ChartQuest privacy notice

1. Who we are

ChartQuest is a practice environment for trading. You practise with Quest on real historical prices, test your strategy in the Backtest and see your results in Statistics. You never trade with real money in ChartQuest.

You use ChartQuest through the website chart-quest.com and the web app app.chart-quest.com. This notice covers both.

Crypto Universiteit (the Starter Class and the Master Class) and GripOS (our customer contact system, which holds our customer database) belong to the same company. Where we write "our customer database" below, we mean the customer database of Crypto Universiteit in GripOS.

2. In short

• We never sell your data.
• You enter payment details at Stripe, not with us.
• No advertising cookies, no advertising pixels, no analytics company.
• You can view your data and have it corrected or deleted.
• We link your account to our customer database using your email address.
• We measure in-house which screens you see and what you click. You can turn this off in your profile.

3. What data we process

• AccountWhat exactlyemail address, password (stored only in encrypted form), username, avatar, language and countryFromyou
• LoginWhat exactlywhen you signed up, confirmed your email address and logged in; while a session is active, your IP address and the type of browser or deviceFromyour device
• OnboardingWhat exactlyyour answers: how long you have been trading, your trading results in broad ranges (loss, break-even, up to 10,000, more than 10,000, not yet), your main reason, your choice and its outcome in the trial trade, your language. When you reach the Quest Passport, we send them to our server, still without a name or email address; if you do not create an account, we delete them within 2 hoursFromyou
• How you found usWhat exactlythe source you choose yourself (for example YouTube, Instagram or Benjamin), if you choose Benjamin, where you follow him, and if you choose "something else", your own short explanation; the UTM values of the link you arrived through, the domain name of the website you came from and the first page, for your first and your last visit before you signed upFromyou and your device
• GameplayWhat exactlyyour trades in Quest (market, direction, entry, stop, target, outcome, R and the points in time on the chart) and in the Backtest (also amount, timeframe and the name you give a backtest), your runs, crowns and MANA, and the statistics that follow from themFromyour use
• ChatWhat exactlyyour messages, the room and the time, with your name and avatarFromyou
• UsageWhat exactlyin the app: which invitations and buttons you saw, which steps you took, what you clicked, what you chose, how long something was on screen and how far you watched a video. Along with the context of that moment: your stage (1 to 4), the offer you saw, your answer to "What went wrong?", your MANA balance and losing streak, for a backtest your number of trades and your result in R, and whether you use the website or the app. Before you have an account: which onboarding screens you saw and a few moments during sign-up (such as "account created", or for a failed attempt only the type of error), with random codes and the UTM values of your linkFromyour device
• SubscriptionWhat exactlyyour customer number and subscription number at Stripe, the status and the end of your billing periodFromStripe
• OKXWhat exactlyyour OKX UID, when you linked your account, and from OKX: your sign-up date, your verification date and the code you signed up with; the result of the nightly check (when OKX last confirmed your link and, if it did not, how many times and since when); a history of linking and unlinking, kept for 90 daysFromyou and OKX
• Membership and contactWhat exactlywhether you are in the Starter Class and since when we know, whether you are in the Master Class and until when, whether you were already a member when you signed up, your first name, last name and phone number, and your profile: employee, entrepreneur or former entrepreneur. If that profile is missing, we derive it from the work situation you gave Crypto Universiteit; we do not copy whether you are a student, looking for work or receiving benefitsFromour customer database
• Source from the customer databaseWhat exactlythe UTM values, the name of the form and the date of your sign-ups with Crypto UniversiteitFromour customer database
• WhatsApp (old)What exactlykeywords you sent to our WhatsApp number yourself before 15 October 2026, with your phone number and email address; nothing new is addedFromyou
• AdministrationWhat exactlywhether your account is a test account, a manual exception to your membership, whether and when you turned off "Share usage statistics" (Gebruiksstatistieken delen), and a log of when the administrator viewed your dataFromus

We do not ask for your address, date of birth or national ID number, and we do not process special categories of personal data, such as data about your health. You enter your card or bank details at Stripe; we never receive them.

