Privacy and data

1. Scope of this policy

This information covers the published Chezur portal and its synthetic practice application in Spanish and English. Current features are free and guest access needs no email. Existing accounts retain access; email registration and recovery, payments and third-party ads remain disabled. Reading lessons requires neither broker credentials nor banking details.

The short demonstration within portal pages, optional My learning saving and the complete training application use different storage methods described below. Real historical data remains outside this public mode; training scenarios are generated and identified as synthetic.

2. Exercises and calculators during your visit

Understanding checks and calculators use your inputs in the browser to show feedback or results. The short demo holds the scenario, illustrative decision, objective and notes only while you use that page; it does not send them to the server as a training history.

The short demo and calculator values are not saved persistently. Reloading, leaving that page or switching languages discards that practice. Your browser may restore fields using its own features. This short-demo limitation does not apply to history in the complete application.

My learning offers optional local saving, initially disabled. Only after selecting Enable saving does this browser retain the chezur.learning.v1 key: the eleven lesson identifiers, review marks, check counts and whether a correct answer was recorded. It stores no answer text, names, email addresses or notes. Both languages share progress; it is not sent automatically to the server. Disable and clear it from My learning or your browser settings. Clearing can be undone while you remain on that page.

Structured order, cost and timeline activities are corrected in your browser. Without saving enabled, aggregate results last only for this visit. With optional My learning saving, chezur.applied-checks.v1 retains fixed case and lesson identifiers, counters, relative ordering, latest result and error codes; it stores neither answer values nor free text. It is not sent or copied to the account. Disabling and clearing local progress also removes this key; clearing data through Account includes it. You can undo clearing during the same visit to My learning.

If accounts are enabled and you are signed in, the account area lets you inspect and manually copy this progress between the browser and account, after confirming which destination will be replaced. The server copy contains only those eleven identifiers and their marks and counters, with a revision and update timestamp. There is no automatic synchronisation. Clearing the local copy does not clear the account copy, or vice versa; they are managed separately.

The complete training application uses guest access and stores its identifier, attempts, configuration and plan, actions, notes and simulated trades in a server SQLite database. You can recover practice, browse history, repeat a scenario as an independent attempt and compare both attempts after completion. Switching language or reloading retains access while its cookie remains valid.

To recover interrupted requests, the application also keeps creation identifiers and configuration, including the plan, and configuration drafts in browser local storage. Pending actions and note drafts use session storage. These records are tied to the user identifier to prevent sending them from another identity; they are separate from optional My learning progress.

Enabled accounts retain a name, email and password hash to check access, as well as their practices. When email registration is available, the request retains those details in a pending state and the version and date of explicit acceptance of the terms and privacy information; the account activates after email verification and confirmation of the password chosen in the request. Migration does not declare older accounts verified.

Verification and recovery links contain a single-use code that expires after 30 minutes. The database retains its hash, purpose and expiry, not the link code or plaintext passwords. Opening the link does not change the account: the operation must be confirmed. Resetting a password signs out every session and requires signing in again. Guest history can only be adopted with the original, still-valid access from the same browser; knowing an email address cannot recover it.

Use fictional examples and avoid entering sensitive information or other people’s data. Demo charts are synthetic and contain no personal information about market participants.

The skill panel requests your practice summary only when you press its button. That request does not create a guest or merge accounts. It shows counts of plans, notes, attempts and reviews and suggests an activity with its reason. Local marks, automatic corrections and personal reviews remain separate kinds of evidence; simulated profit is not used to infer competence.

3. Search and downloaded files

Search obtains a public catalogue of portal titles, summaries and paths. Matching against your search term takes place in your browser. It does not create an interest profile or use a personal account. Enter curriculum concepts without names, email addresses or other private information.

The query may appear in the page address and browser history. Sharing or reopening that address includes the term and could expose it in connection information. You can remove the query from the address before sharing it.

Downloadable templates are text files that you save and manage. Completing one on your device does not send its content to the portal. The training application lets you download a CSV containing your own trades from a completed session; this is not a complete export of all notes or the price catalogue. The location, copies and deletion of your downloads depend on your tools.

