Privacy Policy
Last updated: 26 May 2026
This Privacy Policy explains what personal data Cupital (the "Service") processes, why, on what legal basis, and the rights you have. It is provided in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR / DSGVO). By accepting it you acknowledge the processing described here.
1. Controller and contact
The controller responsible for processing your personal data is the operator of Cupital. Operator and contact details are available in the Imprint. For any privacy request you can write to privacy@cupital.app.
2. What we process and why
We process only the data we need to run a free, account-based, play-money game. There is no automated decision-making and no profiling that produces legal or similarly significant effects.
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account creation and authentication | Email address, username, hashed credentials | Contract — Art. 6(1)(b) |
| Trading, portfolio and leaderboard | Orders, trades, holdings, balances, ranking | Contract — Art. 6(1)(b) |
| Global chat | Messages you post, linked to your username | Contract — Art. 6(1)(b) |
| Transactional email (signup, password reset) | Email address | Contract — Art. 6(1)(b) |
| Session cookie | A strictly necessary authentication cookie | No consent required (ePrivacy essential) |
| Product analytics — signed-in users (PostHog) | Pseudonymized event data, IP discarded | Consent — Art. 6(1)(a) |
| Aggregate analytics — anonymous visitors (PostHog) | Cookieless, memory-only page-view counters | Legitimate interest — Art. 6(1)(f) |
| Personalized advertising (from a later phase) | Anonymized request data via Google AdSense | Consent — Art. 6(1)(a) |
| Moderation and safety | Reports, admin actions (audit-logged) | Legitimate interest — Art. 6(1)(f) |
When you accept the Terms of Use and this Privacy Policy, you also consent to product analytics and, from a later phase, personalized advertising — both used to keep Cupital free. You can withdraw this consent at any time (see § 6).
3. Cookies and tracking
Cupital does not show a cookie banner because it sets no non-essential cookies without your consent.
- Logged out: no cookies are set. Analytics runs in cookieless aggregate mode (memory only, no
ph_*cookies, IP discarded, no session replay). No ads are shown. - Logged in (after you accept these documents): an essential session cookie keeps you signed in, and PostHog analytics (and, from a later phase, AdSense) operate under the consent bundled with your acceptance.
4. Recipients and sub-processors
We share data only with the processors needed to operate the Service. Each is bound by a data-processing agreement (DPA).
| Sub-processor | Service | Data shared | Hosting region |
|---|---|---|---|
| Supabase (Supabase Inc., USA) | Postgres database, Auth, Realtime | All account and game data | EU (Frankfurt) |
| Vercel (Vercel Inc., USA) | Hosting, edge runtime, analytics proxy | Request logs (IP, user-agent, path) | EU (Frankfurt) |
| PostHog (PostHog Inc., USA) | Analytics, session replay, feature flags | Pseudonymized event data, IP discarded | EU |
| Google Ireland Ltd (from a later phase) | AdSense | Anonymized request data | EU |
5. International transfers
Personal data is stored in the EU (Supabase Frankfurt, Vercel FRA, PostHog EU). Our sub-processors are USA-based companies; transfers to them are covered by the Standard Contractual Clauses included in their DPAs.
6. Withdrawing consent
You can withdraw your analytics and advertising consent at any time in your account settings ("Revoke analytics + ads consent"). Because these are bundled with your acceptance of the Terms, withdrawing them clears your local analytics state and signs you out; re-using the Service requires re-acceptance. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7. Retention
| Data | Retention |
|---|---|
| Active account data (profile, holdings, etc.) | While your account is active |
| Profile after deletion | Removed; trades are pseudonymized indefinitely |
| Chat messages | While active; pseudonymized after deletion |
| Moderation reports | 90 days after resolution |
| Admin audit log | 365 days |
| Analytics events (signed-in) | 12 months rolling |
| Analytics events (anonymous) | Session only — not persisted |
8. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection regarding your personal data. To exercise any of these, email privacy@cupital.app; we respond within 30 days. You can delete your account at any time from your account settings, which erases your profile and pseudonymizes your trade history for ledger integrity.
You also have the right to lodge a complaint with a supervisory authority — for the operator's jurisdiction this is the competent German data-protection authority (Landesdatenschutzbehörde).
9. Age
The Service is intended for users 16 years or older. We do not knowingly process data from people under this age.
10. Changes to this policy
We may publish new versions of this Privacy Policy. When we do, you will be asked to accept the current version the next time you log in; previous versions are retained. The date of the latest update is shown at the top of this page.