TradeCert Privacy Policy

This policy explains what happens to data when you use TradeCert (“the app”), published by Anvil Digital Labs (“we”, “us”). It is written to be read, not to be impressive. If anything here is unclear, email support@anvillabs.app.

1. Information we collect ourselves

Nothing, unless you join the leaderboard. TradeCert still has no sign-up, no login, no password and no email-based account. If you never opt in to the leaderboard, nothing about your studying is sent to us, and we cannot see how you answer questions or how you score. If you do opt in, we receive exactly the items listed in section 3 and nothing else. The one exception is the rewarded-video record described in section 8, which comes from our ad mediation partner, not from the app, and identifies no one.

2. Information stored on your device

The following is written to your device’s private app storage and never transmitted to us:

• Study progress — attempts, best score and last score for each category.
• Premium status — whether the one-time unlock has been purchased, stored in Android’s encrypted storage (on iPhone and iPad, the iOS Keychain) so the app works offline.
• App preferences — such as when the app last checked for a content update.
• Leaderboard identity — if you join the leaderboard, the app also keeps your profile identifier and recovery code here so the board recognises you.

Uninstalling the app, or clearing its data in Android settings, removes all of it, except the automatic backup files described next. If you joined the leaderboard, your profile on our server is separate and is not deleted by uninstalling — see section 7.

Automatic backup on Android. Unless you switch it off in the app’s menu, the app saves an encrypted copy of your study progress once a day to the Download/TradeCert folder on your phone. Those files stay after you uninstall the app or clear its data; you can delete them with any file manager. They are never sent to us.

On iPhone and iPad, the premium status, your leaderboard identity, the random device identifier described in section 4, the App Attest key reference (section 3) and the keys that protect your progress backups are kept in the iOS Keychain. Deleting the app removes your study progress and preferences, but iOS can keep Keychain items after an app is deleted, and the premium status and leaderboard identity can also move to a new iPhone or iPad through an encrypted backup, so they may still be there when you reinstall TradeCert.

3. The optional leaderboard

The app includes an online leaderboard. It is strictly opt-in: nothing in this section happens unless you choose to join. If you do join, the app sends the following to our server over an encrypted (HTTPS) connection:

• A nickname you choose — public: it is displayed on the leaderboard to other users, so pick one you are happy to show.
• A country, and optionally a region or state, that you select — public. This is a menu choice, not your location: the app never asks for location permission and never reads GPS.
• An avatar — one of 24 preset icons, stored as nothing more than a number — public.
• Your scores for the three boards — correct answers this week, best survival run, and best streak run — public.
• A random profile identifier that our server generates, and a recovery code, so you can get your profile back after reinstalling the app.
• Which kind of device the profile is on (Android, or iPhone and iPad), so our server applies the right integrity check — not public.
• On iPhone and iPad only, an App Attest key — Apple’s App Attest service lets our server check that leaderboard requests come from a genuine, unmodified copy of TradeCert. The app creates the key on your device and Apple certifies it; our server keeps the key’s identifier, its public half and a usage counter with your profile. It contains no name, email address, contact details or location, is not public, and is never used for advertising.

That list is complete. Joining the leaderboard sends your profile choices and board scores — not your study progress, your notes, your settings, or anything else on the device.

4. Identifiers we never store in readable form

Running a public leaderboard fairly requires some abuse prevention. Three identifiers are involved, and none of them is stored in readable form:

• Your IP address is never stored. The server keeps only a keyed one-way hash (an HMAC) of it, used for rate limiting and abuse prevention.
• A recovery identifier is derived on your device from the Android device ID using a keyed one-way hash. The raw Android ID never leaves your phone. iPhone and iPad have no such ID, so there the app creates a random identifier once, keeps it in the iOS Keychain on that device only (it is not synced or restored to another device), and derives the recovery identifier from it the same way. The random value never leaves the device either.
• Your recovery code is stored on the server only as a keyed one-way hash. The readable code exists in exactly one place: the app on your device.

5. What we still do not collect

Even if you join the leaderboard: no email address, no real name, no phone number, no contacts, and no location — the country on your profile is something you picked from a menu, not a reading from your device. The app also contains no analytics or crash-reporting SDK of any kind. Apart from the anonymous rewarded-video record described in section 8, we do not track how you use it.

Voice answers on iPhone and iPad. If you turn on “Answer By Voice” in Hands-Free mode and allow Microphone and Speech Recognition access, the app listens for a spoken answer (A, B, C or D) only while a question is waiting for one. Apple’s speech recognition turns it into text on the device itself; nothing you say is recorded, stored, or sent to us, to Apple or to anyone else.

Voice answers on Android. If your version of the app has “Answer By Voice” and you turn it on in Hands-Free mode and allow Microphone access, the app listens for a spoken answer only while a question is waiting for one. Your phone’s speech service (usually Google’s) turns it into text, on the phone when it can and otherwise online, under that service’s own privacy terms. TradeCert itself records and keeps no audio, and nothing you say is sent to us.

6. How long leaderboard data is kept

Your leaderboard profile and its data are kept for as long as the profile exists. The boards themselves reset on their weekly and monthly cycles by design, so board scores are replaced as part of normal operation. If you delete your profile, everything attached to it goes with it, except the record of prizes already awarded — see the next section.