4. Contact by email

The Contact page lets you prepare a subject and message to open a draft in your email application. Preparing the draft does not send or store it on the portal. You decide whether to open, edit and send it to info@chezur.com through your email service.

If you send it, Jaime Castillo receives the data included in the message, such as sender address, subject, text and attachments you add. They are used to answer your enquiry, handle a correction or process your request. Contact does not add you to an advertising list or subscription.

Share only what is necessary to explain your enquiry. Do not send passwords, identity documents or banking details. If a request needs an additional identity check, a proportionate method must be specified.

5. Connection, cookies and external links

This version’s own code contains no visitor analytics, advertising, cross-site tracking or tracking cookies. Functional access uses a seven-day cookie with HttpOnly and SameSite=Lax. When unified accounts are enabled, its scope is Path=/, shared by the portal, account area and Training; HTTPS production uses the __Host- prefix and Secure. When accounts are disabled, the integrated installation retains a cookie limited to Path=/entrenar/, also Secure in production. Visiting a page does not constitute consent to new processing.

To deliver files, a server receives technical connection information such as IP address, requested resource and browser information. The preview cannot establish the final hosting configuration or its logs. Purposes, access and retention must be verified before launch.

External sources and tools open when you follow their links. Their operators apply their own policies. Chezur does not control how those sites process a visit or receive the contents of an account you have with them simply because you followed a link.

6. Purposes, retention and providers

The portal delivers content, calculates examples and, if you enable My learning, keeps local progress; copying it to an account is manual and requires confirmation. The application uses identity and storage to recover access, process actions and retain the requested history. An email you send is used to address your communication. The legal basis and conditions for each activity must be documented in the service review; browsing is not blanket authorisation.

While the service is running, periodic cleanup removes expired email actions and authentication sessions and deletes guest records created more than 30 days ago that no longer have a valid authentication session, along with their practices. This is measured from guest creation: it does not mean 30 days since the last visit or extend the seven-day access period. Registered accounts do not receive this automatic age-based deletion.

You can explicitly delete your account or guest access and its attempts and notes from the application access panel after confirmation. A pending subscription or payment operation must be resolved with the provider before account deletion. Deletion applies to the active database and does not retroactively erase operational backups. Actual retention of backups, messages and connection logs, and restoration, still require verification on the host; no storage country or unverified retention period is guaranteed.

Transactional email remains disabled in this free local phase. Only when transactional email is enabled and configured does Resend receive the recipient and verification, recovery or password-change notice. Verification and recovery messages contain the requested link; your password and practices are not sent to the email provider. The Contact form still opens a draft in your own email application.

Payments and Stripe remain disabled in this free local phase; no card is requested and no subscription is offered. Only when payments are enabled and legally ready does Stripe handle payment and subscription management on its pages. Chezur sends the email and an account reference, and retains customer, subscription and operation identifiers, price, status and dates to check access and prevent duplicates. Payment details are entered on Stripe; the application does not store the full card number. Test mode is identified and does not establish real charges.

Hosting and email providers, their locations, conditions and any international transfers must be identified before publication, alongside deletion periods or criteria. The policy will be updated for that configuration; this draft does not claim those checks are already complete.

7. Requests and your data rights

You can write to info@chezur.com to ask about data relating to a communication or practice, or exercise applicable rights. Depending on the processing, access, correction, deletion, restriction, objection and portability may apply. Where consent is used, you can withdraw it for that processing.

Describe your request and the minimum information needed to locate the communication or practice. Do not send passwords or your cookie value. The panel lets you export completed trades and delete training data; My learning separately clears local progress. Losing the cookie prevents guest access recovery through the current mechanisms. If more information is necessary for a request, the need will be explained.

You may also complain to the Spanish Data Protection Agency or the competent authority. The official AEPD guide linked below explains rights and how to exercise them. This text does not limit legally available procedures or safeguards.

8. Changes to privacy information

This version dated 25 October 2026 describes published features and distinguishes disabled providers. Public personal identity remains limited to the name while the required information is reviewed. Any new processing requires reviewing its information and applicable authorisations before activation.

Future Chezur development does not imply those activities already take place. Check a feature’s scope on its page and contact the project if you notice a difference between this policy and your experience.