Legal
Privacy Policy
Draft for review. This document is still being reviewed and may change before it becomes final.
This policy explains what personal data Rival collects, why, who can see it, and your rights. The controller of your personal data is Maoz Chonowitz (“Rival”, “we”). Contact us about privacy at support@rival100k.com.
1. What we collect
- Account: your email address, display name and, if you set one, a password. We store your password only as a salted, one-way scrypt hash. We also record whether and when your email address was verified.
- Google sign-in (optional): if you choose Continue with Google, we ask Google only for the openid, email and profile scopes. From Google we read your Google account ID, your email address, whether Google has verified it, and your name. We use your name only to suggest a display name while you finish signing up; it is not saved to your account. We store your Google account ID and email address as your sign-in connection, with when it was created and last used. We never see your Google password, we do not store Google access or refresh tokens, and we do not use your Google photo. If your Rival email address is the address Google has verified, we mark it as verified.
- Profile photo (optional): an image you choose to upload. When you upload it through Rival, your device crops it and re-encodes it to a small square, which removes embedded metadata such as camera location.
- Game activity: your portfolios, instructions, executed trades, cash records, tournaments created or joined, invitations and results.
- Sign-in and security: sign-in sessions (stored by us only as hashes), password-reset and email-verification requests (tokens stored as hashes), temporary Google sign-in records, and rate-limit counters. Rate-limit counters are keyed by a hash of your email address, your account ID or, for Google sign-in, your IP address. We also keep security audit events: password changes and resets, email verification, sign-in method connections, profile photo changes, order events, tournament setup changes, administrator actions on accounts, and account deletion.
- Product events: first-party records of actions such as signing up, signing in, joining a tournament or submitting a portfolio. They are stored in our own database.
- Activity days: the days you open Rival while signed in, and which of your tournaments you opened that day, so we can tell whether players come back. Only the day is kept, not pages, times or devices.
- Rival updates (only if you turn them on): if you choose WhatsApp or email updates in Account, we keep the channel, your WhatsApp number (WhatsApp only), what you chose to receive, and when and how you agreed. We use them only to send you tournament alerts and recaps (at most one each US market day plus a weekend recap), record whether a message was delivered or its link opened, and stop when you turn updates off, reply STOP on WhatsApp or use an email’s unsubscribe link. Your number is never shown to other players. Messages contain tournament standings that the tournament’s players can already see, never anyone’s holdings.
- Ad measurement (only if you allow it): if you choose Allow in the ad cookies bar, the Meta Pixel runs on Rival’s pages (never on administrator pages). It tells Meta which pages you visit and when you create an account or reserve a league spot, so we can measure our Facebook and Instagram ads. We send Meta no name, email or other account details; Meta receives your browser and device information and its own cookies under its own privacy policy. If you choose No thanks, the pixel never loads.
- Technical logs: our hosting provider records standard request logs, such as IP address, browser type and time, to operate and secure the service.
- Terms acceptance: which version of these documents you accepted and when.
We do not collect payment details, government IDs, real brokerage accounts, precise location or your contacts, except from a prize winner as described below.
- Prize winners only: if you win a prize tournament, we ask for your legal name, country of residence, payment details (such as a PayPal email or bank account) and any tax or identity information the law requires. We use it only to check eligibility, pay the prize and meet legal obligations. See the Official Rules.
2. Why we use it, and our legal bases
- To provide Rival (performance of our contract with you): your account and sign-in, portfolios, tournaments, rankings, invitations, email verification and password resets.
- To keep Rival secure and fair (legitimate interests): preventing abuse, collusion and cheating, rate limiting, and investigating incidents.
- To improve Rival (legitimate interests): understanding which features are used, from our first-party product events.
- Your profile photo (your consent): shown only because you chose to add it. Remove it at any time in Account.
- To run prize tournaments (performance of our contract with you, and legal obligations): verifying a winner’s eligibility and paying the prize.
- Legal obligations: where the law requires us to keep or disclose information.
We do not sell your personal data, share it for cross-context advertising, or use it to make decisions that have legal or similarly significant effects on you.
3. What other players can see
- Your display name and profile photo appear wherever you play: leaderboards, participant lists and player pages. Profile photos are shown only to signed-in players. Your email is never shown to other players.
- In tournaments you join, other participants and viewers can see your rank, portfolio value, total return and performance history.
