This Privacy Policy explains what information we collect, how we use it, and what rights you have over it. By using MarketPlay you agree to this policy.
1. What we collect
Information you give us directly
Email address — used for account creation and login
Age band, as a range such as 16-17 rather than a date of birth — used to set your starting net worth, to decide whether you can appear on a public leaderboard, and to decide whether we may send you marketing email
Financial situation — used to set your starting net worth and onboarding profile
Display name, avatar, learning goals, and any messages you send to Monty
Information we collect automatically
Your in-app decisions and their outcomes
Your private Life simulation and simulated paper-trading activity
Your login activity and streak
Your group memberships and challenge results
Notifications sent to you and whether you opened them
App usage data including which screens you visit and when
Information processed by service providers
PostHog processes explicit product events, page paths, and a pseudonymous account identifier. MarketPlay does not send your email address, financial values, screen text, or session recordings to PostHog.
Sentry processes technical error and performance data when the app fails. Collection of default personal identifiers is disabled.
If you play MarketPlay Versus
MarketPlay Versus (versus.marketplay.space and its Android app) is a 1v1 chart game made by MarketPlay. You can play it without an account. When you do, Versus keeps:
A random guest code stored on your device, and a random device cookie, used to keep your profile and to stop one device playing against itself
The nickname and picture you play under, which other players see
Your matches: your calls, scores, rating and records
Your sound and vibration settings
A keyed hash of your IP address, used only to limit how fast new guest profiles can be created. We never store the address itself and never use it to work out where you are.
Usage stats in Versus, only if you allow them. After your first match, Versus asks whether you want to share usage stats. Until you tap Allow, PostHog is never loaded and nothing is stored for it. If you allow them, Versus sends PostHog named game events, such as a match starting or finishing with its result, score and rating change, together with your random Versus player identifier and whether you play in the Android app or a browser. It never sends your email address, name, nickname, age or any screen recording. You can turn usage stats off at any time in You → Usage stats, which stops all further collection and deletes the stored identifier. Deleting your Versus data does the same.
If you log in to Versus with your MarketPlay account, we link your Versus profile to that account and Versus reads the age band on it. If you create a MarketPlay account by logging in to Versus with Google, it is a normal MarketPlay account and this whole policy applies to it. We send it no MarketPlay email until you first sign in on MarketPlay itself.
2. How we use your information
To create and manage your account
To generate personalised financial scenarios using AI
To calculate and display your simulated scenario balance
To provide learning progress, module tests, Positions, paper trading, and optional class features
To send push notifications you choose to enable
To send transactional emails via Resend
To improve the app using limited, pseudonymous product analytics
We never sell your data to anyone. We never use your data for advertising.
3. What we share
Within the app, other users can see
Your display name
Your level
Your login streak
Your learning-topic count and class rank, when you join a class
In Versus: your nickname, picture and rating, your score in matches against them, and your head-to-head record with them
Other users can never see
Your email address
Your financial situation answer from onboarding
Your private Life simulation or paper-trading portfolio
Your chatbot conversations
Your psychology profile
Outside the app we share data with
Supabase — database and authentication provider
OpenRouter — AI processing; the profile context needed for a personalised response is sent when you use an AI feature
PostHog — explicit product events and a pseudonymous account identifier; no email address, financial values, automatic screen interaction capture, or session recording. In Versus, only after you allow usage stats
Sentry — technical error and performance data; default personal-identifier collection is disabled
Resend — email delivery, your email address only
Upstash — short-lived rate-limit counters keyed by an account or network identifier
Vercel — hosting and standard request/security logs
Cloudflare: hosting, game server and database for MarketPlay Versus, plus standard request and security logs
4. Data retention
Your account data is retained until you delete your account
Onboarding session data is deleted immediately after onboarding completes
Chatbot conversation history and product activity are retained with your account unless you delete the relevant data or your account
Failed-sign-in security telemetry uses a scoped HMAC identifier instead of an email address and is retained for 30 days
You can delete your Versus data from inside Versus or by emailing shahaarit3@gmail.com. Matches you played against other real players stay in their history, with your nickname replaced by "Deleted player", because they are part of the other player's record.
If in-app account deletion succeeds, MarketPlay removes the account's active application records and authentication identity immediately. Infrastructure backups and provider security logs may remain for their providers' limited retention periods.
5. Your rights
You have the right to:
Access your data using Settings → Download your data, or email shahaarit3@gmail.com
Correct any inaccurate data in your account settings
Delete your account and all associated data at any time from your profile settings
Withdraw analytics consent at any time in Settings → Usage analytics, which also deletes the analytics cookie
Withdraw all consent by deleting your account
6. Children
MarketPlay accounts are for people aged 13 and above, with no upper limit. We do not knowingly hold an account for anyone under 13, and if we discover one we delete it. We ask for an age band, such as 16-17, and never for a date of birth.
If you are between 13 and 17 we hold your account more narrowly than an adult's. You are never placed on a public leaderboard, and we never send you marketing email. Nothing you can learn or play is reduced because of your age.
If you are under 18, we ask that a parent or guardian knows you use MarketPlay and agrees to this policy on your behalf. We ask for that agreement at the point you create the account. We do not verify it, and we would rather say so than claim a check we do not perform.
A parent or guardian can email shahaarit3@gmail.com to see everything we hold about the account, to correct it, or to have it deleted. We act on a request from a parent or guardian the same way we act on one from the account holder.
In Versus, logged-in accounts appear on the public leaderboard only if their age band is 18 or over. Versus guests are not asked their age and appear under their chosen nickname only.
Some parts of MarketPlay need no account at all. The Money Brain test, for example, shows anyone their score and the explanations behind it. Where that happens we ask for no email address, we place the result on no leaderboard, and we store nothing that identifies the person taking it.
7. Cookies
MarketPlay uses two kinds of cookie and nothing else. We use no advertising cookies, no tracking pixels, and no third-party marketing tags, and we do not sell or share your data with advertisers.
Strictly necessary cookies
Set by our authentication provider to keep you signed in and to protect sign-in against abuse. They are required for an account to work at all, so they are set whenever you sign in and cannot be turned off separately from having an account. They carry a session identifier, not your activity.
MarketPlay Versus sets one strictly necessary cookie of its own: a random device identifier, used to stop one device playing against itself and to limit abuse. Versus sets no analytics cookie. If you allow usage stats in Versus, PostHog keeps its random identifier in your browser's storage instead of a cookie. Nothing is stored before you allow it, and turning usage stats off deletes it.
Analytics cookie
One cookie set by PostHog, holding a randomly generated device identifier. It is what lets us count which screens are used and where people get stuck, so we can fix the parts that are not working. It carries no email address, no financial values, no screen text, and no session recording.
We ask before we set it. On your first visit you are shown a choice, and until you accept, PostHog is never loaded and the cookie is never written. Declining changes nothing about how the app works.
You can change your mind at any time in Settings → Usage analytics. Turning it off stops all further collection and deletes the analytics cookie from your device.
8. Security
We protect your data using:
Row Level Security on every database table — users can only access their own private data
Encrypted transmission via HTTPS on all routes
Server side only access to all API keys — never exposed to the browser
Signed, secure session cookies and rate limits on authentication-sensitive endpoints
9. Changes to this policy
If we make significant changes to this policy we will notify you via email and in-app notification before the changes take effect.
10. Contact
For any privacy questions or data requests contact: