s proof of purchase: on iPhone and iPad, the App Store’s signed transaction, which the server checks with Apple’s own certificates; on Android, the Google Play purchase token, which the server checks with Google Play’s Developer API through our service on Google Cloud. For each purchase we keep: the store, the App Store transaction ID or a fingerprint of the Google Play purchase token together with the token (so we can check renewals and refunds), the plan, its expiry date, whether it’s in a free trial or set to renew, whether it’s a test purchase, and which game it belongs to.

Apple, and Google Play once set up, send our server notices when a subscription renews, ends or is refunded. A purchase belongs to one game at a time; it moves to another game only when you buy or tap Restore Purchases there.

4. Notifications

Reminders (today’s practice round, the weekly review, payday, an occasional nudge) are scheduled on your phone; nothing about them is sent to us. If you allow trade alerts, the app registers with Firebase Cloud Messaging, a Google service, and sends our server your device’s push token and whether it’s an iPhone or an Android phone. We keep up to five tokens per game and use them only to tell you when an order or a stop fills, or a story scene opens, while the app is closed. Turn alerts off in the game’s Settings → Reminders or in your phone’s settings; signing out or deleting your game removes the tokens.

5. Today’s round

Today’s practice round is the same for every player. When you finish it, we store your result (your percentage gain or loss, how many trades you made and whether every trade had a stop) with your player ID, so we can show how everyone did. Other players see only totals, such as how many played, the middle result and the share who used stops, never your name or your game.

6. How the game is doing

To find where the game is too hard or too slow, the server records game events with your player ID and the time: scenes and chapters reached, lessons finished, practice rounds played and restarts after going broke. They contain nothing you type. We don’t use any third-party analytics or crash-reporting service in the game. The only advertising identifier the app touches is the one described in section 8 (Android only, and only while “Share installs with Meta” is on).

7. Robin’s reviews

Robin’s reviews are written by AI. When you ask Robin to review a closed trade (live or practice), or to look at your habits, our server sends Google’s Gemini API the facts the game measured about those trades: prices, your stop and target, your size and risk, how long you held, the support and resistance levels before you entered, your own trading rules, the words you wrote as the trade’s reason, what you expected and your notes, and your character’s name. It doesn’t send your email, your sign-in or your player ID, and it’s only sent when you ask. Google processes it to write the review for us, and the review is kept with the trade in your game.

8. Measuring our ads (Meta)

We advertise Climb From Zero on Facebook and Instagram. To learn which ads bring players in, the iPhone and Android apps include Meta’s app events SDK, run by Meta Platforms. It sends Meta:

• that the app was installed and opened;
• Climb Pro purchases and free trials (the plan, price and currency, from the App Store or Google Play);
• device details such as the model, operating system, app version, language and IP address, and on Android your device’s advertising ID.

It never sends anything from your game: no balance, trades, orders, rules, notes, lessons or Robin’s reviews, and no name, player ID, username, email or sign-in. On iPhone and iPad the app never asks to track you and doesn’t collect the advertising identifier (IDFA); Meta counts installs through Apple’s SKAdNetwork, which doesn’t identify you. The desk (the web game) and test builds send nothing.

You can turn this off at any time in You → Settings → “Share installs with Meta”; from then on the app sends Meta nothing. On Android you can also reset or delete your advertising ID in your device’s settings. Meta uses this information under its own privacy policy (https://www.facebook.com/privacy/policy/), which includes using it to measure and improve ads.

9. Technical information

• IP address. Our game server runs on Cloudflare, which receives the IP address of every request, as any website does. We store IP addresses only in short-lived counters that stop abuse (too many new games or sign-in attempts) and delete those counters within a day. We don’t keep request logs.
• Live prices. To show live prices, the app and the desk connect to Binance’s public market-data service (data-stream.binance.vision). Binance receives your IP address as part of that connection, but nothing about you or your game, and you don’t need a Binance account. Price history comes through our server.
• The desk. The desk keeps your session token in your browser’s local storage. Like other Flutter web apps, it may load parts of its graphics engine and fonts from Google’s servers (gstatic.com), which receive your IP address.
• On your device. Sound, reminder and display settings, which tours you’ve seen and your place in a Library book are stored only on your device. The home-screen widget, and on iPhone the Apple Watch app, show a short summary of your game (chapter, money, open trades, the next task): it’s kept on your phone for the widget and sent to your own watch over Apple’s watch connection, nowhere else.

10. This website

This website is hosted on Firebase Hosting, a Google service, which receives your IP address to serve the pages. It uses no cookies, no analytics and no tracking.

11. If you contact us

If you write to us, we keep your email address and message to answer you and to help with similar questions.

12. What we don’t do

• No ads in the game. The app never asks to track you on iPhone, and nothing from your game is shared with advertisers: the only thing Meta receives is described in section 8, and you can turn it off.
• We don’t sell or rent your information.
• No real money: the game never connects to a bank, a broker, an exchange or a crypto wallet, and nothing in it is financial advice.

13. Who processes your information for us

They process information only to provide these services to us. Your information may therefore be processed outside the country where you live, under the safeguards these providers offer (such as the European Commission’s standard contractual clauses).

14. Why we use your information (legal bases)

Where laws such as the EU and UK GDPR apply: we run your game, your sign-in and your purchases because you asked us to (performance of a contract); we prevent abuse, keep the service secure and improve the game from game events because we have a legitimate interest in doing so; we measure our ads with Meta (section 8) because we have a legitimate interest in knowing which ads work, and you can object at any time with the Settings switch; we send trade alerts because you turned them on (consent, which you can withdraw at any time); and we keep purchase records as the law requires.

15. How long we keep it

• Your game, its sign-in links, purchase records, today’s-round results and game events: until you delete your game.
• Rate-limit counters with IP addresses: less than a day.
• Web sessions: 30 days without use; app sessions: until you sign out.
• Backups of our database are kept for up to 30 days, then overwritten.

A guest game has no email or login attached. If you uninstall the app without signing in, we can no longer connect that game to you; it holds only the character name you chose and your pretend trading.

16. Deleting your game

In the game, open You → Settings → Delete account. If your game uses Google or Apple, you’ll confirm with that account first. We delete your game (with its drawings and Robin’s reviews), its sign-in link, purchase records, push tokens, today’s-round results and game events straight away, and the Firebase sign-in account too; with Apple, the app also gives back its access to your Apple Account. See how to delete your account, including by email. Deleting doesn’t cancel a Climb Pro subscription: cancel it in your App Store or Google Play account.

17. Children

Climb From Zero is meant for adults aged 18 and over. We don’t knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, write to us and we’ll delete it.

18. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your information, to object to or restrict how we use it, and to withdraw consent. Write to contact@bitfuzed.com and we’ll answer within 30 days. You can also complain to your local data protection authority. We don’t sell personal information. Sending app opens, purchases and (on Android) the advertising ID to Meta to measure our ads may count as “sharing” for cross-context behavioral advertising under California law; you can opt out at any time with the “Share installs with Meta” switch in Settings.

19. Security

Everything travels over encrypted connections. Passwords and session tokens are stored only as one-way hashes, purchase tokens stay on our server, and access to our systems is limited to the people who run the game.

20. Changes

If this policy changes, we’ll update the date above and, for significant changes, tell you in the game before they take effect.

21. Contact

Bitfuzed (PVT) LTD · contact@bitfuzed.com