Privacy Policy

Who we are

Investment Bets is a paper-trading game at investment-bets.com. No real money is traded. The data controller for the personal data described here is the operator of Investment Bets, reachable at [email protected].

What we collect

Account data: your username, email address, and password. Passwords are stored only as salted hashes — we cannot read them.

Paper-trading activity: the bets you place (ticker, direction, entry and exit prices, dates, and resulting percentage performance — cancelled bets are recorded at break-even) and the traders you follow.

Billing data: payments for optional upgrades are handled entirely by Stripe. Our servers store only your Stripe customer and subscription identifiers and the capacities your plan grants — your card details never reach us.

Telegram link (optional): if you connect Telegram notifications, we store the numeric chat identifier needed to send them, nothing else from your Telegram account.

Technical data: Cloudflare (our CDN and security provider) processes request metadata — IP address and browser user agent — to serve and protect the site. Our own servers do not keep request logs.

Why we process it

Account, trading, billing, and sharing data are processed because they are what the service you signed up for consists of (performance of contract).

Security screening and aggregate analytics rest on our legitimate interest in keeping the site available, fast, and abuse-free.

Telegram notifications are processed only with your consent, which you give by linking the account and withdraw by unlinking it.

What is public

Your username and your closed-trade performance appear on the public leaderboard, and your public profile additionally shows your currently open calls — ticker, direction, entry and current prices, unrealized gain, and dates. You can hide all of it with the leaderboard visibility toggle in your settings.

Share links you create grant read access to the same track record — open calls included — to anyone who has the link, including while your profile is otherwise private, and let signed-in holders follow your account. You can rotate the link at any time from settings.

After you rename your account, your previous username is reserved for 90 days so nobody can impersonate your old handle.

Cookies and local storage

We set a single essential cookie (auth_token) that keeps you signed in for up to 7 days. It is HttpOnly and used only to authenticate you; our cache layer also checks for its presence to make sure signed-in pages are never served from the shared public cache. There are no advertising or cross-site tracking cookies.

Your browser's local storage caches your session details so the app loads faster; it stays on your device and is cleared when you sign out.

Analytics

We use Cloudflare Web Analytics, a privacy-first, cookieless tool. It reports aggregate page metrics (visits, load performance) and does not build individual profiles or track you across sites.

Third parties

Stripe processes payments (see Stripe's own privacy policy for how it handles your card data). Cloudflare provides our CDN, security, and analytics. Telegram receives messages only if you choose to link it. Market-data lookups we make to price your bets contain ticker symbols, never your personal data. Our servers are located in the EU.

We do not sell your data or share it with advertisers.

Retention and deletion

We keep your data while your account exists. To delete your account and its data, or to request a copy of it, email [email protected] from your registered address and we will handle it manually. Deleted data can persist in our database backups for up to 12 months before those backups expire.

Your rights

If you are in the EU/EEA or UK, you have the right to access, correct, export, delete, or object to the processing of your personal data, subject to the conditions and exceptions the GDPR provides. Wherever you are, we honour the same requests: contact [email protected]. You also have the right to complain to your local data-protection authority.

Changes to this policy

We will update this page when our data practices change. Last updated: August 21, 2026.