Privacy Policy

Who we are

Investment Bets is a paper-trading game at investment-bets.com. No real money is traded. The data controller for the personal data described here, except the purchase data Stripe collects as the seller of our upgrades, is the operator of Investment Bets, reachable at [email protected].

What we collect

Account data: your username, email address, and password. Passwords are stored only as salted hashes — we cannot read them. If you use Sign in with Google, we also store the stable account identifier Google sends us: an account created through Google has no password until you choose to set one under PROFILE, and an existing account you link to Google keeps its password. Your Google password never reaches us.

Paper-trading activity: the bets you place (ticker, direction, entry and exit prices, dates, resulting percentage performance, and the optional one-line thesis you write for a bet — cancelled bets are recorded at break-even) and the traders you follow.

Billing data: optional upgrades are sold through Stripe's merchant-of-record service, shown at checkout as "Sold through Link". Stripe, not Investment Bets, is the seller and is responsible for the data it collects for the purchase (your name, email address, billing address, and payment details); it handles the payment, sales tax and VAT, receipts, refunds, and billing support. In our Stripe account we see only what Stripe shares with businesses under its privacy policy (contact and purchase details and limited payment-method information, never your full card number or security code), and we use it only to manage your subscription and answer billing questions. Our own servers keep only your Stripe customer and subscription identifiers, your subscription's status, and the capacities your plan grants.

Telegram link (optional): if you connect Telegram notifications, we store the numeric chat identifier needed to send them, nothing else from your Telegram account.

Technical data: Cloudflare (our CDN and security provider) processes request metadata — IP address and browser user agent — to serve and protect the site. Our own servers do not keep request logs.

Why we process it

Account, trading, billing, and sharing data are processed because they are what the service you signed up for consists of (performance of contract).

Security screening and aggregate analytics rest on our legitimate interest in keeping the site available, fast, and abuse-free.

Telegram notifications are processed only with your consent, which you give by linking the account and withdraw by unlinking it.

What is public

Your username and your closed-trade performance appear on the public leaderboard, and your public profile additionally shows your currently open calls — ticker, direction, entry and current prices, unrealized gain, and dates — and the thesis you wrote for any call, open or closed. You can hide all of it with the leaderboard visibility toggle in your settings.

Share links you create grant read access to the same track record — open calls and theses included — to anyone who has the link, including while your profile is otherwise private, and let signed-in holders follow your account. You can rotate the link at any time from settings.

After you rename your account, your previous username is reserved for 90 days so nobody can impersonate your old handle.

Cookies and local storage

We set one essential cookie (auth_token) that keeps you signed in for up to 7 days. It is HttpOnly and used only to authenticate you; our cache layer also checks for its presence to make sure signed-in pages are never served from the shared public cache. While you sign in with Google, our API sets one or two more short-lived HttpOnly cookies (five minutes at most) that tie that sign-in, and the linking of an existing account, to your browser; they expire on their own. There are no advertising or cross-site tracking cookies.

Your browser's local storage caches your session details so the app loads faster; it stays on your device and is cleared when you sign out.

Analytics

We use Cloudflare Web Analytics, a privacy-first, cookieless tool. It reports aggregate page metrics (visits, load performance) and does not build individual profiles or track you across sites.

Third parties

Sign in with Google (optional): if you use it, your browser loads Google's sign-in script on the sign-in page and Google handles the sign-in itself under Google's privacy policy (policies.google.com/privacy), including any cookies Google sets in its own sign-in window. Google then tells us your verified email address and a stable account identifier, and we store those two things and nothing else from your Google account. To disconnect Google from an account that also has a password, email us and we will do it manually.

Stripe sells our optional upgrades as merchant of record and processes the payments; it is responsible for the purchase data it collects, under its own privacy policies (stripe.com/privacy and, for checkout, link.com/privacy). Cloudflare provides our CDN, security, and analytics. Telegram receives messages only if you choose to link it. Resend delivers the password reset emails you ask for: it receives your email address and your password reset email. Market-data lookups we make to price your bets contain ticker symbols, never your personal data. Our servers are located in the EU.

If you connect a third-party client or AI agent to your account (including agents built from our published demo), it acts with the credentials you give it, on your device or infrastructure. Whatever you share with the tool itself, and whatever it forwards to its own providers (for example, prompts, keys, or account data sent to the AI model provider you configure), is processed under that tool's and those providers' policies, not ours — that exchange happens from wherever the tool runs, without routing through our servers. The API requests the tool makes to Investment Bets, including signing in with your password, reach us and are covered by this policy, exactly as if you had made them yourself.

We do not sell your data or share it with advertisers.

Retention and deletion

We keep your data while your account exists. To delete your account and its data, or to request a copy of it, email [email protected] from your registered address and we will handle it manually. Deleted data can persist in our database backups for up to 12 months before those backups expire. Purchase records Stripe holds as the seller are deleted through Stripe: ask Link's support (support.link.com), which also cancels any subscription bought that way.

Your rights

If you are in the EU/EEA or UK, you have the right to access, correct, export, delete, or object to the processing of your personal data, subject to the conditions and exceptions the GDPR provides. Wherever you are, we honour the same requests: contact [email protected]. You also have the right to complain to your local data-protection authority.

Changes to this policy

We will update this page when our data practices change. Last updated: October 5, 2026.