Privacy Policy

1. Data Controller

White Bird is an educational project dedicated to economics and financial markets. The data controller is the site publisher.

2. Data Collected

We only collect data necessary for the operation of the service:

• User account: email, username, password hash (never stored in plain text) and the hashes of the 4 previous passwords, to refuse their reuse
• Preferences: visual theme, header configuration
• Favorites: saved indicators, markets, and announcements
• Personal space: notebooks and notes you write (titles and contents, linked to your account)
• Training: your quiz answers and scores
• Messages: suggestions and messages you send us (subject, content)
• Security: two-factor authentication (TOTP), open sessions and trusted devices (browser and system derived from the User-Agent, opening and last activity dates), recent authentication failures, audit logs (IP, User-Agent)

3. Purpose of Processing

Your data is used exclusively to:

• Manage your account and authentication
• Personalize your experience (theme, favorites, personal notes, training progress)
• Ensure the security of the service and of accounts (access restriction after authentication failures, list of open sessions, email alerts on sensitive operations, audit)
• Send you verification codes by email
• Read your suggestions and follow up on them

We never sell, rent, or share your data with third parties for commercial purposes.

4. Legal Basis

The processing of your data is based on your consent (account creation, optional features) and on the legitimate interest of the controller (service security, fraud prevention, audit logs) — Art. 6 GDPR.

5. Data Retention

• Active account: data retained as long as the account is active
• Deleted account: immediate deactivation, then automatic purge after 30 days — your favorites, notebooks and notes are deleted, and your account (email, username, password, 2FA secrets) is irreversibly anonymized. Any quiz scores are kept in anonymous form, with no remaining link to you.
• Audit logs (IP, User-Agent): retained for security purposes — IP and User-Agent erased at the latest 90 days after account deletion, and logs purged after at most 1 year (routine actions) or 3 years (security actions)
• Account security data: the access-restriction counters (recent failures) are erased at the latest 30 hours later; the matching entries in the audit logs follow those logs' own retention (see above). Sessions and trusted devices are deleted at the latest 31 days after they are closed or expire (a trusted device expires after one year); only the hashes of the last 4 passwords are kept; the content of sent emails (codes, links, alerts) is erased as soon as it is sent

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

7. Data Security

• Passwords hashed with Argon2id (never stored in plain text)
• TOTP secrets encrypted with Fernet (AES-128-CBC)
• Communications protected by HTTPS (TLS)
• Advanced security headers (CSP, HSTS, X-Frame-Options)
• Access restriction after authentication failures (increasing delay, at most 25 attempts per 24 hours), without letting a third party lock the holder out of their trusted devices
• Compromised password checking via Have I Been Pwned (k-Anonymity — your password is never transmitted)

8. Cookies

White Bird sets no advertising cookies and uses no audience-measurement tool that tracks you individually. Five strictly necessary cookies keep your account working: two authentication tokens (__Host-wb_acces, __Host-wb_rafraichissement) and a trusted-device token (__Host-wb_appareil, one year, so that someone trying to guess your password cannot lock your account on this browser), all three in httpOnly cookies (inaccessible to JavaScript, to protect your session against token theft), a login flag (__Host-wb_connecte) and an anti-CSRF token (__Host-wb_csrf). Your browser's localStorage stores your display preferences (language, theme, collapsed panels) and your course progress — this information stays on your device and is never sent to our servers. TradingView widgets, for their part, only load after you agree, and then set their own cookies: see “Third-party services” below.

9. Third-party Services

• TradingView: market chart widgets and economic calendar. These widgets only load after you click (“Load widgets”); you can also decline to load them, and the rest of the site then works normally. Once loaded, your IP address and the URL of the page are sent to TradingView, which sets its own audience-measurement cookies (including an identifier kept for up to 13 months) — see TradingView's privacy policy. The “Always load on this site” and “Always decline to load them” choices are stored in your browser for 6 months and can be withdrawn below.
• Sentry: technical error monitoring, configured to store no personal data (send_default_pii disabled: neither IP address nor email; request bodies and cookies filtered before sending). When an error occurs, a replay of the faulty session may be recorded for diagnosis — with text masked and media excluded.
• Have I Been Pwned: compromised password checking (k-Anonymity, no password transmitted)
• Transfers outside the EU: displaying TradingView widgets transmits your IP address to TradingView and associates its cookies with it (transfers that may occur outside the European Union). Sentry is based in the United States but stores no personal data (see above), and Have I Been Pwned never receives your password. No other personal data is transferred outside the EU.

Reset my TradingView choice

10. Contact

To exercise your rights or ask a question about your data, contact us at: contact@training-eco.com