Privacy Policy

1. Scope and publication status

This draft explains how RetroStock Arcade is intended to collect and use personal data across the website, account features, research, community, contests, games, and support.

The operator identity, registered address, privacy contact, data-protection authority, retention schedule, processor inventory, transfer safeguards, and effective date are still pending. This page is informational and is not a final jurisdiction-specific Privacy Policy until those details and counsel approval are published.

2. Personal data we collect

3. Why we use data and legal bases

4. When we share data

We share only what is reasonably necessary with:

• hosting, database, cache, storage, email, security, logging, and support providers when configured by the operator;
• Google or X/Twitter when you choose their authentication flow;
• Vercel Analytics only after explicit analytics consent, using scrubbed event data;
• Marketstack and public SEC EDGAR sources when retrieving requested market or filing information;
• Logo.dev when company-logo delivery is enabled;
• other users or the public when you choose to publish a profile, DD, comment, contest result, or leaderboard entry; and
• advisers, authorities, auditors, or transaction counterparties where law or safety requires it.

The beta does not sell personal data for money and does not enable advertising or creator payments. Any future monetization or advertising requires a new privacy review and notice. The final policy will identify the operator's actual processors, independent third parties, locations, and contractual safeguards.

5. Public, unlisted, and private content

Public DD, posts, comments, reactions, profile details, contest standings, and leaderboard entries can be viewed, copied, indexed, or reshared by others. Deleting content from the Service cannot remove copies made by third parties. Private and unlisted research is access controlled, but no online storage can be guaranteed absolutely confidential. Do not submit confidential, sensitive, or material non-public information.

6. Cookies and browser storage

Essential browser storage supports authentication, security, preferences, and consent. Optional analytics remains unloaded until you explicitly choose “Allow analytics.”

You can withdraw analytics consent with the control on this page. Clearing site storage also resets the local choice and causes the consent banner to appear again.

7. Retention and deletion

The operator is still approving the retention schedule. Until that schedule is published, data is intended to be kept only for as long as reasonably necessary for the purposes above, including security, fraud prevention, disputes, backups, and legal obligations.

The schedule must address at least:

• active and deleted accounts, sessions, login history, and IP addresses;
• private, public, deleted, and moderated content;
• reports, appeals, contest entries, game runs, and anti-cheat evidence;
• support requests, analytics, logs, backups, and legal holds.

The current public UI does not provide a complete self-service export and deletion workflow. A final policy will publish the approved privacy-request channel and actual deletion behavior. Public copies made by third parties and data retained under a legal or security exception may remain after removal from the Service.

8. Security and incidents

The Service uses administrative, technical, and organizational safeguards appropriate to the data and risk, including secure session cookies, CSRF protection, password hashing, authentication controls, rate limits, redacted logging, and abuse monitoring. No system is completely secure. The operator will provide a security and privacy contact before binding publication and will handle reportable incidents as required by applicable law.

9. International transfers

Data may be processed in countries where the operator and its configured providers operate. The final policy will identify relevant locations and, where required, the approved transfer mechanism and safeguards, such as an adequacy decision or appropriate contractual terms.

10. Your rights and choices

Depending on your location and the applicable law, you may have the right to be informed, access your data, correct it, request deletion, restrict processing, receive a portable copy, object to processing, withdraw consent, and challenge certain automated decisions.

Requests should use the dedicated privacy channel published by the operator. We may verify identity before responding and may retain or restrict data where law, security, or another person's rights requires it. Requests are generally answered without undue delay and within the period required by applicable law.

You may complain to the data-protection authority in your country or place of residence. The final policy will name the relevant supervisory authority and any appointed data protection officer, if applicable.

11. Automated decisions and profiling

The beta uses automated checks for authentication, rate limiting, contest validation, game replay verification, and moderation support. It is not intended to make decisions based solely on automated processing that produce legal or similarly significant effects. The final policy will explain any material change to this position and the available safeguards.

12. Age limit

The Service is intended for adults aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided data, use the privacy contact once it is published.

13. Changes and contact

We will post updates with a revised review or effective date. Material changes will receive additional notice where required. The operator identity, postal address, privacy email, support channel, and effective date remain pending and must be completed before this document becomes binding.

General product questions can be sent through the contact page. Do not use the current simulated contact form as the sole channel for a statutory privacy request.