Privacy Policy
How The Hideout collects, uses, protects and deletes your personal information, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
1. Who We Are
The Hideout (“we”, “us”) runs thehideouthq.app, a members' website for The Hideout trading community. For the personal information described here, the personal information controller is The Hideout.
Privacy questions and requests: privacy@thehideouthq.app.
2. What We Collect and Why
| Information | Why we need it |
|---|---|
| Email address, username, password | To create and secure your account. Your password is never stored in readable form; our authentication provider keeps only a one-way hash. |
| Date you accepted the Terms and this policy | To record your consent. |
| Two-step login setup (if you turn it on) | To check the 6-digit code from your authenticator app. We never see or store those codes. Your backup codes are stored only as one-way hashes, so nobody at The Hideout can read them. |
| Inner Circle application: who referred you, MEXC UID, the email on your MEXC account, your confirmations, and a screenshot of your deposit or balance | Only to review your application or renewal: that your MEXC account is registered with the referral code of whoever referred you (mexc-HIDEOUT or a Hideout partner's code) and holds the required deposit or balance, and to credit that partner. You give this with a separate, unticked consent box. |
| Phone or browser alerts, if you turn them on: a delivery address your browser creates for this site | Only to send you alerts about new signals, TP hits and team posts. The alert shows a title and a short line; the post itself stays behind your log-in. Turn alerts off in the bell, or delete your account, and the address is removed. |
| Your Discord username (asked when you apply for Inner Circle or claim the Alpha Program role) | Only so the team can find you on Discord, give or remove the Inner circle role, and check an Alpha Program claim against the batch list. Only founders see it. You can change it on the Inner Circle page. |
| Alpha Program attendance: whether you tapped Present in each attendance check, and any request to rejoin | Only to run the Alpha Program: students who miss a check lose the Alpha role, and the team uses your absences to decide a rejoin request. You and the founders see it. |
| Review decisions and notes, access dates, Discord role to-do items | To run your Inner Circle access (30-day terms, renewals, expiry) and keep the Discord role in step. |
| Signals you mark as entered (with the ROE, PNL and note you choose to add) and your leaderboard choice | To show your own stats on your Account page. The team sees entry totals per signal. Other members see your username and stats on the Inner Circle leaderboard only if you turn it on. |
| Academy progress: lessons done, quiz scores, certificates and the name you put on one | To save your place and issue certificates. Anyone you give a certificate link to sees the course, the date, your username and that name. |
| A testimony you choose to write | To show it publicly on the homepage and the Testimonies page, with your username, role and the month you joined, once a founder approves it. You tick a box agreeing to this when you send it, and you can remove it any time from your Account page. |
| Support tickets: the topic, title and messages you write, and the team's replies | To answer your questions. Only you and the founders can read a ticket. |
| Chat rewards: how many of your chat messages counted in each 2-week round, and, if you win and claim, the MEXC UID you enter | To rank the most active members and send the USDT reward to your MEXC account. The UID is encrypted by our website like your application UID; only founders can read it, to send the payout. Your username and place are shown to signed-in members. |
| Learn season points: the videos you watch and the workshop and quiz scores you get each season | To rank members each month and award the season prizes. Your username, season rank and points are shown to members and, for the top 5, on the public homepage, unless you turn off “Show my name on the Learn leaderboards” (then you show as “Hidden trader”). |
| Bounty claims: the proof links and screenshot you send, and the MEXC UID you enter | To check that the task was done and send the reward. Only you and the founders can see a claim; the UID is encrypted by our website like your application UID. |
| Security records: log-ins, team actions, and every time a founder opens an application | To protect accounts, investigate problems and show who accessed what. |
| Technical data from your browser (IP address, device and browser signals) | Processed by our providers to deliver the site and to tell people from bots on the log-in, sign-up and reset forms. |
We do not collect your MEXC password, API keys, wallet addresses or seed phrases, and we will never ask for them. We don't use advertising or analytics trackers, and we don't sell or rent personal information.
3. Legal Basis
- Your account: to provide the service you signed up for, under our Terms of Use.
- Inner Circle data: your specific consent, given on the application form. You can withdraw it (see section 8); we then stop reviewing and delete the application data.
