Privacy Policy

FakeTrade is operated by an individual (the "Operator"). The Operator does not disclose a company name, registered office, or postal address. All correspondence -- including data-protection requests -- happens through a single email address: contact@faketrade.fun.

For the purposes of the EU General Data Protection Regulation (GDPR), the Operator is the data controller for personal data processed through FakeTrade.

We process your personal data under the following lawful bases (GDPR Article 6):

• Art. 6(1)(b) -- performance of a contract: running your account, persisting your virtual balance, order book, leaderboard rank, etc., so the simulator works as advertised.
• Art. 6(1)(f) -- legitimate interests: fraud prevention, abuse detection, and the minimum infrastructure logs needed to keep the service available and secure.

Authentication data (via Supabase Auth)

• Your email address.
• If you sign in via Google OAuth: your Google profile data, specifically your display name and avatar URL.
• Your user ID (a UUID generated by Supabase).
• For email/password accounts (if used): your password is stored only as a bcrypt hash. We never see the plaintext.
• Auth metadata maintained by Supabase: account creation timestamp and last sign-in timestamp.

Application data

• The username you choose for the leaderboard.
• Your simulated balances (ranked and practice/unranked).
• Your order history, position history, and trade history inside the simulator.
• A leaderboard-exclusion flag used for admin and test accounts so they do not appear on the public leaderboard.
• The timestamp at which you accepted these legal documents (see the registration acceptance flow).

Infrastructure data (collected automatically by our processors)

• Vercel (hosting) records server logs covering your IP address, user-agent string, and requested paths.
• Cloudflare Workers (price engine) records request logs for the simulator's pricing worker, including IP and the requested URL.
• Supabase (auth + database) records auth and database logs.

Cookies (strictly necessary only)

We do not use analytics or marketing cookies, so we do not show a consent banner. The cookies we do set are strictly necessary to provide the service:

• sb-* -- Supabase Auth session cookies. Without these you cannot stay logged in.
• market_mode -- remembers whether you last viewed the Crypto or Stocks markets (1-year lifetime).
• Vercel technical cookies used for caching and routing.

What we do NOT collect

• No analytics: no Google Analytics, no Facebook Pixel, no Hotjar, no session-replay tools.
• No marketing tracking and no behavioural profiling.
• No sale of your data to third parties.
• No real money, financial, or payment data -- FakeTrade is a simulator and does not process payments.
• No marketing emails. The only emails we send are transactional (account confirmation, password reset).

We use a small set of providers to actually run the service. Each acts as a data processor on our behalf:

• Supabase -- authentication and database (supabase.com/privacy).
• Vercel -- hosting and edge network (vercel.com/legal/privacy-policy).
• Cloudflare -- the Workers runtime that powers the price engine (cloudflare.com/privacypolicy).
• Google -- only if you sign in via Google OAuth (policies.google.com/privacy).

To run the simulator we pull live price data from public market-data APIs. These providers see only the symbols we request (e.g. BTCUSDT, AAPL) and our own server's IP. They do not receive your account, identity, or personal data:

• Finnhub -- US stock quotes via the IEX feed.
• Polygon.io -- historical stock candles.
• Binance public market-data API and binance.vision -- cryptocurrency prices.
• Coinbase public API -- cryptocurrency price fallback.

Our processors operate globally. In particular, Supabase stores production data in the United States (region us-east-1) and Vercel runs on a global edge network. Where personal data leaves the European Economic Area, we rely on the European Commission's adequacy decisions where applicable and on standard contractual clauses (SCCs) where they are not. We flag this honestly: if EU-only data residency is critical for you, FakeTrade may not be the right service.

We keep account data (profile, balances, order/position history) for as long as your account exists. Infrastructure request logs from Vercel and Cloudflare are retained per their default policies -- typically around 30 days. If you delete your account, your profile and trading history are removed from our database; backups and infrastructure logs may persist for a short period before they roll off.

If you are in the EU/EEA (and in many other jurisdictions with similar laws) you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data rectified.
• Have your data erased (the "right to be forgotten").
• Receive your data in a portable format.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, write to contact@faketrade.fun. We answer within a reasonable time and, in any event, within the deadlines GDPR sets for us.

We use Supabase Row-Level Security and database-level functions to make sure your account data can only be read and modified by you (or by privileged backend processes that run the simulator). Passwords are stored hashed; OAuth tokens are scoped and short-lived. No system is perfectly secure, but we make a reasonable effort.

We may update this Privacy Policy over time. The "Effective date" at the top reflects the latest version. Material changes will be announced on the site.

For privacy questions or to exercise your rights, contact contact@faketrade.fun. See also our Terms of Service and Risk Disclaimer.