Privacy policy
What PnL World collects, why, who processes it, which cookies we use and how to get your data deleted. Plain language.
PnL World (pnl.world) runs trading tournaments on a simulator and keeps a public world rating of traders. This page explains, in plain language, what we know about you and what we do with it. It is a working version; it will be reviewed by a lawyer, and any material change will be announced here with a date.
Contact for anything on this page: [email protected].
1. What we collect
| What | When | Public? |
|---|---|---|
| E-mail address and password | You sign up with e-mail. The password is stored only as a secure hash by our authentication provider — nobody at PnL World can read it. | Never |
| Google account e-mail, name and profile picture | You choose Continue with Google. We use the e-mail to create and identify your account; the name and picture stay with your sign-in record and are not published. | Never |
| Your public profile: name, UID, picture, status line, country, social usernames | You fill them in, or we give you a default name (trader_…). | Yes — on your card and in rankings |
| Trading activity: orders, trades, balances, tournament results, rating | You trade on the platform. | Results and closed trades — yes, that is the point of the rating |
| Phone number | Only if you verify it to appear on the World Rankings. Used to confirm one person = one account. The text message is sent by our SMS provider. | Never |
| Security signals: IP address and a random device identifier | When you use the platform. Stored only as salted hashes, to detect multiple accounts and abuse. | Never |
| Active sessions: browser, device and IP address of each signed-in session | When you sign in. Shown to you in Settings → Active sessions so you can sign out of a device. | Never |
| Product analytics: pages viewed and actions such as joining a tournament | When you use the site (see section 3). Linked to a random user id — never to your e-mail, phone or name. IP addresses are anonymised. | Never |
We do not collect payment card data. During open testing there are no real-money payments.
2. Why we use it
- To run your account and the tournaments you join, and to show your results.
- To keep the rating fair: one person, one rated account (phone verification, security signals).
- To protect the platform from abuse, fraud and attacks.
- To send service e-mails: sign-in and password links, important account and tournament notices. Marketing e-mails only if you switch them on in Settings → Email subscriptions.
- To understand how the product is used and improve it (analytics).
We do not sell your data, we do not show ads, and we do not share your data with advertisers.
3. Cookies and local storage
Essential — needed for the site to work, always on:
- your sign-in session;
- your choices: theme, cookie consent, layout preferences in the terminal;
- an invite code, if you arrived through a partner link;
- a random device identifier used only for fair play (see section 1).
Analytics — PostHog cookies that measure how the site is used:
- visitors from the EU, the EEA, the UK and Switzerland: off until you click Accept in the cookie banner; until then analytics runs without cookies or local storage and without session recordings;
- other visitors: on by default.
Session recordings never capture what you type (all input fields are masked) and are never made on the sign-in and partner pages. You can block cookies in your browser settings at any time; the essential ones are needed to stay signed in.
4. Who processes your data for us
| Service | What for |
|---|---|
| Supabase | Database and authentication (accounts, passwords, sessions) |
| Cloudflare | Hosting, content delivery, network security, e-mail routing |
| PostHog (EU servers) | Product analytics |
| Twilio | Text messages for phone verification |
| Our e-mail delivery provider | Sign-in links, password resets and service e-mails |
| Only if you choose Continue with Google — signs you in |
Each of them processes data only to provide that service to us.
5. Google sign-in
If you sign in with Google, we receive your e-mail address, name and profile picture from Google. We use the e-mail address to create and identify your PnL World account. We do not post anything on your behalf, do not read your Google contacts, mail, files or any other Google data, and do not share the data we receive from Google with anyone. Our use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements.
6. How long we keep it
- Account data — while your account exists.
- When you ask us to delete your account, we delete your e-mail, phone, sign-in records and profile. The public record of past tournaments stays, anonymised, because other traders' places and ratings depend on it.
- Security signals are kept as long as they are needed to protect fair play.
7. Your rights
You can ask us to show you the data we hold about you, correct it, export it, or delete your account, and you can object to analytics. Write to [email protected] from the e-mail of your account. If you are in the EU, the EEA or the UK, you can also complain to your local data protection authority.
8. Age
PnL World is for people aged 18 and over. We do not knowingly collect data from anyone younger.
9. Changes
When this policy changes materially, we update this page with a new date and, for registered traders, send an e-mail.