4. What we use your data for

To provide the service (performance of a contract)

To improve ChartQuest and follow up with you personally (legitimate interests)

For this processing, we have weighed our interests against your privacy. You can always object to it (see §13).

A. Our own statistics. We count which screens you see, also in the onboarding before you have an account, which invitations you see, what you click and how far you watch a video in the app. This shows us where people drop off and what helps. Everything stays in our own database: no analytics company, no advertising IDs and no IP address in that data. We use it only for statistics and to improve ChartQuest, not to contact you personally. We delete it after 13 months. We also record once whether you were already a member when you signed up, so we can see per source who becomes a member later. If you do not want this, turn off "Share usage statistics" in your profile: we then no longer store anything about your use of the app or your onboarding, and we delete what was already there. How you found us (B) is not covered by this switch; you can object to that by email.

B. How you found us. We store the source you gave, the UTM values of the link you arrived through (the platform, the type of content and which video or ad, for example "YouTube, one-hour video") and, from our customer database, the UTM values of your sign-ups with Crypto Universiteit. For 90 days, we keep a record of which onboarding belongs to your account, so we can count per source how far people get. This tells us which channels bring in people who stay, so we spend our time and advertising budget well. We never put names or contact details in a UTM. If you object, we stop doing this for you.

C. Personal follow-up. We combine your activity in ChartQuest (trades, last active, membership, OKX link, subscription, your onboarding answers and how you found us) with your data in our customer database, such as your name, phone number and profile. This shows us who might benefit from a next step, such as the Starter Class or the Master Class, and lets us contact you personally, for example with a message or a call. This is profiling for direct marketing. A person decides whether and how we get in touch. We always honour an objection to this: we then stop the follow-up.

D. Security and preventing abuse. A word filter and a limit on the number of messages in the chat (we do not store a message the filter blocks), limits on the number of attempts when logging in and for other requests, at most two other OKX UIDs per 30 days, and a log of every time the administrator views your data.

With your consent

The course video comes from YouTube. It only loads when you click Play; from then on, YouTube can store data on your device. We do not use advertising pixels, screen recordings or data sharing with advertising platforms. If we ever do, we will ask for your consent first.

Legal obligation

• Keeping our financial records for 7 years.
• Providing data when a competent authority lawfully asks for it.
• Reporting a data breach to the Autoriteit Persoonsgegevens (the Dutch data protection authority), and to you if needed.

5. Data we receive from others

Our customer database (Crypto Universiteit)

If you are in the customer database of Crypto Universiteit, for example because you signed up for a training session, the Starter Class or a call, we link this to your account using your email address. From it we read your membership (stage, and whether you have paid, have a contract or are following a programme, with start and end dates), your first name, last name and phone number, your work situation and the UTM values of your sign-ups. We use this to unlock the right features (§4), to count the source and for personal follow-up (§4 B and C). We read this when you open the app (at most once a minute) and every night. We do not copy your address, date of birth, notes, call reports, chats or amounts.

OKX

If you link your OKX account, we ask OKX whether you signed up with our code and whether you are verified. To do this, we send OKX your OKX UID. From the answer we keep only your sign-up date, your verification date and the code you signed up with; we do not keep figures on deposits, withdrawals, trading volume or commission. Every night we ask OKX again whether your link is still valid. For 90 days, we keep track of when an account was linked or unlinked; this lets us limit the number of new links. Good to know: OKX pays us a fee when you trade using our code.

Stripe

From Stripe we receive the status of your subscription and the end of your billing period, to decide whether you have unlimited MANA. As soon as you hover over or tap the subscribe button, we prepare a payment page at Stripe with your email address and your account code, so checking out is quicker. At that point you have not agreed to anything yet.

