Privacy Policy

1. Who we are and what this policy covers

Propy Market is operated by [OPERATOR LEGAL NAME], organised in [STATE OF ORGANISATION], registered address [REGISTERED ADDRESS]. In this policy "we" is that company and "the platform" is propymarket.com, the app behind its login and the e-mails we send. The spelling proppymarket.com redirects to the same site.

This policy covers everyone who visits the site or holds an account, and the data we receive about you from the partners that handle payments, wallets, identity checks and screening for us. It does not cover those partners' own sites and policies, which are linked where you meet them.

What the platform is shapes what we collect. You buy a ticket, which is a simulated trading account with a virtual balance and published rules, and you trade real-market prices on it. No real securities, futures, options or crypto are ever bought or sold for you, nothing is mirrored to a real brokerage, and we hold no balance for you: a ticket is bought and a prize is paid out. So there is no brokerage account, no bank account and no card on file with us.

2. What we collect

Account details. Your e-mail address, your username and your password, which we store only as a hash we cannot read back. At sign-up you also tell us your date of birth, your country and state, and you confirm that you are 18 or older.

Connection and device data. Your IP address each time you connect, the state and country we derive from it, what your browser tells us about your device and browser, and the timestamps of what you do on the platform. Our servers log this.

Payments. When you pay a ticket by card, Apple Pay or Google Pay you enter your details in Stripe's payment form, not ours. Stripe tells us whether the payment succeeded, failed or was refunded, and gives us a payment reference. We never receive or store card numbers.

Wallet addresses. The wallet address linked to your account through the MBW Connect widget, the address each USDC or USDT ticket was paid from, and the on-chain transactions for your tickets and prizes.

Identity documents. Only when you claim a payout of $3,000 or more, through the MBW Connect verification flow, and only for that verification — apart from the cases the Terms name. Section 6 explains it.

Tax details. Only where a prize triggers tax reporting. Section 6 explains it.

Contest activity. Every ticket you buy, every trade on your simulated accounts, each ticket's equity curve, your rankings, trophies, levels and prizes, your re-buys and running spend, and the limits you set under Responsible play (daily and weekly spend caps, cool-off, self-exclusion).

Messages. What you post in the Community and Challenge chat rooms, your direct and group messages with other users, your conversations with Bill, the assistant in the challenge room, and the e-mails you send to support@propymarket.com.

Results from our partners. Whether your wallet address passed a sanctions check, the state and country our IP-geolocation provider derives from your IP address, and the outcome of an identity verification. We receive the result, not the provider's working.

3. Why we use it

To run the contests. We open your tickets, run your simulated trades against the platform's own price feed, rank you at the bell, apply the published reward tables and show your results. The prices the platform recorded are what settles a round.

To take payment and pay prizes. We confirm a ticket is paid before it enters, refund every ticket of a voided round to the payment source it came from, and send each prize to the wallet address the entry was made with.

To check eligibility. Paid contests are open only to people 18 or older who are not resident in, or physically present in, the US states listed on the State Eligibility page. We decide where you are from your IP address and other signals, we check your age confirmation, and at every entry we screen your wallet address against sanctions lists, including the OFAC lists. An account that belongs to a person on a sanctions list is refused.

To keep the contests fair. The Rules allow no automation or bots, one account per person, no collusion between entrants and no insider or non-public information. To enforce that we compare device and browser data, IP addresses, wallet addresses and trading patterns across accounts and tickets. A breach voids entries and forfeits prizes, and we keep what we found.

To apply your Responsible play limits. We enforce the spend caps you set and the platform's defaults, show your running spend before every re-buy, apply the re-buy cap of each round, and honour a cool-off or self-exclusion for its full period.

To meet our legal duties. Identity verification before a payout of $3,000 or more, sanctions compliance, tax reporting where it applies, and the records the law requires us to keep.

To support you and settle disputes. We answer your e-mails, and a dispute about a round is settled on the platform's recorded data, which is what decides it.

To tell you what is happening. Service e-mails such as a round starting, a ticket liquidated, a prize won or paid, a verification needed or a password reset. We do not send marketing e-mail.