- Security records: our legitimate interest in keeping accounts and member data safe, and legal obligations such as breach notification.
4. How We Protect It
- Encrypted connections only (HTTPS with HSTS).
- Your MEXC UID and application email are encrypted by our website before they reach the database, with a key the database never holds.
- Screenshots are redrawn as a new image on upload, which removes hidden data such as location, and stored in a private vault with no public link.
- Database rules decide who can read what: you see only your own data; only founders signed in with two-step login can open applications.
- Every founder must use two-step login. Every time a founder opens an application, it is recorded.
- Log-in cookies can't be read by scripts on the page, and log-in, sign-up and reset forms are protected against bots.
No system is perfectly secure. If a breach affects your information, section 9 explains what we do.
6. How Long We Keep It
- Deposit and balance screenshots: deleted automatically 30 days after the team's decision (approve, reject or change request).
- Application records (encrypted MEXC UID and email, decision, notes, dates): kept while your account exists, so renewals and disputes can be handled; deleted immediately when you delete your account.
- Account information, access history, two-step login setup, signal entries and academy progress: kept until you delete your account, then deleted immediately.
- Discord username after deletion: if you delete your account while you have (or may still have) the Inner circle role, we keep only your username for up to 30 days so the team can remove the role.
- Profile photo (optional): shown only to signed-in members (chat, leaderboards, top bar). Kept until you replace or remove it, or delete your account; the old file is deleted straight away. Day in the Hideout story photos are deleted when the story ends.
- Trade journal: your trades, chart screenshots and the names of any journal accounts you open. Private to you (nobody else, including the team, sees it on the site). Kept until you delete a trade or your account; chart screenshots are deleted with the trade.
- Notifications, badges and visit days: notifications are deleted after 60 days; badges and the days you opened the site (used for streaks and active-member counts) are kept until you delete your account.
- Chat messages: deleted automatically 30 days after they're posted (sooner if you or the team delete them). Reports about messages are kept up to 90 days. If you delete your account, your messages are deleted with it.
- Testimony: kept until you remove it or delete your account. Editing it takes it off the site until a founder approves the new version.
- Support tickets: deleted 180 days after the ticket is closed, or when you delete your account.
- Chat rewards: wins, claims and payout records (including the encrypted MEXC UID) are kept until you delete your account, so payouts can be checked.
- Learn season points and prizes: kept until you delete your account, so past seasons and payouts can be checked.
- Bounty claims: the screenshot is deleted 90 days after the claim is paid or not approved; the rest of the claim (links, encrypted UID, amount, decision) is kept until you delete your account.
- Security and audit records: kept for up to 2 years (proposed), then deleted.
- Email delivery records: kept for up to 90 days (proposed).
7. Emails We Send
We email you only about your account and Inner Circle access: confirming your email, password resets, application results, renewal reminders 7 days and 1 day before your access ends, a note when it ends, and one last email confirming it if you delete your account. These are part of the service. We never ask for your password, two-step codes or funds by email.
8. Your Rights
Under the Data Privacy Act you have the right to:
- be informed about how your personal information is processed;
- access it and get a copy in a commonly used format;
- have inaccurate information corrected;
- object to processing, or withdraw consent for Inner Circle data;
- have your information erased or blocked;
- be compensated for damages caused by unlawful processing; and
- file a complaint with the National Privacy Commission (privacy.gov.ph).
You can download a copy of your data or delete your account yourself, any time, on the Your data page (log in first; we ask for your password again). Deleting your account also withdraws your consent for Inner Circle data.
For anything else, email privacy@thehideouthq.app from the address on your account. We may ask you to confirm it's you, and we reply within 30 days. You can correct your application details yourself whenever the team asks for a change.
9. If Something Goes Wrong
If a security breach affects your personal information, we contain it, work out what was affected, and notify the National Privacy Commission and affected members within 72 hours where the law requires, with what happened and what you should do.
10. Age
The Hideout is for adults. You must be at least 18 to create an account. We delete accounts we learn belong to anyone younger.
11. Changes to This Policy
When we change this policy we update the date at the top. If a change affects how we use information you already gave us, we tell you by email or on your dashboard first. See also our Cookie Policy and Terms of Use.