Privacy Policy

StockArena (the "Service") is operated by BKNYLabs LLC ("we", "us", "our"). This Privacy Policy explains what information we collect from users, how we use it, what choices you have, and how we secure your data. By using StockArena you agree to this policy.

1. Who We Are

StockArena is a paper-trading competition platform for mentor-led groups ("funds"). A typical fund has one adult mentor and a small group of teen students (ages 15 and over) trading virtual money in real markets over six months. Students don't trade real securities; the platform simulates orders against live market quotes. There is no real money at stake.

2. Children and Minors

StockArena is intended for users aged 15 and over. We do not knowingly collect personal information from anyone under 15.

The platform is mentor-led: every student is invited by an adult mentor who is responsible for the safety and appropriateness of the fund. We encourage parental awareness for all users under 18, but we do not require parents to register, provide contact information, or otherwise interact with the platform.

3. Information We Collect

3.1 From every user

• Name and email address
• Account password (stored hashed; we never see your plain-text password)
• Time zone, profile picture (if uploaded)
• Login activity timestamps and basic device information

3.2 From students

• Date of birth (used solely to enforce the 15+ age floor)
• Portfolio activity: cash balance, holdings, executed trades, watchlist, price alerts
• Chat activity: messages posted, reactions, mentions
• Arena AI workspace conversation history

3.3 From mentors (additional)

• Profile information you provide via the Mentor Profile flow (background, philosophy, sectors of expertise) — used to personalize Arena AI responses to your fund and to provide context to your students
• Audio and video recordings of mentor sessions, where applicable — used for in-fund follow-ups and, for selected sessions, inclusion in our public mentor library (see Section 6)

3.4 Forensic and safety data

For every chat message you post, we record the IP address and browser identifier (user agent) at time of posting. This data is used only for safety incident investigation and is retained per Section 8.

3.5 What we don't collect

We do not collect any payment or financial-account information. The "trades" on the platform are simulations against public market quotes; no money changes hands. We do not collect Social Security numbers, government identification, or biometric data.

4. How We Use This Information

We use the information we collect to:

• Create and maintain your account and your portfolio
• Run the simulation: execute paper trades against live market quotes, calculate portfolio value, populate the leaderboard
• Communicate with you: weekly digests, mention notifications, password resets, occasional service announcements
• Operate the Arena AI workspace and Mentor Profile features (see Section 5)
• Moderate the chat board: detect prohibited content, support mentor-driven moderation, store evidence of safety incidents
• Improve the Service

5. AI Processing

StockArena uses third-party AI services to power several features. By using these features you understand:

• Arena AI workspace. When you ask the AI a question, your message and recent portfolio context are sent to Anthropic (Claude) for processing. The response is generated by Claude and displayed to you.
• Chat moderation. Every chat message you post is sent to Anthropic for an automated content-safety check before delivery. This check happens server-side and is invisible to other users; only the decision (post or reject) and our internal log entry result.
• Mentor profile research. When mentors generate or update their profile, public information may be sent to Anthropic to assist in summarization.

We do not include your full real name in payloads sent to AI providers — interactions are pseudonymized to first-name plus role. Your portfolio and chat content are sent. Per our agreement with Anthropic, your data is not used to train any models.

6. When We Disclose Information

We do not sell or rent personal information.

We disclose information to third parties only in these circumstances:

• Service providers that operate parts of our infrastructure: hosting (DigitalOcean), email delivery (Resend), market data (Finnhub), AI processing (Anthropic), video sessions (Daily.co), and analytics (Google Analytics). These providers are contractually limited to using the data only to perform the service we contract them for.
• Within your fund. Your mentor and platform admin can see your portfolio, trades, chat activity, and Arena AI interactions for the purpose of mentoring and moderation. Other students in your fund can see your name, portfolio value, leaderboard rank, and chat messages.
• Public mentor library. Selected mentor session recordings may be incorporated into our public mentor library, accessible to other students and mentors on the platform. Students appearing in recordings may request anonymization or removal as described in our Terms of Service, Section 6.
• For safety, abuse, or legal compliance. We may disclose information to law enforcement or other parties if required by law, or to protect against imminent harm to any person.
• In a business transition. If StockArena is acquired or merged, your data may transfer with the Service. We will give you notice if your data is to be used in a way materially different from this policy.

7. Cookies and Tracking

StockArena uses session cookies to keep you logged in. These are required for the Service to function.

Our public marketing pages (stockarena.org, stockarena.org/how-it-works, and our legal documents) use Google Analytics 4 to understand how visitors find and use the site. GA4 sets first-party cookies and records page views, the source of traffic (referrer or search query), session duration, and basic device information (browser, OS, country inferred from your IP). Data is collected on our behalf as a service provider; we do not share individual GA4 data with third parties or use it for advertising. Analytics is not active inside the authenticated paper-trading product — we do not track logged-in user activity for analytics purposes.

You can opt out of GA4 tracking by:

• Installing the Google Analytics Opt-Out Browser Add-on
• Using a browser with built-in tracker blocking (Brave, Firefox with Enhanced Tracking Protection, Safari with Intelligent Tracking Prevention)
• Setting "Do Not Track" in your browser; we honor DNT signals where technically practical

Beyond Google Analytics on the marketing pages and the session cookie noted above, we do not embed cross-site advertising pixels, third-party advertising trackers, or behavioral profiling beacons.

8. Data Retention

We retain data for the following durations:

• Active accounts: while you are an active participant in any fund, plus the duration of any contest you join.
• Chat messages: for the duration of the contest plus one year afterward, or until you or your fund admin requests deletion.
• Audit and forensic records (IP addresses, user agents, moderation decisions, ban records): retained for two years to support safety incident response.
• Mentor session recordings: recordings selected for inclusion in our public mentor library are retained indefinitely. Recordings not selected for the library are retained for 12 months after the session date and then deleted.
• Aggregated or anonymized usage statistics: retained indefinitely.

You may request earlier deletion via the contact information in Section 12.

9. Your Rights

You may:

• Access your data — most of it is visible directly in the app (portfolio, trades, chat history, profile).
• Update your profile information through the Account Settings page.
• Delete your account by emailing us. Deletion removes your portfolio data, trades, and chat messages within 30 days. Audit records may be retained per Section 8.
• Export a copy of your data by emailing us; we will provide a JSON archive within 30 days.

9.1 California (CCPA / CPRA)

California residents may request, free of charge once per 12 months, a list of categories of personal information disclosed to third parties for those parties' direct marketing purposes during the preceding calendar year. California residents may also request access, correction, and deletion of their personal information. Send requests to the contact email in Section 12.

9.2 European Union (GDPR)

Users in the EU have the rights of access, rectification, erasure, restriction of processing, objection, and data portability with respect to their personal data, subject to applicable limitations. To exercise any of these rights, contact us using Section 12. EU users may also lodge a complaint with their local data protection authority.

10. Data Security

We secure data in the following ways:

• All connections to the Service use TLS over HTTPS.
• Passwords are hashed using bcrypt; we never store or transmit plain-text passwords.
• Hosting is on Laravel Forge / DigitalOcean infrastructure with industry-standard server hardening.
• Access to production data is limited to platform administrators and is logged.

No system is perfectly secure. If we discover a security incident affecting your data, we will notify affected users without undue delay and within any timeframes required by law.

11. Changes to This Policy

We may update this policy. Material changes will be announced in-app or via email at least 14 days before they take effect. The "Last updated" date at the top of this policy reflects the most recent change.

12. How to Contact Us

For privacy questions, data requests, or to report a concern:

• Email: stockarena@bkny.com
• BKNYLabs LLC Brooklyn, NY 11215