Privacy Policy

This Privacy Policy describes how veledah ("veledah," "we," "us") collects, uses, discloses, and retains information in connection with the veledah website, applications, and related services (the "Service"). It applies to every account holder, including Listed Persons — verified individuals who have chosen to list their own market. By using the Service, you acknowledge the practices described in this Policy. This Policy does not apply to third-party websites or services that we do not operate, including the identity-verification provider's own collection practices, which are governed by that provider's privacy policy.

2.1 Account and profile information

When you register, we collect the information needed to create and operate your account: email address, chosen display name, password credentials (stored in hashed form), and, for Listed Persons, the ticker symbol and profile content you choose to publish.

2.2 Identity-verification status

Listing and participation require verification that you are a real person, 18 years of age or older, and not already associated with another account. Verification is performed by a third-party identity-verification provider. veledah receives and stores only the verification outcome — a pass/fail status, a provider reference identifier, and a de-duplication signal used to enforce the one-person-one-market rule. veledah does not store images of government identification documents or selfie images. Those materials are handled by the verification provider under its own policy.

2.3 Trading and ledger records

The Service records every order, trade, fee, credit grant, and balance change in an append-only ledger. The ledger is a permanent audit record: it is the source from which every price, position, and figure on the Service derives, and its entries are not modified or deleted after they are written. Section 6 describes how personal identifiers are separated from ledger entries.

2.4 Usage, device, and analytics information

We automatically collect technical information when you use the Service: IP address, browser type, device and operating-system characteristics, pages viewed, features used, timestamps, and referring URLs. This information is collected through server logs and the product-analytics tooling described in Section 8.

2.5 Information Listed Persons choose to publish

A Listed Person controls the content of their own market page: profile text, updates, corrections, and any other material they choose to post. Anything a Listed Person publishes to their market is public, as described in Section 4, and should be treated as such before posting.

We use the information described above to:

Operate the simulation. Create and maintain accounts and markets, execute trades against the market maker, apply the 1% trade fee, credit the 10,000 CR verification grant, and display prices, positions, and histories.

Protect market integrity. Enforce the one-person-one-market rule, apply insider labeling, detect and prevent manipulation, multi-accounting, automation abuse, and other violations of the rules of the Service.

Improve the Service. Analyze aggregate usage to understand how features are used, diagnose defects, and develop improvements.

Comply with law. Satisfy applicable legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

Transparency is a structural feature of the Service, not an incidental disclosure. The following information is public by design and visible to anyone who uses the Service:

a Listed Person's market — its ticker, price history, updates, linked corrections, and INSIDER labels on the Listed Person's own trades; and every account's trading record — the positions taken and trades made under that account's display name.

By listing yourself or trading on the Service, you direct us to publish this information as part of the Service's operation. Rights to deletion described in Section 7 apply to personal identifiers, not to the existence of the public market record, which persists in pseudonymized form as described in Section 6.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. The Service contains no advertising networks. We disclose information only as follows:

Service providers and processors. Vendors that perform services on our behalf, under contracts that limit their use of the information to providing those services. The current categories of processors, and the vendors engaged in each, are: infrastructure and database hosting, including authentication (Supabase); product analytics (PostHog, when analytics is enabled, as described in Section 8); and identity verification (no identity-verification provider is engaged during the play-money alpha, during which verification is administered manually; a professional identity-verification provider will be engaged before any real-money phase, and this Policy will be updated at that time).

Legal process and protection. Where required by law, subpoena, or other legal process, or where disclosure is necessary to protect the rights, safety, or property of veledah, our users, or others.

Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, in which case this Policy will continue to apply to the transferred information until a revised policy takes effect under Section 13.

We retain personal information for as long as your account is active and as needed for the purposes in Section 3, after which it is deleted or de-identified.

