Privacy Policy

Cipher30 (the Cipher30 Mentorship) is a trading-education mentorship for US30 and Gold traders, run from Cape Town, South Africa. Cipher30 is a trading name of Saood Williams, a sole proprietor. Under the Protection of Personal Information Act, 2013 (POPIA), Cipher30 is the responsible party for the personal information collected through this website and the member area.

Information Officer. Cipher30 is headed by its founder, who is our Information Officer by default under section 55 of POPIA. You can reach the Information Officer about anything in this policy: email us or message us on Discord (opens in a new tab).

We only collect what we need to run your account, deliver the course and keep the service secure.

Account detailsYour name, email address and password. The password is stored only as a one-way hash, so nobody at Cipher30 can read it.

WhyTo create your account, sign you in and contact you about it.

Google sign-in (optional)If you choose “Continue with Google”, Google shares your name, email address, profile picture and a Google account ID with us, and we store the sign-in tokens Google issues. We never see your Google password.

WhyTo sign you in without a separate password, because you asked us to.

Membership statusWhether your account is a free or member account, whether you have accepted our terms, and when the account was created and last updated.

WhyTo unlock the modules and member tools you paid for, and to show that you accepted the terms.

Payment recordsPayment is arranged by message on Discord and made by EFT / bank transfer. We keep the details that come with your payment, such as the amount, date, payment reference and payer name.

WhyTo confirm your payment, grant access, keep the financial records the law requires and resolve disputes.

Learning progressWhich lessons you have started or completed.

WhySo you can pick up where you left off and see your progress.

Trade journal entriesOnly what you choose to save in the journal: instrument, prices, dates, position size, profit or loss, notes and strategy tags.

WhyTo provide the journal tool. We do not review your trades and do not use journal entries for marketing.

Messages you send usEmails and Discord messages, including questions, payment arrangements, refund requests and privacy requests.

WhyTo answer you and keep a record of what was agreed.

Terms acceptance recordWhen you accept our terms: your name and email, the date and time, the version you accepted and your IP address.

WhyProof of what you agreed to, for example in a refund or payment dispute. Kept while your account exists and for as long as we may need it to resolve a dispute.

Technical dataYour IP address and basic browser information when you load pages. Our server logs can also record your email address when you use account features, and a password-reset link is valid for one hour.

WhyTo deliver the site, block abuse (we briefly use IP addresses to rate-limit requests), investigate errors and keep accounts secure.

Information that stays on your device. Some member tools (the pre-trade checklist log, the prop-firm tracker, Mind Arena scores and a cache of your lesson progress) save to your browser’s local storage. That information is not sent to us, and clearing your browser data removes it. The Cookie Policy lists what the site stores on your device.

Discord. Our community runs on Discord, which handles your Discord account under its own privacy policy. Inside our server, we and other members can see your Discord username, profile and anything you post.

POPIA (section 11) only allows processing on a lawful basis. We rely on:

• Our agreement with you: creating your account, delivering the course and member tools, arranging payment and supporting you.
• Legal obligations: keeping financial and tax records, and responding to lawful requests.
• Legitimate interests: keeping the service secure, preventing abuse and fraud, and keeping records that show access was delivered in case of a dispute.
• Your consent: Google sign-in, optional cookies, and anything else we ask you about specifically. You can withdraw consent at any time. Withdrawing it does not affect what was done before.

We do not sell or rent personal information, we do not use it for advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

We send account emails, such as password-reset links. When we publish a new market update on the site, registered users may also get an email letting them know.

To stop update emails, email us or message us on Discord (opens in a new tab) and we will take you off the list. Account and security emails continue while you have an account.

