LEGAL
Privacy Policy
The short version. We collect what we need to run Season 0: how you signed in (email or X handle and photo), your calls and points, who invited you, and basic analytics. We don't sell your data and we don't run ads. On public boards your handle is partly hidden unless you choose otherwise. You can ask us for a copy of your data or to delete it at any time.
1. Who we are
Options.xyz ("we", "us") runs options.xyz (the "Service") and is the data controller for the personal data described here. This policy explains what we collect, why, and the choices you have. It should be read with our Terms of Service.
2. What we collect
Sign-in information. We use Privy to sign you in with Google, X or email. Depending on the method, we receive your email address, or your X username, display handle and profile photo URL, and a Privy account ID. We never receive your passwords.
Activity. Your calls (price, round, time placed and changed), the market odds at the time, results, points, streaks, your member number, your invite code, and which invite or call link brought you here.
Settings. Choices you make, such as whether to show your full @handle on the board.
Technical and usage data. When you use the Service our hosting provider processes your IP address, browser type and device information to deliver pages and protect against abuse. Where we keep an IP-derived value for rate limiting, we store a one-way hash rather than the address itself. We use Google Analytics to understand how people use the Service, such as which pages are visited, sign-ups, calls made and shares. Analytics are linked to a hashed identifier, not your email or handle.
Messages. If you contact us, we keep what you send and our reply.
We don't ask for and don't want sensitive information such as government IDs, financial account details, health data or similar. If real-money products launch later, any identity verification will be covered by a separate notice.
3. How we use it
- To run Season 0: create your account, record and settle calls, calculate points, streaks and referral credit, and show boards.
- To keep it fair: detect and prevent duplicate accounts, bots, referral abuse and other breaches of the Terms, and check eligibility.
- To improve the Service: measure what works, fix bugs and plan features.
- To contact you: service messages about your account, and news about Options.xyz, including the launch of real-money trading. You can opt out of non-essential messages at any time.
- To consider eligibility for any future reward program described in the Terms.
- To comply with law and enforce our Terms.
We don't sell or rent your personal data, we don't share it for third-party advertising, and we don't make decisions with legal or similarly significant effects about you based solely on automated processing.
4. Legal bases
Where data protection laws such as the Cayman Islands Data Protection Act, the EU or UK GDPR apply, we rely on: performance of our contract with you (running the Service); our legitimate interests (keeping it fair and secure, improving it, telling you about our products), balanced against your rights; your consent where required (for example, certain cookies or marketing), which you can withdraw at any time; and legal obligations.
5. What's public
Boards and the points leaderboard show, for each player, a partly hidden X handle (for example "@Mi•••er") with the X profile photo, or a partly hidden email address (for example "j•••@gmail.com"), along with calls, results and points. You can choose to show your full @handle in My calls. Call cards and links you choose to share show your full handle, your call and your result to anyone who sees them. Your email address is never shown in full publicly.
6. Who we share with
We share personal data only with service providers that process it for us under contract, and only as needed:
- Privy (authentication);
- Vercel (hosting and serverless functions);
- Neon (database);
- Google (Google Analytics, and Google sign-in if you use it);
- X (if you sign in with X or share to X).
Current market data comes from third-party market data providers; we don't send them your personal data. We may also share data if required by law or a valid legal request, to protect the rights, safety and property of our users, us or others, or as part of a merger, financing, acquisition or sale of assets, in which case this policy will continue to apply to your data.
7. Cookies and local storage
We use your browser's local storage to remember things like a price you were setting, where you came from, and what you've already seen, so the Service works smoothly. Privy uses storage to keep you signed in. Google Analytics sets cookies to measure usage. You can block or delete cookies and local storage in your browser settings, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Blocking sign-in storage will stop you staying signed in.
8. Retention
We keep account and activity data while your account is open and for as long as needed to run Season 0, settle and record past rounds, determine eligibility for any reward program, resolve disputes and meet legal obligations. When you delete your account we delete or anonymise your personal data within 30 days, except where we must keep it longer by law or to prevent abuse. Past results on public boards may remain in anonymised form. Analytics data is kept for the period set in Google Analytics (14 months by default).
9. Security
We use encryption in transit, access controls, hashed identifiers for analytics and rate limiting, and reputable providers to protect your data. No system is completely secure, so we can't guarantee absolute security. If a breach affects your personal data, we'll notify you and regulators where the law requires.
10. International transfers
We are based in the Cayman Islands and our providers process data in the United States and other countries. Where required, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
11. Your rights
Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent. To use any of these rights, email privacy@options.xyz from the address on your account, or message @OptionsXYZ on X from your linked account. We may need to verify it's you and will reply within 30 days. You also have the right to complain to your data protection authority; in the Cayman Islands this is the Ombudsman.
12. Age
The Service is only for people 18 and older. We don't knowingly collect data from anyone under 18. If you believe a minor has used the Service, contact us and we will delete their data.
13. Changes
We may update this policy. We'll change the effective date above and, for material changes, give notice on the Service before they take effect.
14. Contact
Privacy questions and requests: privacy@options.xyz.