6. What other players see about you

On the leaderboard (the top 3), other players see your name, avatar and number of crowns. In the chat they see your name, your avatar, your number of crowns, your messages and the time. In the Starter Class room, everyone who is logged in can read along, but only members can post; so anyone who posts there shows they are a member. The Master Class room is only for Master Class members and our team. Each message also carries an internal code for your account; it says nothing about your email address.

You choose your name yourself in your profile. If you do not choose a name, other players see the part of your email address before the @ as your name. They never see your full email address. If you do not want this, choose a different name in your profile. A new name applies to your next messages; earlier messages keep the name you had then.

7. Profiling and automated decisions

We automatically assign you to a stage (1 to 4), based on your OKX link and your membership. That stage determines which offer you see in the app. Your membership also determines how much MANA you get per day and whether you can post in the Starter Class chat.

At set moments in the game, we automatically show a short explanation and the offer that fits your stage: when a run fails, when you reach the daily limit, after three losses in a row, when your MANA runs out and when a backtest ends in a loss. Your answer to "What went wrong?" determines which explanation you see. If we know your first name, we use it.

For personal follow-up (§4 C), we see fixed lists in our admin area, such as people who have not been active for a while. There we can also filter by your profile. A person decides whether and how we get in touch. The word filter in the chat automatically blocks messages containing certain words.

We do not make decisions based solely on automated processing that have legal effects for you or affect you in a similarly significant way.

8. Who we share data with

We do not sell data. We only share it with parties we need to make ChartQuest work.

• SupabaseRoleprocessorWhat fordatabase, login, chat and server functionsBased inSupabase Pte. Ltd., Singapore; the database is in Frankfurt (Germany)
• CloudflareRoleprocessorWhat forhosting the app, price data, domain names and security, and forwarding email sent to usBased inCloudflare, Inc., US; global network
• VercelRoleprocessorWhat forhosting chart-quest.comBased inVercel Inc., US
• ResendRoleprocessorWhat forsending the confirmation and login emailsBased inPlus Five Five, Inc. (Resend), US; sent via Ireland
• StripeRoleprocessor; independent controller for fraud prevention and legal obligationsWhat forpayments and subscriptionsBased inStripe Payments Europe, Limited, Ireland; also Stripe, LLC, US
• GripOSRoleour own systemWhat forour customer database and customer contactBased inCU Coaching B.V.; the database is hosted by Supabase in Stockholm (Sweden)
• GitHubRolecodeWhat forour code, and the start signal for the tasks that run every night (they run at Supabase; GitHub receives no player data)Based inGitHub, Inc. (Microsoft), US
• Google (Workspace)RoleprocessorWhat forour mailbox: email you send us arrives thereBased inGoogle Ireland Limited; also Google LLC, US
• OKXRoleindependent controllerWhat forchecking your OKX link (we send your OKX UID)Based inOKX Europe Limited, Malta
• Google (YouTube)Roleindependent controller once you play the videoWhat forthe course videoBased inGoogle Ireland Limited; also Google LLC, US
• Other playersRolerecipientWhat forthe leaderboard and the chat (§6)Based inN/A

Until the move to GripOS, our customer database is still stored at Airtable (Formagrid Inc., US).

The app fetches the current OKX promotion from our own website cryptouniversiteit.com; like any website you visit, it sees your IP address when it does.

Within our company, only the administrator (Benjamin) can view user data, through a separate admin area.

9. Transfers outside the European Economic Area

Some of the parties in §8 are based outside the European Economic Area (EEA), mainly in the United States, or may process data there. We only transfer data with a legal safeguard: the party is certified under the EU-US Data Privacy Framework (DPF), or the European Commission's standard contractual clauses (SCCs) apply.

