Privacy Notice
This notice describes the current closed-pilot service. Before general availability, we will publish the completed processor, transfer, retention, cookie, and data-protection-governance records. This does not introduce new uses of personal data.
1. Who is responsible for your data?
HouseAlone, trading as Sharpe League, is the controller of personal data described in this notice. Our details are: Randweg 116A, Rotterdam, The Netherlands; KVK 42078906; VAT ID NL005477900B96; info@sharpeleague.com; +39 327 070 5577.
For privacy questions or to exercise your rights, email info@sharpeleague.com with the subject “Privacy request”. We have not appointed a data-protection officer on the information currently available. If one is appointed, we will publish the contact details here.
2. Data we collect and where it comes from
We collect data directly from you when you create an account, complete a profile, connect a paper portfolio, use the Service, contact us, request a withdrawal, or request guardian approval. We also receive limited data from the services you choose to connect or use.
- Account and identity data: email address, authentication identifier, first and last name, nickname, participant code, and account-security information.
- Profile and participation data: university or school, age band, profile visibility choices, biography, social links, league memberships, invitations, settings, and activity needed to operate a competition.
- Paper-portfolio data: encrypted Alpaca OAuth token material or, during this closed pilot, encrypted Alpaca paper API-key material; account connection status, paper positions, balances, paper orders, portfolio history, metrics, and rankings. We do not ask you for your Alpaca password or authorize live accounts.
- Billing and transaction data: plan, Stripe customer and subscription identifiers, billing status, trial status, cancellation or withdrawal references, and confirmations. Stripe processes payment-card details directly; we do not receive the full card number.
- Guardian data: for a participant aged 16 or 17, guardian email address, guardian name, approval status, and approval evidence. Approval links expire after seven days.
- Technical and security data: IP address and device/browser, authentication and session data, security-verification result, request and error logs, and records needed to detect abuse and protect the Service.
- Communications: messages, complaints, and the information you provide to support.
When you use Google sign-in, Google provides the account information you authorise it to share, such as your name and email address. When you connect Alpaca through OAuth, Alpaca provides the paper-account information needed to operate the connection. During the closed pilot, you may instead choose to provide paper API-key material directly for that same purpose. When you subscribe, Stripe provides the payment and subscription status needed to administer the membership.
3. Why we use data and the legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide your account, connected paper portfolio, leagues, rankings, support, and paid membership. | Account, profile, portfolio, participation, support, and billing data. | Performance of our contract with you; steps taken at your request. |
| Process payments, subscriptions, withdrawals, tax and accounting records, and legal evidence of acceptance. | Billing, transaction, acceptance, and contact data. | Performance of contract and compliance with legal obligations. |
| Protect accounts, prevent fraud and abuse, maintain security, investigate incidents, and improve reliability. | Technical, security, account, and activity data. | Our legitimate interests in operating a safe, reliable Service and protecting participants; where applicable, legal obligations. |
| Display a competition identity and results. | Nickname, participant code, league participation, rank, and paper-performance metrics; optional profile fields where you choose to publish them. | Performance of our contract and our legitimate interest in operating a transparent competition. Optional profile publication follows your instruction and can be changed in Account. |
| Obtain and record guardian approval for participants aged 16 or 17 where required. | Participant identity, age band, guardian contact data, and approval evidence. | Our legitimate interests in safeguarding younger participants and, where applicable, performance of our contract and compliance with legal obligations. |
| Respond to requests, complaints, and legal claims. | Contact, communication, account, transaction, and relevant security data. | Our legitimate interests in customer care and defending legal claims; where applicable, legal obligations. |
We do not make decisions producing legal or similarly significant effects about you solely by automated means based on the information reviewed for this draft. We do not use your paper-trading performance to provide investment advice.
4. What other people can see
Sharpe League is designed for competition. Public leaderboard pages may show your nickname, participant code, rank, and selected paper-performance metrics. Your university appears there only when your profile is public and you choose to show your university. Your real name, email address, credentials, and raw account responses are not public leaderboard fields. In your profile settings, you control whether your full name, university, and social links are visible on your profile. A setting cannot retroactively remove content that has already been copied or lawfully retained by others.
Competition results may remain visible after account deletion only as a pseudonym and participant code without a link to your deleted account. This preserves the integrity of historical standings while reducing identifiability.
6. How long we keep data
We keep data only for as long as needed for the purpose described above, to comply with law, resolve disputes, enforce agreements, and maintain security. The current product behaviour is:
- account and profile data are kept while the account is active and removed when the account is deleted, subject to the exceptions below;
- encrypted Alpaca OAuth token material or encrypted paper API-key material is deleted when you disconnect the portfolio or delete the account; disconnecting also deletes the connected portfolio’s league entries, history, metrics, and private connection identity;
- account deletion removes the sign-in, profile, linked portfolios, guardian approval record, and the direct link between retained legal-evidence records and the former account;
- historical final standings can remain under a pseudonym and participant code without a link to the deleted account; and
- Stripe and we may retain billing, tax, transaction, withdrawal, and legal-evidence records for the period required by applicable law.
We have not yet published fixed retention periods for technical logs, support records, security records, backups, and legal evidence. Until those periods are adopted, these records are retained only under the purpose-based criteria above and reviewed for deletion or anonymisation when no longer needed. We will publish the periods before general availability.
7. Security
We use technical and organisational measures designed to protect personal data. Alpaca OAuth token material and, during this closed pilot, paper API-key material are encrypted before storage, excluded from browser-readable database access and application logs, and decrypted only in backend memory when needed for portfolio synchronisation. No method of transmission or storage is completely secure; you should protect your password and never send account credentials through email or support messages.
8. Your privacy rights
Subject to applicable law, you may request access to your data; correction; deletion; restriction; portability; and, where we rely on legitimate interests, object to processing. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing. You may also ask for information about the logic and consequences of any relevant automated decision-making.
To make a request, email info@sharpeleague.com from your account email where possible. We may ask for information needed to verify your identity. We will respond within the period required by applicable law, normally one month under the GDPR, subject to any permitted extension.
You may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your habitual residence, place of work, or place of the alleged infringement.
9. Cookies and similar technologies
We do not use advertising or behavioural-analytics cookies or tags. The Service uses strictly necessary browser storage to keep a signed-in session and to retain limited interface preferences, including the Supabase authentication session and short-lived sign-up state. Cloudflare Turnstile is loaded on sign-up, login, and password-reset flows to prevent automated abuse. Depending on Cloudflare’s security configuration, it can also issue a strictly necessary cf_clearance security cookie after a challenge.
We do not show a consent banner because we do not use non-essential cookies or similar technologies. Before enabling one, we will provide the required information and obtain consent where required, including the technology, purpose, provider, retention, and withdrawal method.
10. Changes and contact
We may update this notice when the Service, our processing, or the law changes. We will publish the new version and update its effective date. For material changes, we will provide additional notice where required.
Questions, requests, and complaints: info@sharpeleague.com · +39 327 070 5577 · HouseAlone trading as Sharpe League, Randweg 116A, Rotterdam, The Netherlands.
Related documents: Terms & Conditions and Cancellation & withdrawal.