Privacy Policy
Last updated 2026-10-20.
Who is responsible
OneStonks, N/A, contactus@onestonks.app.
What we collect and why
| Data | Purpose | Basis |
|---|---|---|
| Email address, username, hashed password | Create and secure your account, verification and password reset emails | Contract |
| Confirmation that you are old enough (your birth date is checked and then discarded, not stored) | Age limit | Legal obligation, legitimate interest |
| Game activity: wallets, holdings, trades, orders, short positions, watchlist, badges, season results, notifications, restarts, net worth history, achievements, proposals and votes, and the Stonkverse suggestions you make or vote for | Run the game, leaderboards and your portfolio | Contract |
| Invitations: your personal invitation code, who invited you and whom you invited (usernames, and the dates each friend joined and became active), and the in-game fee share paid to you if that option is on. The code of an invitation link you opened is kept in your login session until you sign up | Give the invitation rewards and prevent abuse | Contract, legitimate interest |
| Alerts on a device, only if you turn them on: the address and keys your browser gives us for that device, its time zone and a short name (browser and system), your alert settings, the alerts waiting to be sent and when the last ones were sent | Send the few alerts you asked for (orders and shorts, optionally updates), within a daily limit and outside your quiet hours | Consent (you turn it on and can turn it off at any time in Account) |
| Preferences and account activity: language, cosmetic choices, your privacy switches, the time of your last login | Remember your settings and keep the account secure | Contract |
| Messages you send through the Feedback form (text, type, optional Stonkverse, the page you came from) | Read and act on your ideas, bug reports and reports | Legitimate interest |
| Username and score on leaderboards; public profile (username, join date, net worth, rank, badges) | Show standings and shareable profile cards. You can opt out of each in Account. | Legitimate interest; you can object |
| IP address (and the username or email typed in a login attempt) in short-lived rate-limit records, and security/activity log entries | Prevent abuse and brute-force attacks, investigate problems | Legitimate interest |
We do not sell your data. We do not use it for profiling. Public profiles, leaderboards and season pages ask search engines not to list them and are left out of our sitemap; anyone who has the link to a profile can still open it, and link previews (a card with your username and badges) are shown when it is shared.
Who else handles data
- Hosting provider (servers and backups).
- Email delivery (verification and reset emails).
- Push services of your browser’s maker (for example Google, Microsoft, Mozilla or Apple), only if you turn alerts on: they carry the alert to your device. The message is encrypted for your device, so they deliver it without being able to read it; they do see that a message was sent to your browser.
- Cloudflare Turnstile: an anti-bot check on signup and some forms. It loads a script from Cloudflare, which may process your IP address and browser signals.
- Ads and payments: not active at the moment. If they are switched on, this policy and the Cookie Policy will be updated first, and personalised ads will need your consent.
How long we keep it
Account and game data: until you delete your account, or until the account has gone 24 months without a sign-in. In that case we email you at 23 months, and if you do not sign in within the following 30 days the account and its data are deleted; signing in is enough to keep it. Login sessions: forgotten after 7 days without use. Rate-limit records: a few minutes to days. Alert devices: until you turn them off, sign out, or the push service reports the device as gone; alerts waiting to be sent: at most 12 hours; the log of sent alerts: 3 days. Activity log: up to 12 months. Feedback messages: until handled, then up to 180 days. Deleting your account removes your personal data, feedback messages, gameplay records and invitation links; decided character proposals stay but lose the link to you.
Your rights
You can download your data and delete your account in Account settings. You can also ask us to correct your data, restrict or object to processing, and you may complain to your data protection authority. Write to contactus@onestonks.app.
Security
Passwords are stored hashed. Sessions use protected cookies. If a breach affects you, we will tell you and the authorities as the law requires.
Age
OneStonks is for people aged 16 or older.