KURUS Get the app
Kurus

Privacy Policy

Updated 20 September 2026

Covers meetkurus.com — the games (Buy the Dip, The Quant, Live a Life), the lessons (the Feed and the written library), the market page, and Your Number — and the Buy the Dip mobile app.

Who is responsible for your data

Kurus is operated by Serdar Gunduz, a sole proprietor. That operator is the data controller for everything described here, and is who you are dealing with when this page says “we”. A mailing address is available on request at [email protected]. Privacy questions and requests go to [email protected] and are answered by a person, usually within a few days and always within 30.

The short version

Kurus runs on your device. No account is required for anything. We do not sell or share your personal information and we show no ads. The website uses Google Analytics, which does set cookies; the mobile app does not, and none of it feeds advertising. The only personal information we ever hold is an email address — and only if you choose to give us one, for updates or for an optional Buy the Dip profile. Everything else that reaches our server is either something you chose to publish (a leaderboard handle), play-money game state under a random token, or an anonymous count.

What's stored on your device

Your saved games, best finishes, streaks, unlocked themes, lesson and Feed progress, and settings are kept in local storage on your device only — in your browser on the website, in the app's own storage in the mobile app. Clearing your browser's site data (or deleting the app) erases them permanently.

Your Number deserves its own sentence: the holdings you enter there — what you own and how much of it — are stored only on your device and are never uploaded. When the page fetches live prices, it always requests the entire list of supported symbols, so the request cannot reveal which ones you actually hold.

What leaves your device

A few requests happen, and none of them carries anything you typed about your real money:

  • Hosting: the site and the app's online features are served by Cloudflare, whose servers may log basic technical data (such as your IP address) as part of normal operation.
  • Leaderboards (only if you join one): if you claim a handle on a Buy the Dip leaderboard (all-time, daily, or a ranked season), the handle you choose, your score, and your run's public tape are stored on our server and shown publicly. Handles are chosen by you — don't use your real name if you don't want it shown.
  • Paper-book sync (The Quant): so your play-money book can survive a lost device and follow you between devices, The Quant saves your paper portfolio and trade history on our server under a random token — not your name, email, or any identifier of you. It is play money about invented company names; it says nothing about anything you really own. Ask us and we will delete it.
  • Usage metrics: anonymous, cookieless counts of in-game actions — opening a game, starting, resuming or finishing a run or lesson, passing a day, earning a bonus or a theme, opening a screen, and a few technical events such as the renderer dropping quality — each with a random per-device id that is not your identity, a coarse country, and the action name. Never your entries, and never a score tied to you. We honor Do-Not-Track and Global Privacy Control: if your device sends either signal, we record nothing — that covers the anonymous counts here and Google Analytics on the website, everywhere in the world, whether or not consent would otherwise be required.
  • Market data: the market page, The Quant, and Your Number fetch delayed, public market figures (prices, index levels, history, inflation and interest rates) through our own server, which gets them from market-data providers (currently Finnhub for stocks and gold, Coinbase for cryptocurrency prices, and the St. Louis Fed's FRED for economic series). Your request to us contains none of your information, and the providers are contacted by our server, not by your device.
  • Site analytics (website only): pages on meetkurus.com load Google Analytics 4, which sets cookies on your browser (names beginning _ga) and reports page views, referrers, approximate location and device type to Google, so we can see which pages are worth writing more of. Google processes it on our behalf. We do not use it for advertising, we belong to no ad network, and we do not sell or share the data. Pages also load Cloudflare Web Analytics, a cookieless page-view counter run by our host. Consent: in the EU, EEA and UK nothing is sent to Google until you agree — the tag is not even loaded before then. Elsewhere it runs by default, and you can turn it off at any time using the button at the bottom of this page. The mobile app contains neither — its build strips analytics out, and a test fails the release if any trace survives.
  • Fonts & icons: pages load fonts from Google Fonts and, on some pages, an icon stylesheet from the jsDelivr CDN — so opening them makes your device visible to those providers, as with most websites and apps.
  • Bot check (only on sign-in): if you create a Buy the Dip profile, the sign-in form loads Cloudflare Turnstile to check you're not a bot. It runs in your browser and reports only a pass/fail token to us. It sets no advertising cookies and does not track you across sites.
  • Link counters: short links like meetkurus.com/go/yt count how many times they were clicked — a plain number per day. No IP address, identity, or device information is stored with the count.

The Buy the Dip mobile app

The app is the same game, packaged for your phone. It contains no ads, no third-party analytics or tracking SDKs — no Google Analytics, no advertising or attribution kits of any sort — and no in-app purchases. The whole game is playable offline and needs no account.

The app goes online for five things, all of them described above and none of them required to play: the leaderboards, if you claim a handle; the optional profile sign-in, if you give us an email address for a magic link — which loads the Cloudflare Turnstile bot check on that screen only; the anonymous usage metrics; error reports if the game faults (the message, where it happened, and your device's browser-engine string — never your game data); and fonts from Google Fonts, which makes your device visible to Google the way most apps and websites do. If you sign in, your email is stored with your handle so the handle can survive a lost device. You can delete the whole account yourself, inside the app or the game — profile screen, DELETE ACCOUNT — which erases the account, the handle and every leaderboard row saved under it immediately.

The app can also ask permission to send you a daily reminder that a new tape is up. That is entirely opt-in, scheduled on your own device, and sends nothing to us — declining it changes nothing about the game.