To keep the platform safe and running. We watch for attacks and abuse, fix faults and keep logs.

Some of these decisions are automated: the location check and the sanctions check at entry refuse an entry without a person looking first. You can ask support to review a refusal. [COUNSEL]

4. What is public

Contests are public by design. Your username, your place in every ranking, your trophies, levels, wins and win rate, and every finished simulated book — the trades and the equity curve of each ticket once its round, run or Career has ended — can be seen by every other user, and a leaderboard teaser on the public welcome page may show top usernames and results to anyone, logged in or not. Choose a username you are happy to be known by.

While a round is running, other entrants see the live leaderboard and aggregate figures such as total long against short exposure. The trades inside your ticket are shown only after the bell.

Your e-mail address, IP address, payments, identity documents and tax details are never public. We never publish your wallet address either, but a transaction on a public blockchain is visible to anyone who knows the address, and we cannot remove it.

Chat. Messages in the Community room are visible to every logged-in user, and messages in a Challenge room to every entrant of that challenge. Direct and group messages are visible to the people in them. Your conversation with Bill is visible to you alone. Our moderators can read any message that is reported, and we read messages when we investigate a fair-play breach.

5. Who handles your data

We share data only with companies that do a job for us, only the data that job needs, and under written terms that stop them using it for anything else. [COUNSEL]

Stripe handles card, Apple Pay and Google Pay payments. Your payment details go to Stripe directly; Stripe sends us the payment status and reference, and runs its own fraud checks under its own privacy policy.

MBW Connect provides the wallet widget and identity verification. It links a wallet to your account, carries tickets paid in USDC or USDT, receives your prizes, and runs the identity verification for a payout of $3,000 or more.

A sanctions-screening provider checks wallet addresses, and the details from an identity verification, against sanctions lists including the OFAC lists.

An IP-geolocation provider turns your IP address into a state and country.

An e-mail provider delivers our service e-mails and receives the e-mails you send to support.

Google Cloud hosts the platform and its databases in a United States region.

[CUSTODY PROVIDER — PLACEHOLDER: if a digital-asset custody provider holds each challenge's address and sends prizes on-chain, it is named here with what it sees (the wallet address and the amount of each crypto ticket and each prize). It is not in the confirmed processor list; confirm or remove with the custody decision the Contest Rules flag in section 3.4.]

We also disclose data when we must: to a tax authority where reporting applies [COUNSEL], to a court, regulator or law-enforcement body on a valid request, and to protect the platform and its users from fraud or abuse. If the business is sold or merged, your data goes with it under this policy, and we tell you.

We do not sell your data, and we do not give it to advertisers or data brokers.

6. Payouts of $3,000 or more

A prize under $3,000 is paid automatically when it is due to the wallet address the entry was made with. No identity check is involved.

A payout of $3,000 or more is held until you complete a short identity verification in the MBW Connect verification flow. This is the only time we ask for identity documents, apart from the cases the Terms of Service name: a lower amount where the law requires it, or a sanctions, fraud or legal signal. The threshold applies to each payout, not to your prizes added together. [COUNSEL]

The documents and details you submit are used for that verification and kept only as long as it requires. Once it is complete we keep its outcome, its date and the reference the verification gave us with the payout record, not the documents.

Where your prizes reach the IRS reporting threshold — currently $600 in a year — we ask for the details that reporting requires, such as a tax form, and we file the report. [COUNSEL]

7. Cookies

We set one session cookie, which keeps you logged in and protects your session, and we keep your preferences — such as your theme and layout choices — in cookies or your browser's local storage. That is all. No advertising cookies, no third-party analytics, no trackers.

The session cookie is essential; the platform does not work without it. You can clear cookies and local storage in your browser at any time; you will be logged out and your preferences reset.

Stripe's payment form and the MBW Connect widget are embedded on the pages where you pay and manage your wallet. Each may set its own cookies for security and fraud prevention under its own privacy policy.

Because we do not track you across other sites, a browser's "Do Not Track" or Global Privacy Control signal changes nothing on our side. [COUNSEL]

8. How long we keep it

Account details: for as long as your account exists. When your account is deleted, we delete or anonymise them, except what the rest of this section says we must keep.