7. Deleting your data

Leaderboard profile, in the app: on iPhone and iPad, and on Android from the update that adds it, open Ranks → Your Profile → “Delete My Leaderboard Profile” and confirm. This erases your nickname, scores and ranks, the groups you started and your recovery code from our server straight away and removes you from the boards. It cannot be undone. A record of prizes already awarded is kept, without your nickname.

Leaderboard profile, by email: email support@anvillabs.app and tell us the nickname on the profile you want removed. We will delete the profile and its scores from the server, which also removes you from the boards.

Everything on your device — study progress, settings and your local leaderboard identity — is deleted by uninstalling the app or clearing its data in Android settings, except the automatic backup files in Download/TradeCert, which you can delete with any file manager. On iPhone and iPad, deleting the app removes it all except the Keychain items described in section 2. That part has never required our involvement.

Never joined the leaderboard? Then we hold nothing that identifies you (the rewarded-video records in section 8 contain no identifier and are deleted after 90 days), and uninstalling the app removes everything there is, apart from the Android backup files and the iPhone and iPad Keychain items described in section 2.

8. Third-party services used in the app

Ads in TradeCert are delivered through Unity LevelPlay, an ad mediation service run by Unity Technologies (which owns ironSource). LevelPlay picks which of the advertising networks below shows each ad. LevelPlay and these networks may process device-level information such as your advertising ID, the Android App Set ID, IP address (which can indicate an approximate location), device model and settings, and how you interact with ads, in order to show, measure and limit ads and to prevent ad fraud. LevelPlay also includes Unity’s Ad Quality SDK, which checks the ads that are shown for malicious or broken creatives. None of these partners receive your study progress, answers or leaderboard scores.

On iPhone and iPad, the app includes Unity LevelPlay with ironSource Ads, Unity Ads and Google AdMob, plus Unity’s Ad Quality SDK and Google’s User Messaging Platform (the consent form described in section 9); the other networks in the table below are not in the iPhone and iPad version. There, instead of the Android identifiers, these partners may process the identifier for vendor (IDFV) and, only if you choose “Allow” on Apple’s tracking prompt (section 9), the advertising identifier (IDFA).

Not every network serves ads at all times; LevelPlay only calls the ones that are switched on for the app. Google’s handling of data for the Play services is governed by the Google Privacy Policy. You can reset or delete your advertising ID at any time in Android Settings under Privacy → Ads. On iPhone and iPad, see the tracking choice in section 9.

Rewarded videos. When you finish watching a rewarded video, Unity LevelPlay’s server tells our server that a reward was earned. The message holds an event number, the reward’s name and amount, whether it came from the Android or the iPhone and iPad app, and the time. We keep these records for 90 days, only to count rewarded videos and check that they are genuine. They contain no name, no advertising ID, no user or device identifier, none of your IP address and no study data, and they are not linked to the leaderboard. The app gives you the reward itself, on your device, whether or not this message reaches us.

9. Advertising choices

Purchasing the premium unlock removes all advertising from the app permanently. Ads never appear during a timed mock exam.

EEA, UK and Switzerland: before any ad partner is started, the app asks once whether you agree to personalised advertising. If you decline, partners are told to show only non-personalised ads.

United States: you can turn on “Do Not Sell or Share My Personal Information” at any time in the app under About → Privacy and Ad Settings. When it is on, ad partners are told not to sell or share your information.

You can change either choice later from the same About → Privacy and Ad Settings screen.

iPhone and iPad: if you have not bought the premium unlock, the app shows Apple’s App Tracking Transparency prompt once, after any consent form above. Ad partners can use your device’s advertising identifier (IDFA) to track you across other companies’ apps and websites only if you choose “Allow”. If you choose “Ask App Not to Track”, they cannot, and every feature works the same. You can change this at any time in iOS Settings → Privacy & Security → Tracking.

10. Payments

Purchases are handled by Google Play on Android and by Apple through the App Store on iPhone and iPad. We never see or store your card details, billing address, or any payment information. Refunds are handled by Google Play or Apple under their standard refund policies. To get the unlock back after reinstalling, or on another device that uses the same Google or Apple account, use “Restore Purchases” in the app’s menu or on the Premium screen.

11. Children

TradeCert is intended for adults preparing for occupational certification exams. It is not directed at children under 13, and we do not knowingly collect information from them.

12. Your rights

If you never joined the leaderboard, we hold no personal data about you (the rewarded-video records in section 8 identify no one), so there is nothing for us to export or delete on request — uninstalling the app removes everything except the Android backup files described in section 2. If you did join, the data we hold is the profile described in section 3, and you can email support@anvillabs.app to ask what it contains or to have it deleted, as described in section 7. To limit ad personalisation, use the Android advertising ID controls described above or, on iPhone and iPad, the “Allow Apps to Request to Track” switch in iOS Settings → Privacy & Security → Tracking.

13. Changes to this policy

If this policy changes materially, the date at the top of this page will change and the updated version will be published here before the change takes effect in the app.

14. Contact

Anvil Digital Labs — support@anvillabs.app