Cookies & analytics

We use no advertising cookies and belong to no ad network. The website's Google Analytics does set its own cookies, described above — and in the EU, EEA and UK it does not load at all until you have said yes, because analytics cookies there need your permission first. Refusing is a single tap, exactly as prominent as accepting, and it is remembered so you are not asked again. Two kinds of counting happen, neither of which builds a profile of you: our own anonymous, cookieless event counts (a random device id that is not tied to your identity, a coarse country, and the event name — never your game, plan, lesson, or financial entries), and Cloudflare Web Analytics, a cookieless page-view service from our host that does not track you across sites. The only local storage we use is what saves your own progress.

Email (optional)

Two places may ask for an email address, both optional: signing up for updates, and creating a Buy the Dip profile (a magic-link sign-in that lets your handle survive a lost device). In both cases we store the address and the date you joined — nothing else — and use it only for that purpose. We never sell or share it. Every update email includes an unsubscribe option, and you can ask us to delete your address at any time.

Children

Anyone can play. The games, the lessons, the market page and Your Number need no account and collect nothing that identifies you, so there is nothing to stop a younger player using them — and a classroom of them.

Anything that involves a name or an email address is for 13 and over. That is the whole list: a Buy the Dip profile, a public leaderboard handle, and the email updates. Each asks you to confirm you are 13 or older before it collects anything. Kurus is not directed to children under 13, we do not knowingly collect personal information from them, and if we learn that an account or a handle belongs to someone under 13 we delete it and the rows saved under it.

If you believe a child under 13 has given us personal information, email [email protected] and we will delete it. For teachers: students can use every part of Kurus without an account, and we recommend they do — the classroom guide at for teachers says the same.

Service providers

We keep the stack small. Data leaves your device only to: Cloudflare (hosting, Web Analytics, the databases holding the anonymous usage events, leaderboard entries, synced paper books, and any profile email, and the Turnstile bot check on sign-in); Google (Analytics on the website, and Fonts everywhere) and jsDelivr (icons); and Google Gemini (only if you tap "still confused?" on a website lesson for an AI hint — your question goes server-side, never your saved data). Market-data providers — Finnhub, Coinbase, and FRED — are contacted by our server only and never see your device. We do not sell or share your data or use ad networks. The legal bases we rely on, and the rights you have over any of this, are set out under Your rights below.

How long we keep it

Nothing is kept “just in case”. Each thing has a life:

  • On your device — saves, streaks, settings, your Your Number holdings: until you clear the site's data or delete the app. We cannot reach any of it.
  • Anonymous usage events: up to 24 months, then deleted. They carry a random device id, never an identity.
  • Leaderboard entries (handle, score, public tape): for the life of that board or season, or until you delete the account they were saved under — whichever comes first. Deleting the account removes every row with it, immediately.
  • A Buy the Dip profile (email address, handle, progression): until you delete it. There is a DELETE ACCOUNT button in the profile screen and it works without contacting us.
  • Synced paper books (The Quant): until you ask us to delete them, or after 24 months with no activity on that random token.
  • Mailing-list address: until you unsubscribe or ask us to delete it.
  • Error reports: 90 days.
  • Link click counts: a plain number per day, kept indefinitely — there is nothing personal in it to keep.
  • Host logs (Cloudflare, may include an IP address): per Cloudflare's own retention, which is short and not under our control.

Where your data is handled

Our server runs on Cloudflare's network and the databases are hosted in the United States. Google (Analytics on the website, Fonts everywhere) also processes data in the United States and elsewhere. If you are in the EEA or the UK, that means your data may be transferred outside it; those transfers rely on the providers' standard contractual clauses and equivalent safeguards. The quantity is small by design — the honest summary is that we hold an email address only if you gave us one.

Your rights

Wherever you live, you can: see what we hold about you, correct it, delete it, get a copy of it, and object to or restrict how we use it. Most of it you can do yourself, immediately: clearing site data erases everything local, and DELETE ACCOUNT in the profile screen erases the account, the handle and every row saved under it. For anything else, email [email protected] — we answer within 30 days, and asking costs you nothing.

If you are in the EEA or the UK: the legal bases are consent (email updates; Google Analytics, which does not load there until you agree) and legitimate interests (running the features you chose to use, and anonymous aggregate counts to see which pages are worth writing more of). You may withdraw consent at any time, using the button below for analytics or the unsubscribe link in any email, and you have the right to complain to your local supervisory authority.

If you are in California: in the last 12 months we collected identifiers (an email address, only if you gave one) and internet activity (anonymous, cookieless usage counts and Google Analytics on the website), for the purposes described above. We do not sell your personal information and we do not share it for cross-context behavioural advertising — not for money, not for anything else, and we never have. You have the right to know, to delete, to correct, and to opt out; exercising any of them changes nothing about the service you get. We honour Global Privacy Control automatically, everywhere, as an opt-out signal.

Keeping it safe

Everything travels over HTTPS. The server holds as little as possible — that is the main defence, and it is deliberate. Sign-in is a magic link rather than a password, so there are no passwords to leak. Access to the databases is limited to the operator. No system is perfect: if a breach ever affected your personal information, we would tell you and the relevant authority as quickly as we could, and say plainly what happened.

Withdrawing permission has to be as easy as giving it, so it is one button:

Your control & changes

You can erase your on-device data at any time by clearing the site's data in your browser or deleting the app. If you created a Buy the Dip profile, you can delete it yourself at any time from the profile screen — DELETE ACCOUNT, then type DELETE to confirm — which erases the account, your display name and every leaderboard row saved under it straight away, with no need to contact us. For anything else stored on our server — a mailing-list address or a synced paper book — email us and we will delete it. We may update this policy; the date above marks the latest version.

Questions: [email protected]