Contest records: every ticket, trade, equity curve, ranking, recorded price, refund and payout is the record of a contest and of money paid. We keep them for [CONTEST RECORD RETENTION PERIOD] after the contest, which covers the 7-day dispute window and the financial records the law requires. [COUNSEL]

Chat messages and conversations with Bill: 90 days, then deleted. A message that is part of a report or an investigation is kept until that is closed.

Support e-mails: with your account, so the history of your requests is there when you write again.

Connection logs (IP addresses, device and browser data): [LOG RETENTION PERIOD], longer when a log is evidence in a security or fair-play case. [COUNSEL]

Identity documents: only as long as the verification requires (section 6).

Eligibility and compliance records (location checks, sanctions results, your age confirmation, the limits you set, a self-exclusion, tax forms): as long as the law requires, because they show the contests were run as allowed. [COUNSEL]

Payment references and status: as long as financial record-keeping requires. [COUNSEL] Stripe keeps its own records under its own policy.

9. Security

Everything between your browser and the platform travels encrypted. Passwords are stored as salted hashes; we never see your password and cannot read it back.

Card details never reach our servers; they go to Stripe. Identity documents go through the MBW Connect verification flow and are held only for that verification.

Inside the company, access to your record is limited to the people who need it for support, compliance and operations, and every back-office action on it is logged with who did it and when.

A prize is paid only to the wallet address the entry was made with, and cannot be redirected after entry.

No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires. [COUNSEL] Keep your password to yourself, and tell support@propymarket.com at once if you think someone else has used your account.

10. Your rights

You can ask us what data we hold about you, ask us to correct it, or ask us to delete it. Write to support@propymarket.com from your account's e-mail address; we confirm it is you before we act, and we answer within [RESPONSE PERIOD] days. [COUNSEL]

You can change your e-mail address, password, limits and preferences in your account at any time.

Deletion has limits. We keep what section 8 says the law requires. Finished contest records stay, because every other entrant's result and prize was decided against them; when your account is deleted we replace your username on them with an anonymous label. [COUNSEL]

If you live in California, the California Consumer Privacy Act (CCPA, as amended by the CPRA) may give you the right to know what we collect and why, to delete it, to correct it, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be treated differently for using these rights. We do not sell or share personal information as the CCPA defines those terms. [COUNSEL: confirm whether the CCPA applies to the operator; complete the California notice — categories collected, their sources and purposes, retention per category, sensitive personal information, the request, verification and appeal process, and authorised agents.]

If you live in another state with a privacy law, you may have similar rights; the same e-mail address is the way to use them. [COUNSEL]

11. Children

Propy Market is for adults. You must be 18 or older to hold an account, and older where your state sets a higher age for paid contests. [COUNSEL] We do not knowingly collect data from anyone under 18.

If we learn that an account belongs to someone under 18, we close it and delete the personal data we are not required to keep. If you believe a minor has an account, tell support@propymarket.com.

12. Where your data is stored

The platform and its databases run on Google Cloud in a United States region. Your data is stored and processed in the United States. Our processors handle data where they operate; section 5 lists them.

Paid contests are not available outside the United States at launch (see the State Eligibility page). If you visit the platform from outside the United States, your data is transferred to and processed in the United States, where privacy law may differ from your country's. [COUNSEL: whether users outside the United States are admitted at all and, if they are, which transfer terms apply.]

13. Changes to this policy

We will change this policy when the platform or the law changes. Each version carries its effective date, and earlier versions are available from support@propymarket.com.

If a change matters to you — new data collected, a new purpose, a new kind of sharing — we tell you by e-mail or by a notice in the app before it takes effect. Corrections and clarifications take effect when posted.

14. Contact

Privacy questions, requests and complaints: support@propymarket.com, with "Privacy" in the subject line.

By post: [OPERATOR LEGAL NAME], [REGISTERED ADDRESS].

A dispute about a round has its own route: contact support within 7 days of settlement, and the platform's recorded data decides. The Terms explain it.