The ledger is append-only and immutable. To reconcile that immutability with your rights, personal identifiers are stored separately from ledger entries, which reference accounts by internal pseudonymous identifiers. When personal information is erased — on request or following delisting — the identifying records are deleted, and the ledger's pseudonymized entries persist as the mathematical audit record of the market. After erasure, those entries no longer identify you. When an account is deleted, the content submitted under that account — profile information and, for Listed Persons, published updates — is deleted together with the identifying records; only the pseudonymized ledger entries described in this Section persist.

Delisting a market follows the procedure described in Section 6.5 of the Terms of Service. Delisting removes a market from active trading; it does not rewrite the ledger, and the market's pseudonymized trading history remains part of the permanent record.

Subject to applicable law, you may request access to the personal information we hold about you, correction of inaccurate information, deletion of personal information, and a portable copy of information you provided. Deletion is subject to the ledger architecture described in Section 6: identifying records are erased, while pseudonymized ledger entries persist as the audit record of the market. We do not discriminate against anyone for exercising these rights. To submit a request, contact us at [CONTACT]; we will verify your identity before acting on a request.

7.1 California residents (CCPA/CPRA)

California residents have the rights to know, correct, and delete personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right to non-discrimination. veledah does not sell or share personal information as those terms are defined by the CCPA/CPRA, and does not use or disclose sensitive personal information for purposes other than those permitted by the statute. We honor opt-out preference signals, including Global Privacy Control, as required by California law. Categories of information collected, purposes, and disclosure practices are described in Sections 2, 3, and 5.

7.2 European Economic Area and United Kingdom (GDPR)

Where the GDPR or UK GDPR applies, veledah processes personal data on the following legal bases: performance of a contract (operating your account and executing your instructions on the Service); legitimate interests (market integrity, anti-manipulation enforcement, security, and product analytics); legal obligation (compliance with applicable law); and consent (a Listed Person's decision to publish a market and its content, which may be withdrawn by delisting, subject to Section 6). You have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with your supervisory authority. Our representative in the European Union is [EU REPRESENTATIVE]. Requests may be directed to [CONTACT].

The Service uses cookies and similar technologies for authentication, session management, security, and preference storage, and a product-analytics tool (PostHog or an equivalent) to measure feature usage and diagnose defects. The Service contains no advertising networks and no third-party advertising trackers. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning. Because we do not sell or share personal information, browser Do Not Track and Global Privacy Control signals do not change how the Service operates, though we honor such signals where the law requires.

The Service uses automated systems to operate markets and to protect their integrity. Automated processing includes the execution of trades against the automated market maker, the application of fees and trading rules such as balance checks, concentration limits, and rate limits, and integrity monitoring — for example, signals designed to detect wash trading, duplicate accounts, and automation abuse. Integrity signals do not themselves suspend accounts or remove markets; they flag activity into queues for review by a person. No decision producing legal or similarly significant effects concerning a person is made solely by automated means.

We do not use your personal information, or the content you submit to the Service, to train artificial-intelligence models. AI-assisted tooling is used in developing the software that runs the Service; that tooling operates on source code and design materials and does not receive user personal information.

We maintain administrative, technical, and organizational safeguards appropriate to the nature of the information we hold, including encryption in transit, hashed credential storage, access controls, and the separation of personal identifiers from ledger records described in Section 6. No system is impenetrable; we cannot guarantee absolute security, and you are responsible for safeguarding your account credentials.

The Service is operated from [OPERATING JURISDICTION]. If you access the Service from another jurisdiction, your information will be transferred to and processed in [OPERATING JURISDICTION]. Where required, transfers from the European Economic Area, the United Kingdom, or Switzerland are made under appropriate safeguards, including [TRANSFER MECHANISM — e.g., Standard Contractual Clauses].

The Service is available only to persons 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and no market may exist for a person under 18. If we learn that information has been collected from a person under 18, we will delete it and terminate the associated account.

We may revise this Policy from time to time. The "Last updated" date above reflects the current version. For material changes, we will provide notice through the Service or by email before the changes take effect. Continued use of the Service after the effective date constitutes acknowledgment of the revised Policy.

Questions, requests, and complaints regarding this Policy or our data practices may be directed to [CONTACT] or by mail to [MAILING ADDRESS].