Security & Privacy

How your account and data are protected, what P4 Provider keeps, and how to spot a scam.

Account security

• Login is email + password (minimum 6 characters) with a CAPTCHA challenge to stop bots. There are no social logins to hijack.
• Password reset links are single-use and expire; reset requests are rate-limited.
• Sensitive actions require your password again — deleting your account demands a fresh password confirmation and a recent sign-in.
• Two-factor authentication (TOTP) is mandatory for every staff account — admins, mentors, analysts, moderators, support agents. Staff can't even open their tools without it, and privileged server operations independently verify the second factor. Regular member accounts are not prompted for MFA.

Scam warning

This notice is shown automatically on every support ticket, and it's the single most important security fact to remember:

Keep your account safe. P4 Provider staff will never ask for your password or a one-time code, and never ask you to send money to a personal wallet or account. Pay only to the details shown on your invoice, and only ever inside this app or on p4provider.com.

The same principle covers brokers: for the referral programs, P4 states it "will never ask for your password" (Exness) and "will never ask for your API keys or password" (Binance). Anyone claiming to be P4 staff who asks for credentials, codes, or payment to a personal account is an impostor — report them via a support ticket or WhatsApp.

Also real: certificates can be faked, but verification can't — always check a claimed P4 certificate at p4provider.com/certificate/verify.

Privacy policy & who operates the service

• Privacy Policy: https://app.p4provider.com/#/privacy (public, no login needed) and p4provider.com/privacy.
• Terms of Service: p4provider.com/terms (drafted 2026-08-13, pending legal review).
• Community Guidelines: https://app.p4provider.com/#/guidelines (public).
• The operator: P4 Provider Private Limited, Faisalabad, Pakistan (owner-confirmed 2026-08-14) — "P4 Provider ('we', 'us') operates the P4 Provider app and website (p4provider.com), a trading education platform registered in Pakistan."

Who the service is for

Owner-confirmed 2026-08-14 (and stated in the Terms of Service):

• Purchases and trading-related features require you to be 18 or older.
• Free educational content may be used from age 13.

What data the app handles

From how the product actually works, your account holds: your name, email and password (for login); your optional public trader profile (username, bio, styles); your journal and portfolio entries; your community posts and messages; files you upload (avatars, payment proofs, chart screenshots, review media); payment records and order references; broker referral identifiers you submit (Exness account number / Binance UID) for free-signals verification; and notification preferences.

What the Google Play listing declares

The live Play Store listing's Data safety section states, verbatim (verified 2026-08-14):

"No data shared with third parties" · "This app may collect these data types: Location, Personal info and 3 others" · "Data is encrypted in transit" · "You can request that data be deleted"

Data deletion

You can delete your account yourself: Profile → Delete my account (password required, recent sign-in required, limited to 3 attempts/day). See Account setup for the steps. The privacy policy's key commitments:

• The process first blocks new uploads, then removes your owned files, account data, authored community content and the login itself. Legacy uploads that can't be safely linked require supervised support.
• Broker referral identifiers become anonymous "tombstones" — keyed, non-public records kept for fraud prevention for no more than 24 months, then deleted. The raw identifier is not kept in that record. (This is what enforces the "one broker account = one member" rule even after deletion.)
• Delivery history is deleted or stripped of identity.
• Staff and privileged accounts require a supervised access transfer instead of self-deletion.
• You may contact the team to request a copy of your data, corrections, or information about legally required retention and provider backup periods.

Payment safety

• Automatic payments run through Apple (iOS) or Binance Pay — P4 never sees your card or wallet credentials, and plan prices are verified server-side (the checkout never trusts the app's displayed price).
• Manual payments go only to the published MCB account, USDT address, or Binance Pay ID shown in-app — see Pricing.

Community safety

Every post passes automated safety checks before publishing; the composer bans guaranteed-return claims and any request for money, credentials, wallet keys or seed phrases; and you have Report / Block / Mute on every member. The guidelines commit to acting on reports within 24 hours. AI-operated accounts are always labelled ("Automated AI account operated by P4 Provider") and disclosed on the AI contributors page.

---

Next: Troubleshooting