Privacy Policy

Last Updated: September 2026

PodTrade Holdings LLC (“PodTrade,” “we,” “our”) operates the PodTrade platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. We believe in plain English, not legalese.

1. Data We Collect

Information You Provide

• Email address — used for account creation and authentication
• Display name — shown to other users in your pod
• Chat messages — messages sent within pod chat

Data Generated by Your Use

• Simulated trading activity — paper trades, portfolio positions, and transaction history (all fictional)
• Pod data — pod membership, proposals, votes, and settings
• Season data — season enrollment, your daily standings snapshots, and weekly rival matchups

Technical Data

• Device type and browser (standard web analytics)
• IP address (standard web server logs)
• Pages visited and feature usage patterns

Data We Do NOT Collect

• Real financial or brokerage account data
• Bank account or credit card numbers
• Social Security numbers or government IDs
• Payment information of any kind
• Precise geolocation data

2. How We Use Your Data

• Account authentication — verifying your identity when you sign in
• Platform functionality — enabling paper trading, pod features, chat, proposals, and season standings
• AI proposal summaries — drafting a short educational summary of a trade proposal when you ask for one (the proposal details are sent to the AI provider)
• Platform improvement — understanding usage patterns to improve features

3. Data Storage & Security

Your data is stored on Supabase, hosted in the United States. All data is encrypted at rest and in transit using industry-standard encryption (TLS 1.2+, AES-256). We implement Row Level Security (RLS) policies so that a signed-in user reads only their own data and their pod’s data, never the whole database. Features that deliberately show your data to other people — pod chat, season standings, and season share cards — are described in Section 7. API endpoints are protected with authentication checks and rate limiting.

4. Cookies & Local Storage

Cookies

We use only essential cookies required for authentication. Supabase auth tokens are stored as secure, HttpOnly cookies to manage your login session. We do not use any third-party tracking cookies, advertising cookies, or analytics cookies.

Local Storage

We use browser localStorage to persist UI preferences such as dismissed banners, onboarding states, and notification preferences. This data stays on your device and is never transmitted to our servers.

We do not use any third-party tracking cookies, advertising cookies, or analytics cookies.

5. Third-Party Services

We use the following third-party services. Each receives only the minimum data necessary:

• Supabase — authentication and database. Receives your email, display name, and all platform data. Hosted in the US.
• Vercel — web hosting. Standard server logs (IP address, request metadata).
• Cloudflare — bot protection on the sign-up form. Receives your IP address and browser signals when the anti-bot check runs, so we can tell a person from a script. It does not receive your email, your pod, or any trading data.
• Sentry — error monitoring. Receives a report when something breaks: the error and its stack trace, the page it happened on, and technical details about your browser or our server. We do not send it your portfolio.
• Alpaca Markets — stock and crypto market data. No personal data is shared with Alpaca; we only request price and chart data for stock symbols.
• Anthropic — AI proposal summaries. Receives the details of the trade proposal you request a summary for (symbol, side, size, price, and public company information) to generate a short educational thesis. No PII (personally identifiable information) is shared.
• Google — OAuth sign-in (only if you choose Google sign-in). Receives no data from us; we receive your email and name from your Google profile.

6. Data Sharing

We do NOT sell, rent, or share your personal data with third parties for marketing or advertising purposes.

We may disclose your information only if required by law, to protect our rights, or to comply with a legal process such as a court order or subpoena.

7. Data Within Pods

Your trading activity, proposals, votes, and chat messages are visible to members of your pod. This is a core part of the social trading experience. If you enroll in a season, your display name, pod, rank, and simulated return are visible to other signed-in traders in the season standings. If you leave a pod, your historical trading data within that pod may be retained for pod integrity.

Season Share Cards

You can generate a share card for a week of a season. We only create a card when you choose to share one, and the link stays unguessable until you hand it out — but once you do, that link is public. Anyone holding it can open the card with no account, no sign-in, and no pod membership.

A share card shows your display name, your pod’s name and emoji, your pod’s rank, your rank in the season, and your simulated return and simulated dollar profit or loss. If you had a rival matchup that week, it also shows your rival’s display name, who won, and the simulated dollar gap between you. The card page includes an invite link that lets a viewer join your pod.

Anyone you send the link to — and anyone they forward it to, or anyone who finds it wherever it was posted — can see all of that. Share a card only with people you are willing to show it to.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data from our systems within 30 days, except where retention is required by law. Anonymized, aggregated data may be retained indefinitely for analytics purposes.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and all associated data
• Export your data in a portable format
• Opt out of non-essential communications

To exercise any of these rights, contact us at nolan@podtrade.com or use the account deletion feature within the platform.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your data, and the right to opt out of the sale of your personal information. As stated above, we do not sell your personal information.

To make a CCPA request, contact us at nolan@podtrade.com.

11. International Users (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is your consent (provided at registration) and legitimate interest (operating the platform).

12. Children’s Privacy

PodTrade is restricted to users 18 years of age and older. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a user under 18, we will delete that data immediately. If you believe a child under 18 has provided us with personal data, please contact us at nolan@podtrade.com.

13. Security Measures

We implement industry-standard security measures to protect your data, including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Secure, HttpOnly auth tokens
• Server-side rate limiting on all API endpoints
• Row Level Security (RLS) database policies
• Input validation and sanitization

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify users through the platform or via email. We encourage you to review this page periodically.

15. Contact

If you have any questions about this Privacy Policy, please contact us at nolan@podtrade.com.