Last updated: 1 September 2026

Abu Terminal ("we", "us", "our") operates the website at abu-terminal.com and the Abu Terminal application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information we collect

We collect information in the following ways:

Account information: When you create an account via Google OAuth or magic link, we receive your email address and display name. We do not collect or store passwords.
Usage data: No product analytics. There is no analytics service in the application, and nothing records which pages you visit, which features you use, or how long a session lasts. Counts that appear in the product — the leaderboard, for example — are computed from the game progress described below, which is saved because the game needs it, not gathered to measure you.
Game progress: Your runs, scores, streaks, badges, campaign progress and quiz results are saved so the game can resume where you left it. No trader profile is generated from them.
Device information: Nothing is collected automatically into our records. Your browser type, operating system, screen size and language are read on your device so the interface can adapt, and are assembled into a diagnostic report only if you choose to export or send one. Separately, ordinary connection data — IP address, user agent, timestamps — reaches our host and the third parties named below because your browser connects to them; that is described under "Third-party services".
Feedback data: If you submit feedback through the in-app feedback widget, we collect your message, category selection, and rating.

What we do with your information

We use the collected information to:

Provide, maintain, and improve the Abu Terminal service
Save your game progress — runs completed, scores, badges and campaign state
Track your progression across simulations, quizzes, and campaigns
Send transactional emails (account verification, magic links) — never marketing emails
Produce the counts and rankings the product shows — the leaderboard and your own totals — from that saved progress
Detect and prevent abuse or technical issues

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

What we do not do

Abu Terminal does not use gameplay activity to build behavioural, psychological or investment profiles of users. We do not assign FOMO scores, panic scores, trader personalities or similar behavioural classifications, and we do not use cross-session gameplay history to predict real-world financial behaviour.

Abu Terminal does not use third-party product-analytics services to monitor gameplay during the current restricted beta.

What is saved is game progress: which runs you finished, your scores and streaks, which badges and campaigns you unlocked, and your settings. Scores, XP, badges and rankings are game mechanics and are not assessments of your investment ability, personality or real-world financial competence.

Third-party services

Abu Terminal uses the following third-party services that may process your data:

Supabase — authentication and database hosting. Your account data and simulation records are stored in Supabase with Row Level Security (RLS) enabled. Your browser also opens a WebSocket directly to Supabase Realtime while the app is open, so Supabase receives your IP address and the usual connection metadata even before you sign in.
Google OAuth — if you choose to sign in with Google, Google's privacy policy applies to the authentication process.
Google AdSense — advertising is not enabled. No advertising code runs on the site and no advertising cookie is set. If that changes, this policy will say so before it does.
Vercel — hosting and serverless functions. Vercel processes requests and may log IP addresses per their privacy policy.
TradingView — embedded chart widgets. The widget loads from TradingView's servers, so TradingView receives your IP address and device and network information, and may set its own cookies. TradingView's privacy policy governs what they do with it, not ours.
Binance — live crypto prices. Your browser opens a WebSocket to Binance directly, so Binance receives your IP address and the standard connection metadata that comes with any request, under their own privacy policy. We send them no account details, and nothing about you or your gameplay — but an IP address is personal data under the GDPR, so this is a transfer and we name it as one.
Paddle — payment processing. Payments are not enabled and there is nothing to buy, so no payment data is processed today. If paid plans are ever introduced, Paddle would process the payment details (email, billing address, payment method) under its own privacy policy, and Abu Terminal would still never store card numbers.

Your rights (including GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or any jurisdiction with data protection laws, you have the following rights:

Right of Access (GDPR Art. 15) — request a copy of the data we hold about you. Use the "Download My Data" button in Settings, or email us.
Right to Rectification (GDPR Art. 16) — update your profile information at any time through Settings.
Right to Erasure (GDPR Art. 17) — request complete deletion of your account and all associated data.
Right to Data Portability (GDPR Art. 20) — download your account data and game progress via Settings → Download My Data.
Right to Restrict Processing (GDPR Art. 18) — request that we limit how we process your data.
Right to Object (GDPR Art. 21) — object to processing based on legitimate interests, such as our security and error logs.
Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Right to Lodge a Complaint — you may file a complaint with your local data protection authority.

"Download My Data" gives you what your account itself can read: your profile, your saved game progress and the feedback you sent. It does not include our security and error records, which no account can read and which we can only reach with privileged access — ask by email and those are handled separately. To exercise any of these rights, use the self-service tools in Settings or contact us at abuterminal00@gmail.com. We will respond within 30 days.

Data retention

Different records have different lifetimes:

Account and game progress — kept while your account is active. If you ask us to delete your account, the live records are removed within 30 days.
Feedback you submit — kept while it is still useful for fixing what it reported.
Security and error records — kept on a short cycle so an incident can be investigated, then discarded.
Hosting logs — kept by our host on their schedule, not ours.
Backups — deletion removes your data from the live database. Backups rotate on their own cycle, so a copy can persist in one for a period afterwards. It is not restored into the live service.

Children

The Abu Terminal restricted beta is intended only for people aged 18 or older, and we do not knowingly offer accounts to anyone younger. We do not knowingly collect personal information from children. If we learn that an ineligible user has provided personal information, we may delete the account and the related information. If you believe a child has provided us with personal information, please contact us and we will remove it.

International data transfers

Your data may be transferred to and processed in countries other than your country of residence. Our hosting and database infrastructure is in the United States; the developer is in Israel. The recipients are the third-party services named above. We rely on these transfers because they are necessary to provide the service you asked for, not on your consent — continuing to use the site is not a consent mechanism and we do not treat it as one. Which transfer mechanism applies to each recipient under Chapter V of the GDPR has not been settled by a lawyer, and this policy does not assert one.

Security

We take the security of your data seriously. Measures we implement include:

Row Level Security on the tables holding personal records, so a signed-in account reads its own rows. We have checked this from the outside: an unauthenticated client asking each table for data either gets nothing back or is refused. Not every table is personal — some hold public reference data, some accept a submission without reading it back. The policy text and database privileges behind that behaviour have not yet been reviewed independently.
HTTPS encryption on all connections
Content Security Policy (CSP) headers to prevent cross-site scripting
No secret keys on the client. The Supabase publishable key is present in the app, as it is designed to be — it identifies the project and lets the app act as the anonymous role. What that role can reach is exactly what the database privileges and row-level security allow it to reach, which is why those are the control and hiding the key is not.
DOMPurify sanitization on all dynamic content
Regular security audits via our automated agent squad

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of Abu Terminal after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at abuterminal00@gmail.com.