10. How long we keep data

• Account (email address, username, preferences)How longas long as your account existsAfterwardsdeleted
• Gameplay, statistics, MANA and chat messagesHow longas long as your account existsAfterwardsdeleted
• Copy of your membership and contact details from our customer databaseHow longas long as your account exists; refreshed when you open the app and every nightAfterwardsdeleted
• Source (given by you, and UTM values)How longas long as your account exists; free text for "something else" 90 daysAfterwardsdeleted
• Onboarding without an accountHow longin your browser 24 hours at most; on our server 2 hours at mostAfterwardsdeleted
• Your onboarding answers, as a check after signing upHow long30 days, or less if you delete your account soonerAfterwardsdeleted
• Log of completed onboardings (day, source, UTM values)How long90 daysAfterwardsdaily totals per source only
• Usage data (§4 A)How long13 months; from onboarding without an account, 30 daysAfterwardsdeleted
• Your "Share usage statistics" choiceHow longas long as your account existsAfterwardsdeleted
• OKX linkHow longuntil you unlink or delete your account; the link history 90 daysAfterwardsdeleted
• Subscription statusHow longas long as your account existsAfterwardsdeleted
• Financial records (at Stripe and in our bookkeeping)How long7 yearsAfterwardsdeleted
• Administrator log and refused attempts to use admin functionsHow long12 monthsAfterwardsdeleted
• Abuse countersHow longa day at mostAfterwardsdeleted
• Old WhatsApp keywords (from before 15 October 2026)How longas long as your account existsAfterwardsdeleted
• Login sessions (with IP address and device)How longuntil you log outAfterwardsdeleted
• Database backupsHow long7 days at mostAfterwardsoverwritten
• Storage on your deviceHow longsee §11AfterwardsN/A

Clean-up runs automatically every night. Daily totals not linked to a person, such as "12 completed onboardings via YouTube on 3 October", are not personal data; we keep them indefinitely.

11. Cookies and storage on your device

chart-quest.com sets no cookies and stores nothing on your device. If you click through to the app, the UTM values from your link and the domain name of the website you came from are passed on in the link to the app.

The app sets no cookies of its own and does not work with advertising or analytics companies. We do use storage in your browser (localStorage and sessionStorage): to keep you logged in, to save your settings and your game, and for our own statistics (§4 A). What is stored there stays on your device, with three exceptions: your login key is sent with every request to our server; at the end of the onboarding we send your answers with a linking code (if you do not create an account, we delete them within 2 hours); and the random session code of the onboarding is sent along with the screen measurements.

• sb-…-auth-tokenPurposestaying logged inHow longuntil you log out
• sb-…-code-verifierPurposea one-time check code for signing up and email links (not a password)How longuntil you log in, usually minutes
• chartquest:locale:v1Purposeyour language and countryHow longuntil you clear it
• chartquest:return-toPurposetaking you to the page you wanted to open after logging inHow long2 hours at most
• chartquest:link-usedPurposeshowing the right help after an email link (no code)How long2 hours at most, per tab
• chartquest:postlogoutPurposelanding on the login screen after logging outHow longone page change
• chartquest:onboarding:v1Purposekeeping your onboarding until you have an account: your answers, the trial quest, how you arrived (UTM values, referring domain name, first page), a linking code and a random visitor and session codeHow longuntil you log in, otherwise 24 hours at most
• chartquest:onboarding:pending-email:v1Purposeshowing your email address on the "check your email" screenHow long30 minutes at most, per tab
• chartquest:onboarding:events:v1Purposemeasuring each onboarding screen only onceHow longuntil you close the tab
• chartquest:signals-share:<id>Purposeyour "Share usage statistics" choice, so the app follows it straight awayHow longuntil you clear it
• challenge:<id>Purposeyour Quest run (progress, level, outcomes)How longuntil a new run overwrites it
• chartquest:quest-round:v1:<id>Purposethe current Quest round, so reopening shows the same situationHow longuntil you play the trade
• backtest:<id> and backtest-history:<id>Purposeyour current backtest and your last 20 backtests on this deviceHow longuntil you clear it
• chartquest:chart-style and chartquest:draw-defaultsPurposethe chart style and your drawing toolsHow longuntil you clear it
• chartquest:welcome:seen:<id>, chartquest:stats-visited:<id>Purposeshowing the welcome screen once; ticking off the Analyse stepHow longuntil you clear it
• chartquest:starter-progress-v2:<id>Purposea copy of your Starter Class progress (the progress itself is stored on our server)How longuntil you clear it
• chartquest:okx-deal:v1Purposea temporary copy of the current OKX promotionHow long30 minutes at most

