Privacy Policy

Account information: the email address and password you sign up with (your password is hashed by our authentication provider, Supabase — nobody at Hedge Fun can see it), and an optional username.

Trading data you provide: ticker symbols, share counts, prices, trade dates, sectors, company names, and any notes you enter — either typed manually or extracted from a file you import. This is self-reported data you control; Hedge Fun has no connection to any real brokerage and no independent way to verify it.

Fantasy & social data: your friends list, duel/league picks, and win/loss history with other users, used to run the Fantasy features and the friend-facing display name.

Usage data: login dates (to compute your streak), achievement progress, and standard web server logs (IP address, browser type, timestamps) generated automatically by our hosting provider.

Push notification subscription: if you opt in, a browser-issued push subscription token, so we can send you duel/league and reminder notifications. You can revoke this at any time through your browser.

Cookies & local storage: a session cookie that keeps you signed in, and a local-storage entry for your light/dark theme preference. We don't use advertising or cross-site tracking cookies, and Hedge Fun currently runs no third-party analytics or ad-tracking scripts.

When you import trades from a CSV, PDF, or photo, the file is processed entirely inside your own browser: PDFs are read locally using an in-browser text extraction library, and photos are read locally using in-browser OCR (optical character recognition). The raw file itself is never uploaded to Hedge Fun's servers or sent to any third party. Only the rows of trade data you review and explicitly confirm on the import screen are saved to your account.

Because OCR and PDF-text extraction aren't perfect, always review extracted rows before confirming them. If a statement contains information you'd rather not have extracted (like an account number), consider cropping or redacting it before uploading, or use the CSV import option instead.

• To operate the core service — compute your positions, career stats, tiers, and achievements.
• To run the Fantasy duel/league features and show you and your opponents' results.
• To send account-related emails (sign-up confirmation, password reset) and, if you've opted in, push notifications.
• To maintain security, prevent abuse, and enforce our Terms of Service.
• To diagnose bugs and improve the service.

We do not use your data to train third-party AI models, and we do not sell your personal information to anyone.

We share limited data with the following service providers, solely to operate Hedge Fun:

• Supabase — hosts our database and handles authentication (stores your account, trade, and Fantasy data).
• Vercel — hosts the application itself.
• Finnhub and Yahoo Finance — provide stock price and company data. When you hold or view a ticker, its symbol (not your identity or position size) may be sent to these providers to fetch a quote.
• Your browser's push service (e.g., Chrome or Apple's push infrastructure) — delivers push notifications you've opted into.

We may also disclose information if required by law, to protect Hedge Fun's or others' rights and safety, or in connection with a merger, acquisition, or sale of assets — in which case we'd expect any successor to remain bound by this policy for previously collected data.

Within the app, other users only ever see your username (or email, if you haven't set one), and — only for tickers you've explicitly locked into a shared duel or league — the ticker symbol and its performance percentage. Your cost basis, share counts, and dollar values are never shown to another user.

We keep your data for as long as your account is active, so the service can continue working the way you'd expect. If you request deletion (see below), we'll delete or anonymize your personal data within a reasonable time, except where we're required to retain limited records for legal or security purposes.

Access & correction: you can view and edit most of your data directly in the app (trades, positions, username, goals).

Deletion: email thejfleish@gmail.com from your account's email address to request deletion of your account and associated data. We don't yet have a self-serve delete button in the app — this is on our roadmap.

Notifications: you can revoke push notification permission at any time in your browser's site settings.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, request its deletion, and opt out of its sale — which we don't do. You won't be discriminated against for exercising these rights. Contact us at the email above to make a request.

EEA/UK residents (GDPR): to the extent this policy applies to you, our legal basis for processing is your consent (at sign-up) and our legitimate interest in operating the service you've asked for. You have the right to access, correct, delete, or export your data, and to object to or restrict certain processing — contact us at the email above.

Hedge Fun is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we'll delete it.

We use reasonable technical measures — including row-level security on our database and hashed passwords — to protect your data. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

Hedge Fun's infrastructure (Supabase and Vercel) processes and stores data in the United States. If you use Hedge Fun from outside the U.S., your information will be transferred to and processed in the U.S.

We may update this policy from time to time. If we make material changes, we'll update the effective date above and, where practical, notify users in-app.

Questions, requests, or concerns about this policy? Email thejfleish@gmail.com.