We share personal information only with service providers that process it for us (POPIA calls them operators), or where the law requires us to. Each provider gets only what it needs for its job:

• Vercel: hosts the website and keeps short-lived server logs.
• Supabase: our database (account, membership, progress and journal data).
• Sanity: our content system. It holds a copy of your name, email address, profile-picture link and membership status so we can manage access, plus any pending password-reset link. Your terms-acceptance records (name, email, date, terms version and IP address) are kept there too.
• Resend: delivers our emails.
• Upstash: short-lived rate-limiting records keyed to IP address.
• Google: only if you choose Google sign-in.
• Mux: streams the course videos. Only if you allow optional content in Cookie settings does the player also send playback-quality data (such as start-up time and buffering) to Mux.
• TradingView: the chart on the member market page loads from TradingView in your browser, only once you allow optional content or choose to load it.
• Discord: our community and how payment is arranged. The home page also loads our live member count from Discord in your browser.
• Banks: EFT payments are processed by your bank and ours.

The site also pulls in market prices, news and an economic calendar from third-party data feeds. Our server makes those requests, and none of your personal information is sent with them.

We may also disclose information if the law requires it, or where it is needed to protect our legal rights, for example in a payment dispute.

Several of these providers store or process information outside South Africa, for example in the United States or the European Union. We only transfer personal information across borders where section 72 of POPIA allows it. In practice, the transfer is needed to provide the service you signed up for, and we use providers that publish data-protection terms committing them to protect the information they process for us.

If you type your email into the “Leave your email” form and tick the box, we keep your email address, the date and time, the page you were on and the exact wording you agreed to. We send one email asking you to confirm it was you. Once you confirm, Cipher30 may email you about the mentorship.

• The box is never ticked for you, and we only email you if you asked us to (POPIA section 69).
• We do not sell, rent or share your email. It is stored with our hosting provider (Upstash) and sent through our email provider (Resend), who only process it for us.
• Every email has a link that deletes your address straight away. You can also ask us to remove it any time: email us or message us on Discord (opens in a new tab).
• We keep it until you remove it, or delete it ourselves if you haven’t confirmed within 30 days.

We keep personal information only as long as we need it for the reasons above:

• Account, progress and journal data: while your account is open. If you ask us to delete your account, we delete it from our database and content system.
• Payment records and proof that you accepted our terms: for as long as tax and accounting law requires (generally five years), and for as long as needed to resolve any dispute.
• Emails left on the site: until you remove them; unconfirmed ones are deleted after 30 days.
• Password-reset links: expire after one hour.
• Rate-limiting records and server logs: short-lived, cleared automatically by the provider.
• Discord messages: stay in our server until you or we delete them. Deleting your Cipher30 account does not delete your Discord account.
• Browser storage: stays on your device until you clear it.

• Connections to the site and to our database are encrypted (HTTPS / TLS).
• Passwords are stored only as one-way hashes.
• Course content and member tools are locked to member accounts.
• Repeated requests from the same address are rate-limited to slow down abuse.
• We never store card details, banking passwords or online banking credentials.

No system is perfectly secure, so please use a strong password you don’t use anywhere else. If we have reasonable grounds to believe your personal information has been accessed by someone without authority, we will tell you and the Information Regulator, as section 22 of POPIA requires.

Under POPIA you have the right to:

• ask whether we hold personal information about you, and get a copy of it;
• ask us to correct information that is wrong, incomplete or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing based on our legitimate interests, and to direct marketing;
• withdraw any consent you have given; and
• complain to the Information Regulator.

You can correct the name on your account yourself on your Profile page. For anything else, such as changing your email address, getting a copy of your information or deleting your account, email us or message us on Discord (opens in a new tab). We may need to confirm it’s really you, for example by asking you to write from the email address on your account. We aim to respond within 30 days.

If you are unhappy with how we handled your information, please tell us first so we can try to put it right. You can also complain to the Information Regulator (South Africa) (opens in a new tab).

Cipher30 is designed for adults. If you are under 18, a parent or guardian must consent before you create an account or send us personal information. If we learn that we hold a child’s information without that consent, we will delete it.

Essential cookies keep you signed in and protect forms. Anything optional only runs if you allow it. The Cookie Policy explains each one, and you can change your choice at any time in Cookie settings.

If we change how we handle personal information, we will update this page and the date at the top. For significant changes, we will also let members know by email or on Discord.