Privacy Policy

Last updated: July 24, 2026

1. Data Controller

White Bird is an educational project dedicated to economics and financial markets. The data controller is the site publisher.

2. Data Collected

We only collect data necessary for the operation of the service:

  • User account: email, username, password (hashed, never stored in plain text)
  • Preferences: visual theme, header configuration
  • Favorites: saved indicators, markets, and announcements
  • Personal space: notebooks and notes you write (titles and contents, linked to your account)
  • Training: your quiz answers and scores
  • Messages: suggestions and messages you send us (subject, content)
  • Security: two-factor authentication (TOTP), audit logs (IP, User-Agent)

3. Purpose of Processing

Your data is used exclusively to:

  • Manage your account and authentication
  • Personalize your experience (theme, favorites, personal notes, training progress)
  • Ensure service security (brute-force detection, audit)
  • Send you verification codes by email
  • Read your suggestions and follow up on them

We never sell, rent, or share your data with third parties for commercial purposes.

4. Legal Basis

The processing of your data is based on your consent (account creation, optional features) and on the legitimate interest of the controller (service security, fraud prevention, audit logs) — Art. 6 GDPR.

5. Data Retention

  • Active account: data retained as long as the account is active
  • Deleted account: immediate deactivation, then automatic purge after 30 days — your favorites, notebooks and notes are deleted, and your account (email, username, password, 2FA secrets) is irreversibly anonymized. Any quiz scores are kept in anonymous form, with no remaining link to you.
  • Audit logs (IP, User-Agent): retained for security purposes — IP and User-Agent erased at the latest 90 days after account deletion, and logs purged after at most 1 year (routine actions) or 3 years (security actions)

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right of Access

View your account data in Profile → Settings — and your notes in your personal space.

Right to Portability

Export your account data (profile, preferences, favorites) as JSON via Profile → Export my data. To also receive a copy of your personal notes, training history or messages, write to us — we will provide it within the timeframes set by the GDPR.

Right to Rectification

Edit your information at any time in your profile.

Right to Erasure

Delete your account in Profile → Delete my account. Full anonymization within 30 days.

Right to object

You may object, on grounds relating to your situation, to processing based on legitimate interest (notably security logs) by contacting us.

Right to restriction

You may request the temporary suspension of processing while its accuracy or lawfulness is verified.

Right to lodge a complaint

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. Data Security

  • Passwords hashed with bcrypt (never stored in plain text)
  • TOTP secrets encrypted with Fernet (AES-128-CBC)
  • Communications protected by HTTPS (TLS)
  • Advanced security headers (CSP, HSTS, X-Frame-Options)
  • Brute-force protection on all sensitive endpoints
  • Compromised password checking via Have I Been Pwned (k-Anonymity — your password is never transmitted)

8. Cookies

White Bird sets no advertising cookies and uses no audience-measurement tool that tracks you individually. Four strictly necessary cookies keep your session working: two authentication tokens in httpOnly cookies (inaccessible to JavaScript, to protect your session against token theft), a login flag (wb_logged_in) and an anti-CSRF token (csrf_token). Your browser's localStorage stores your display preferences (language, theme, collapsed panels) and your course progress — this information stays on your device and is never sent to our servers. TradingView widgets, for their part, only load after you agree, and then set their own cookies: see “Third-party services” below.

9. Third-party Services

  • TradingView: market chart widgets and economic calendar. These widgets only load after you click (“Load widgets”). Once loaded, your IP address and the URL of the page are sent to TradingView, which sets its own audience-measurement cookies (including an identifier kept for up to 13 months) — see TradingView's privacy policy. The “Always load” choice is stored in your browser and can be withdrawn below.
  • Sentry: technical error monitoring, configured to store no personal data (send_default_pii disabled: neither IP address nor email; request bodies and cookies filtered before sending). When an error occurs, a replay of the faulty session may be recorded for diagnosis — with text masked and media excluded.
  • Have I Been Pwned: compromised password checking (k-Anonymity, no password transmitted)
  • Transfers outside the EU: displaying TradingView widgets transmits your IP address to TradingView and associates its cookies with it (transfers that may occur outside the European Union). Sentry is based in the United States but stores no personal data (see above), and Have I Been Pwned never receives your password. No other personal data is transferred outside the EU.

10. Contact

To exercise your rights or ask a question about your data, contact us at: contact@training-eco.com