Privacy

Last updated: September 2026

What is collected

• Your email address — so you can log in and recover access.
• A display name, if you choose to give one.
• A password hash. The password itself is never stored; it is hashed with scrypt and cannot be read back, by us or anyone else.
• Your simulated trading — positions, orders, trades, equity and replay position.
• Session records — when you signed in, from roughly what IP address, and the browser user-agent, so a login can be revoked.

What is not

No analytics, no advertising, no tracking pixels, no third-party scripts on the pages you see after signing in, and no cookies beyond the one that keeps you logged in. Nothing is sold or shared with anyone.

Cookies

One: a signed session cookie holding an opaque session id and nothing else. It is marked HttpOnly, Secure and SameSite=Lax, and it expires after 30 days. Clearing it logs you out.

Where it lives

On a single server, in a database reachable only from that machine, with nightly backups kept for seven days. Traffic is encrypted end to end.

Deleting your account

Ask, and the account and everything attached to it — sessions, trades, reports — is deleted. Not anonymised or archived; the rows are removed, and the next backup rotation takes the last copies with it.

Contact

Questions about any of this go to the address on the about page.