<id> is your account code. Logging out only clears your login key; the other keys stay on this device and are not sent to us. sessionStorage is cleared when you close the tab. "Until you clear it" means: until you clear your browser data. Keys starting with chartquest:preview or chartquest:dev- are only used by testers.

Embedded content

• YouTube (the course video, via youtube-nocookie.com): only loads when you click Play. After that, Google's rules apply; see Google's privacy policy.
• Stripe: when you check out, you go to Stripe's payment page; Stripe's rules apply there.

12. Security

We take appropriate measures to protect your data, including:

• All connections are encrypted (https).
• Secret keys are kept only on the server, never in the app.
• We store passwords only in encrypted (hashed) form; we refuse passwords that have appeared in known data breaches.
• In the database, players can only read their own data; the chat and the leaderboard are shared on purpose (§6).
• Our own tables store no IP addresses or browser data. To prevent abuse, we count attempts per connection; the IP address appears there only as a code that cannot be reversed, and we clear those counters within a day.
• The admin area is only for the administrator, with his own account and password; it logs out automatically after 30 minutes without activity.
• In the admin area, phone numbers are hidden by default. If the administrator reveals one or opens your profile, we log that, without the data itself.

If we discover a data breach that poses a risk to you, we report it to the Autoriteit Persoonsgegevens within 72 hours, and if the risk is high, to you as well.

13. Your rights

• AccessWhat it meansan overview of all the data we hold about youHowby email; you get an overview within a month, as a file if you ask
• CorrectionWhat it meanshaving incorrect data correctedHowchange your username, avatar, email address, country and language yourself in your profile; the rest by email
• DeletionWhat it meanshaving your account and data deletedHowby email
• RestrictionWhat it meanshaving the use of your data paused for a while, for example during a disputeHowby email
• PortabilityWhat it meanstaking your data with you in a common file formatHowby email; you get a JSON file
• ObjectionWhat it meansstopping statistics, source tracking or personal follow-up (§4)Howstatistics: with the "Share usage statistics" switch in your profile, or by email; the rest by email
• ComplaintWhat it meansif you feel we are not handling your data properlyHowwith the Autoriteit Persoonsgegevens, or the supervisory authority in your own country

How it works

• Send an email to privacy@chart-quest.com, preferably from your account's email address. That way we know it is about your account.
• We respond within a month. If your request is complex, it may take two months longer; we will let you know within the first month.
• It is free, unless a request is clearly unfounded or excessive.

When your account is deleted

We delete your account and the data we hold about you in our database, including your onboarding answers and usage data. We cancel an active subscription immediately, without a refund for the rest of the period, and we also delete your customer profile at Stripe; Stripe keeps your invoices and payments for as long as the law requires. On request, we also remove you from our customer database (GripOS). Your OKX account remains; only the link with ChartQuest is removed. The administrator log is kept for 12 months; it contains your account code, not your email address or phone number. Backups are overwritten within 7 days.

14. Age

ChartQuest is only for people aged 18 and over. This is also stated when you create an account. If you are younger, do not create an account. If we find out that someone under 18 has an account, we delete that account and its data.

15. Changes

We update this notice when we change what we process or why, before that change goes live. The date of the latest version is always at the top. If there is an important change, we will let you know in advance in the app or by email.

16. Contact

Questions about this notice or your data? Email privacy@chart-quest.com or write to CU Coaching B.V., Valkeniersdonk 306, 7326 KR Apeldoorn.