Academy policies
Privacy policy
Effective 1 October 2026
Simi Trading Academy ("the academy", "we") is a private, invitation-only trading-education academy run by one coach. This policy describes the personal data its members' platform holds and how it is handled.
What we hold about you
Only what the platform needs to give you access and to run the academy:
- Account: your name, email address, role, whether two-factor authentication is turned on, and when the account was created. Your password is stored only as a one-way hash; nobody, including the coach, can read it.
- Profile details you choose to add: timezone, phone number, Telegram handle and trading experience level.
- Membership: your access window, the groups (cohorts) you belong to and the courses you are enrolled in.
- Learning activity: your progress through lessons, which signals, announcements, files and notifications reached you and when you opened them, and which live sessions you were invited to.
- Security log: sign-ins, failed sign-in attempts, important account actions, and the IP address and browser identification (user agent) they came from.
- Private coach notes: the coach and assistants may keep notes about members to support their learning. They are never shown to you, never sent in a notification, and are not part of your data download.
- Email delivery records: whether an email we sent you was delivered, bounced or marked as spam — not its content.
What we do not collect
The platform takes no payments and holds no card or bank details. It loads no advertising, analytics or social-media trackers, sets no third-party cookies, and we do not sell or rent personal data.
How we use it
- To sign you in, keep your account secure and apply your access window.
- To show you the courses, signals, announcements, live sessions and files meant for you.
- To send account emails — your invitation, password-reset links, reminders before live sessions you are invited to, and a warning before your access ends — and to show the same reminders inside the platform.
- To protect the platform: rate limits on sign-in and other sensitive actions, and an append-only security log used to investigate misuse.
- To give the coach statistics about the academy — for example how many members are active and how far through a course they are. These are calculated inside the platform from its own database; percentages over very small groups are withheld so that one person cannot be singled out. The coach can also see an individual member's course progress.
Cookies
The platform sets only the cookies it needs to work:
- A session cookie that keeps you signed in (up to 30 days for members, 24 hours for staff), plus a short-lived copy of the session that avoids a database lookup on every page.
- A short-lived cookie that carries the two-factor step between your password and your code.
- A language cookie that remembers whether you chose English or Arabic, for one year.
Service providers
We use the following providers to run the platform. Each receives only what its job requires; not every provider is active on every deployment, and providers may process data in other countries under their own safeguards.
- Neon — database hosting. Stores all of the data described above.
- Vercel — application hosting. Handles every request to the site, including your IP address.
- Resend — email delivery. Receives your email address, your name where the message uses it, and the message itself.
- Cloudflare R2 — file storage. Holds the files the coach shares and, while it exists, your data-download archive.
- Mux — video hosting and streaming. Receives playback requests from your browser when you watch a lesson. The player runs with Mux Data analytics turned off and sets no Mux cookies.
- Have I Been Pwned (Pwned Passwords) — breach check. Receives the first five characters of a one-way hash of a new password, never the password or your email.
- Ably — live updates. Carries short notices that something new is available; the content itself is always fetched from the platform.
- Upstash — rate limiting. Holds counters keyed by hashed identifiers, never your email address in readable form.
- Trigger.dev — scheduled jobs such as reminders and clean-up. Processes the records those jobs act on.
How long we keep it
Your account and membership data are kept while you are a member and until an erasure request is carried out. Some records are removed automatically sooner:
- Password-reset links expire after 30 minutes; invitation links after 7 days.
- Closed invitations are deleted after 180 days.
- Notifications you have read are deleted after 90 days; unread ones after 365 days.
- Email delivery records are deleted after 180 days.
- Records of who opened a signal or announcement are deleted after 365 days.
- Live-session reminder records are deleted 90 days after the session; access-ending warning records after 365 days.
- Your data-download archive is deleted 7 days after it is generated.
- The security log is kept as evidence and is not deleted automatically. After an erasure it is kept in a form that no longer identifies you.
Your choices and rights
- Download your data: Settings → Your data produces a machine-readable copy of your record. It leaves out passwords and other credentials, private coach notes, other members' data, and IP addresses and user agents (which you can ask for directly).
- Ask for erasure: from the same page. A person reviews every request; nothing is deleted automatically, and the security log is kept in a form that no longer identifies you.
- Both remain available after your membership has ended.
- Correct your details: edit your name, timezone and contact details in Settings. Your email address cannot be changed in the platform — contact us to change it.
- End your sessions: Settings lists the browsers signed in to your account and can sign out all the others.
- If you are unhappy with how your data is handled, contact us first; you may also complain to your local data-protection authority.
Security
Passwords are hashed and passwords found in public breaches are refused. Coach and assistant accounts can add two-factor authentication. Every page and download re-checks your access when you request it, files are served through links that expire within minutes, and suspending an account signs it out everywhere immediately.
Changes to this policy
When this policy changes, the effective date above changes with it. Significant changes are announced inside the platform before they take effect.