Privacy & Data

We store your email address, a hashed password, and the paper-trading data you create here. That's it.

We never ask for exchange API keys, payment details, your real name, your phone number, or your address — and there is nowhere in this system to put them. That isn't a policy we're promising to follow; it's a consequence of the site being paper-only. The worst case for a breach here is an email address and some simulated trades.

On the server running this site — not on your own computer. That's the main difference between this and the the desktop app application, whose data never leaves the machine it's installed on.

On memory, plainly: the notes are things you deliberately asked to be stored, so they are stored. Your questions are a different matter — keeping every one of them would make the AI marginally better and was never something you agreed to, so that one is a switch you have to throw yourself, and it starts off.

Each account's files live in a separate folder, and the code refuses to read or write per-user data unless it knows which user the request belongs to — it raises an error rather than guessing. That's deliberate: a crash is recoverable, one person seeing another's data isn't.

• Exchange API keys or credentials. Never requested. There is no field for them and no code to use one.
• Payment details. None are taken.
• Your real name, phone number or address. Not asked for.
• Analytics, tracking pixels, advertising or third-party trackers. None on any page.
• Telemetry. The site does not report your usage anywhere.

One cookie: a signed session cookie that records you're logged in. It's marked HttpOnly (JavaScript can't read it) and SameSite=Lax (other sites can't make your browser use it). It's strictly necessary for signing in — there are no optional or advertising cookies, which is why this site has no cookie banner.

Signing out clears it.

Market prices come from public exchange and market-data APIs. Those requests are made by the server, not by your browser, so those providers don't see your IP address or anything about you — they see one server asking for prices.

If the site operator has enabled AI explanations, the question you type is sent to Anthropic's API to be answered, along with your remembered notes and — only if you switched recall on — your recent questions. Nothing is sent unless you press the button on a question the app couldn't answer by itself. Commands like “add SOL” or “status” are handled entirely on this server and are never sent anywhere.

Your data is not sold, rented, or shared with anyone. There is no advertising on this site and no arrangement under which there could be.

Your account page has a delete button. It requires your password again, and it is a real deletion: the account record and every file belonging to you are removed from the server.

The code verifies the data is actually gone and reports an error if it isn't, rather than telling you it succeeded. If deletion ever fails you will be told so plainly — you'd have no way to check otherwise.

In place today:

• Passwords hashed with PBKDF2-HMAC-SHA256, 600,000 iterations, per-account salt
• Accounts lock for 15 minutes after 5 failed sign-ins
• Per-account data isolation, enforced in code rather than by convention
• Session cookies signed with a key generated on the server, never shipped in the source

Not yet in place, and worth knowing:

• No email verification. Nothing currently proves an address belongs to the person who typed it.
• No password reset. If you forget your password, the account cannot currently be recovered. Choose one you'll remember.
• Backups. Ask the operator what backup arrangements exist before storing anything you'd be upset to lose. It's a simulator, so the answer matters less than it would elsewhere — but you should know.

These are listed because a security section that only lists strengths isn't information, it's marketing.

Depending on where you live you may have rights to access, correct, export, or delete your data, and to object to certain processing. Deletion is built in and available to you directly. For anything else, contact the operator using the address on the Terms page.