Privacy Notice

Last updated: 2026-08-15

1. Scope and accountability

This notice describes how FANDAQ handles personal information on fandaq.com. FANDAQ is accountable for information under its control and uses the privacy principles required by applicable Canadian law. Privacy questions, access requests, corrections, and complaints go to the privacy contact in Section 11.

2. Information we handle

  • Account: email address, authentication-provider identifier, and sign-in metadata. FANDAQ does not receive your raw Google or GitHub password.
  • Game records: FanBuck balance, holdings, virtual trades, prices, realized game profit, trade count, and streak.
  • Public leaderboard: a generated trader pseudonym plus game-only rank, net worth, profit, trade count, and streak. Email and OAuth profile names are not intentionally published.
  • Security and operations: request metadata such as time, route, browser information, and IP address may be processed by hosting, authentication, rate-limiting, and security systems.
  • Optional analytics: after consent, page paths without query strings and interaction events may be sent to our analytics provider. Session replay is disabled.
  • Error diagnostics: when configured, sanitized technical errors may be sent to our monitoring provider. Request bodies, cookies, headers, query strings, and user identity are removed by application policy before sending.

3. Why we use it

We use this information to authenticate accounts, run and reconcile the virtual market, calculate portfolios and leaderboards, prevent abuse, diagnose failures, respond to requests, improve consented product flows, and meet legal obligations. We do not sell personal information.

4. Public game records

Leaderboard statistics are public by design, but they are attached to a generated pseudonym, not an email-derived or social-profile-derived name. Virtual trade rows are retained as market integrity records. If an account is closed, those records may be kept after removing the link to the account so prices and leaderboard calculations remain auditable.

5. Service providers and location

Providers may process information only to run the service: Supabase for authentication and the database; Vercel for hosting and request delivery; PostHog for optional analytics; and Sentry for sanitized error monitoring. A provider may process information outside Canada, including in the United States, where it can be subject to local law. Optional providers receive nothing from the site when their integration is not configured, and analytics does not initialize before consent.

6. Cookies and browser storage

Necessary storage supports authentication, security, theme, and your consent choice. If you accept analytics, PostHog may use browser storage for measurement. Choosing Essential Only keeps analytics off. You can reopen cookie preferences from the site footer; browser Do Not Track and Global Privacy Control signals also disable analytics in this application.

7. Retention

Retention depends on purpose: account data is kept while an account is active; security and diagnostic records are kept for limited operational periods; consented analytics follows the configured provider retention; and virtual trades may remain as de-identified integrity records. We do not promise a deletion period that the current production workflow cannot verify.

8. Your choices and requests

You may ask whether we hold personal information about you, request access or correction, withdraw optional analytics consent, challenge our handling, or request account closure and deletion. We will verify identity and explain any information that must be retained, de-identified, or withheld under applicable law. Some features may stop working after consent is withdrawn or an account is closed.

9. Safeguards

We use encrypted transport, access controls, row-level database controls, server-side authorization, consent gates, pseudonymous public identities, and minimized diagnostic reporting. No Internet service can guarantee absolute security.

10. Children

FANDAQ accounts are not intended for children under 13. If you believe a child under 13 created an account or provided personal information without appropriate guardian consent, contact us so we can investigate and take appropriate action.

11. Privacy contact

Email the person responsible for FANDAQ privacy at hello@fandaq.com with the subject “Privacy request.” Do not email a password or other sensitive credential.