- In Friends tournaments, members can see your executed holdings and completed trades during play.
- In Official tournaments, your holdings stay hidden until the tournament ends. After that, other participants in it can see your final portfolio.
- In You vs Rival AI, the only other player is Rival AI, which never sees your portfolio. You choose whether you see Rival AI’s executed holdings during play or only when the tournament ends.
- Pending portfolio changes are always private.
- A personal portfolio from before Rival became tournament-only remains private to you and is read-only.
Rival’s administrators can access account and game data, including email addresses, when needed to operate, support and secure Rival.
4. Rival AI
Rival AI’s decisions are made by a third-party AI model. We send it only Rival AI’s own portfolio, the tournament’s dates and rules, and public investment and price data. We never send it your name, email, photo, holdings, pending changes, tournament names or any other player’s data.
5. Service providers and transfers
We use service providers who process data on our instructions:
- Vercel Inc.: website hosting and request logs. Our servers are in the United States (Washington, D.C. region).
- Neon: our database, in the United States.
- Resend: sending password-reset and email-verification emails, and Rival update emails if you turn them on, using your email address.
- Meta Platforms (WhatsApp Business Platform): delivering Rival updates on WhatsApp, only if you turn them on, using your WhatsApp number and the message text.
- Market-data provider: prices (daily official closes and current quotes) and trading calendars. It receives no personal data.
- AI provider (DeepSeek): Rival AI’s decisions. It receives no personal data, as described above.
- Meta Platforms: measuring our ads with the Meta Pixel, only if you allow ad cookies (see Cookies).
If you choose Continue with Google, you sign in on Google’s own pages. Google acts as an independent provider under its own privacy policy, not on our instructions.
Your data may be processed in the United States and other countries whose laws differ from yours. Where the law requires it, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, and we can give you a copy on request. We may also disclose data if required by law, to protect Rival or our players, or as part of a sale or reorganisation of Rival, subject to this policy.
6. How long we keep data
- Sign-in links and sessions stop working when they expire: sign-in sessions after 30 days, password-reset links after 30 minutes, email-verification links after 24 hours, and Google sign-in steps after 15 minutes at most.
- Account and profile data are kept while your account is open.
- Security and product event records, and expired sign-in and rate-limit records, are not yet deleted automatically after a fixed period. We keep them while Rival operates, except as described below for deleted accounts.
- When you delete your account (you can do this yourself in Account), we remove your email address, password, Google sign-in connection, profile photo, sessions, reset and verification links, and product events, and your name in past results becomes “Deleted player”. Your entries in tournaments that have not started are withdrawn. We keep your game records (portfolios, trades, cash records and results), because they are part of other players’ tournament records, and your security audit events, which record actions and account IDs but not your email or name.
- Prize claim and payment records are kept for as long as tax and accounting law requires, then deleted.
- Hosting logs are kept according to our hosting provider’s retention periods.
7. Cookies
Rival uses these strictly necessary cookies:
rival_sessionkeeps you signed in, for up to 30 days.rival_oauth_stateprotects a Continue with Google sign-in in progress, for up to 10 minutes.rival_pending_identityholds a Google sign-in while you finish signing up or connect it to your account, for up to 15 minutes.
They are HttpOnly, SameSite=Lax and Secure in production.
Ad cookies are optional. A bar at the bottom of the page asks first; only if you choose Allow does the Meta Pixel load and set Meta’s cookies (such as _fbp) to measure our ads. Your choice is kept in your browser, and you can change it here at any time.
Your choice in this browser: not chosen yet.
8. Your rights
Depending on where you live, including under the GDPR, the UK GDPR and US state privacy laws, you can ask to access, correct, delete or receive a copy of your data, or to restrict or object to its use. Where we rely on consent, you can withdraw it at any time.
You can change your display name and photo, and delete your account, yourself in Account. For a copy of your data or other requests, email support@rival100k.com from your account email. We will reply within one month. You can also complain to your local data protection authority. We will not treat you differently for using your rights.
9. Security
We use HTTPS, hashed passwords and session tokens, same-origin checks on every change, rate limits and strict access checks between players. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
10. Children
Rival is for people aged 18 and over. We do not knowingly collect data from younger people. If you believe a child has an account, contact us and we will delete it.
11. Changes
We will post updates here with a new version and date. We will tell you in the app or by email about material changes.