LEGAL

TrueGEX Privacy Policy

Effective: 29 October 2026 · Version 2026-10-29

TrueGEX provides the website at truegex.com, the application at app.truegex.com, TrueGEX Academy and administration of the TrueGEX Discord community. This policy describes how we handle personal information for those services. Contact [email protected] for privacy enquiries or requests concerning your information.

Whop and Discord also process information under their own policies. This notice covers our handling of information, including information those services provide to us.

When you sign in through Discord or Whop, we receive the account identifier and available profile details, including username, display name, email address, verification status and avatar reference. We record our account identifier, linked identities and account creation and login times. We do not receive your Discord or Whop password. Provider tokens used to retrieve your sign-in profile are not retained for ongoing access in our account database.

We associate logins with subscriptions using provider-confirmed connections or verified email matches. This can join records belonging to the same person. Contact support if an account connection appears incorrect.

Whop supplies membership and buyer identifiers, available buyer email, plan/access status, billing-period end and a management link. Payment, refund or dispute events can cause us to recheck membership. We use this information to grant and maintain access. Card details are entered with Whop and its payment providers; our account database does not store full card numbers.

The app stores preferences in your browser and synchronises supported records with your account. These can include watchlists, tracked levels, alert definitions, chart layouts, drawings, indicators, flow filters and tracked contracts, scanner preferences and Academy progress. These are workspace records, not evidence that you executed a brokerage trade. Clearing browser storage does not remove synchronised server records.

We process messages, contact details and attachments you send to support. If you participate in our Discord, your posts are visible according to channel permissions and Discord's settings. Our integration handles membership, roles and agreement-button interactions to administer access. Do not submit someone else's private information without authority.

Serving and securing the product involves network and request information, such as IP addresses, requested URLs, timestamps, response/error details and browser headers. We and our infrastructure providers use operational records to diagnose faults and investigate abuse or unauthorised access.

We use PostHog for website and product analytics, configured to its EU cloud service. Analytics includes page views, clicks, referring information, feature usage, selected symbols, settings changes and Academy interactions. When you sign in, analytics associates activity with your account identifier and sends profile properties including name, email, linked-provider usernames and plan/access status. Browser identifiers can connect visits on the marketing site and app. This information is not anonymous merely because it uses an account identifier.

Analytics also records performance measurements, interaction heatmaps and session replays. A session replay captures the website/app interface and your interactions with it; it is separate from TrueGEX's historical market replay. Please do not enter sensitive information the service does not ask for.

The marketing website loads Whop's attribution pixel to associate visits with purchases. This requests a third-party script and sends a page event. Whop receives network/request information and may use browser identifiers and referral information under its applicable privacy terms.

These tools load automatically when you visit the website or use the app. You can limit them with your browser's privacy settings or a content blocker. Contact support with questions about tracking or to make a privacy request.

The tgx_session cookie maintains sign-in. It is issued with a 30-day lifetime; server-side session validity can extend with activity. Signing out invalidates that session. The tgx_oauth cookie binds a sign-in response to the browser that started it and lasts approximately 10 minutes, normally being cleared during the callback. These cookies support authentication and security.

TrueGEX browser storage remembers preferences and caches workspace/progress records. It remains until changed or cleared; supported records also have account copies. Analytics and attribution providers can use their own identifiers and browser storage to recognise visits. Their storage is separate from the essential sign-in cookies. Removing storage may reset preferences or require a new sign-in. It does not cancel billing or delete your account.

Where GDPR or comparable rules apply, we process account, membership and synchronised-workspace information to perform the service contract. We use information needed to answer service requests on the same basis. For pre-purchase enquiries, operational security, fault investigation, proportionate community moderation and protecting legal claims, we rely on legitimate interests, subject to the balancing of your rights and interests. These interests are providing a secure, functioning service, responding to customers and protecting against abuse.

We process records needed for legal obligations, such as tax and accounting, on that basis. We use analytics and purchase attribution on the basis of our legitimate interests in understanding how the service is used, improving it and measuring our marketing, or on your consent where the law requires it.

We need sufficient sign-in and membership details to provide paid access. Optional annotations and community contributions are your choice. Automated membership checks decide service access using subscription and linked-identity records; they do not evaluate creditworthiness or investment suitability. You may ask support to review an access problem.

Our infrastructure uses a cloud hosting provider for our servers and Cloudflare for traffic delivery and security. Whop handles purchases, membership functions and attribution. Discord provides login and community functions. PostHog processes analytics. The support-mailbox provider processes correspondence, and authorised operators may access relevant records for support and administration.

These organisations receive information relevant to their functions. Some also process information independently for their own platform, payment, fraud-prevention or account purposes. Their role depends on the applicable service and agreement. See the providers' privacy notices for their own activities.

We may disclose relevant records in response to valid legal requirements, to address a concrete security incident or to establish or defend legal claims. A business transfer may involve disclosure to advisers and a successor with appropriate protections. Member posts can be seen by their intended community audience.

We do not sell personal information for money. Whop's attribution pixel shares visit information with Whop to connect visits with purchases. If the law where you live gives you a right to opt out of this kind of sharing, contact support to use it.

Our providers operate internationally, so information may be processed outside your country, including in Europe and the United States. PostHog is configured to its EU cloud endpoint; this does not mean every provider processes all information only in Europe. Applicable cross-border protections depend on the receiving entity, location and service agreement. Contact support for information about the arrangements relevant to your data. Your acceptance of this policy is not a waiver of legal transfer protections or a general consent to unrestricted transfers.

We retain account and saved-workspace records to maintain your account and provide the service. Cancellation of a subscription does not automatically delete the account. We also retain relevant records where necessary for legal obligations, accounting, security incidents or disputes. The applicable period depends on the record's purpose, whether an account or issue remains active and any statutory retention or claim period. Information is subject to deletion or restriction requests and applicable exceptions.

In the account system, sign-in state expires after approximately 10 minutes, sessions use a 30-day inactivity period and webhook deduplication identifiers are kept for approximately seven days. These are operational settings, not retention periods for all records. Browser-stored settings persist until overwritten or cleared. Support records, operational logs, provider-held analytics and backups have separate lifecycles. Contact support for information about a particular record or a deletion request; we will identify any records that must be retained and why.

Depending on applicable law, you may request access, correction, erasure, restriction, objection or a portable copy of your personal information. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact [email protected]. We may request proportionate evidence to verify your account, and will respond within the applicable legal deadline. Under GDPR this is normally one month, subject to permitted extensions and notice.

You may complain to the competent data-protection authority, including where you ordinarily live or work or where an alleged infringement occurred, as applicable. If a request cannot be fulfilled, we will explain the relevant reason. These rights are not limited to cancelling your subscription.

Deleting TrueGEX information does not delete your independent Whop or Discord account or all records those organisations retain under their own obligations. Cancellation is a separate action through Whop. We do not require marketing consent as a condition of exercising privacy rights.

We use HTTPS, protected authentication cookies, access controls and hashed session tokens in our account database. These measures reduce risk but cannot guarantee that a security incident will never occur. Report suspected unauthorised access to support promptly.

TrueGEX is intended for adults aged 18 or over. Contact us if you believe a child's information has been provided so we can investigate and take appropriate action.

We date revisions and give appropriate notice of material changes. A policy revision does not itself authorise processing that requires a new consent.