Privacy Policy

• We ask for an email address so you can sign in. There is no password.
• You choose a public handle. That is what other entrants see.
• We record every trading action you take during a competition run, because replaying that record is how your result is decided.
• We do not sell your data and we do not share it for advertising.
• You can ask us for a copy of your data, or ask us to delete it.

The organiser of the Hitpoint Sprint is the Data Fiduciary for the personal data described here, meaning it decides why and how that data is handled.

TODO(legal)The legal entity name and registered address are not filled in. Supply the same entity named in section 16 of the Official Rules. Do not launch without it.

Itemised below. Nothing is collected that is not on this list, and each item is collected for the stated purpose only.

• No payment details. Entry is free, nothing is staked, and there is no payment step anywhere in the product. We hold no card number, no bank account and no wallet address.
• No password. Sign-in is a one-time code sent to your email, so there is no password to store or to leak.
• No real trading account and no real funds. All capital in the simulator and the competition is simulated.
• No identity documents, until and unless you are a prize finalist. Identity verification happens only at the prize stage, and only for finalists.

This section is the notice you are entitled to under the Digital Personal Data Protection Act, 2023, and the rules made under it. It is stated separately so it is not buried in the rest of this document.

• What we ask for: the items listed in section 3, and nothing else.
• Why: to give you an account, to run and judge the competition you entered, and to contact you about it. That is the whole purpose.
• Your consent is free, specific and informed. No box is pre-ticked. You choose to tick it, and you may enter without giving your full name.
• You may withdraw consent at any time by writing to the grievance contact in section 15. Withdrawing is as easy as giving consent. If you withdraw while a run is live, that run is ended and cannot be judged.
• You may complain to the grievance contact in section 15, and afterwards to the Data Protection Board of India.

Your account, your handle, your consent record, your run ledger and your results are stored in a Supabase-hosted PostgreSQL database. Supabase acts as our processor. Access is restricted by row-level security, so your rows are readable by your own signed-in session and by the small number of privileged server processes that run the competition (the price recorder, the replay validator, and the leaderboard builder).

The site is served by Vercel, which processes standard request logs on our behalf.

Data may be stored or processed outside India by these providers. Where that happens, it is done under the providers' own contractual data protection terms.

• We do not sell your data. Ever, to anyone.
• We do not share it for advertising or for any purpose unrelated to the competition.
• Our infrastructure providers (Supabase for the database and authentication, Vercel for hosting, and our email delivery provider for sign-in codes) process it only to deliver the service.
• If you become a prize finalist, the identity documents you provide are used only to confirm that the funded account goes to the right person, and are shared with the funded-account provider only to the extent that provider requires to open the account in your name.
• We disclose data if the law requires it. If we are permitted to tell you, we will.

The leaderboard shows your handle, your verdict, your net profit and loss percentage, your maximum drawdown, your consistency score and the time your run was verified. That is the whole list.

It does not show your email address, your name, your account identifier, your run identifier or your individual trades. The leaderboard is visible to signed-in entrants only and is not indexed by search engines.

Your handle is public within the competition by design. Choose one you are happy to be seen with.

We use Google Tag Manager to load our analytics and advertising tags: Google Analytics, the Meta pixel, the OpenAI Ads pixel and Microsoft Clarity.

• If you are in the EU, the EEA, the UK or Switzerland, we ask first. Nothing that stores an identifier runs until you accept.
• If you are in India, you do not see a cookie banner. These services run by default, and the site has no in-page way to opt out.
• Everywhere else outside the EU, the EEA, the UK and Switzerland, these run by default. You can reject them using the cookie banner, shown once until you answer it.
• Where a banner is shown, your choice is remembered for a year. To change it later, clear your browser's site data for hitpoint.app (this removes the tws_consent cookie and the saved choice) and reload the page.

• Account and handle: while your account exists. Delete the account and they go with it.
• Run ledgers and results: kept while the competition is being judged and for a period afterwards, so that a result can be re-derived, a dispute can be answered and a review can be reopened. A ledger cannot be edited or removed while its run is under judgement, because that is exactly what makes the result honest for everyone else.
• Consent records: kept as long as we need to show what you agreed to and when.
• Identity documents from finalists: kept only as long as needed to release the prize and to meet any legal or tax obligation, then deleted.

TODO(legal)The retention periods above are stated as intentions, not as confirmed numbers. Counsel and the owner must set an actual period in months for run ledgers, results and identity documents, and confirm the minimum retention any tax or KYC obligation imposes before anything is deleted.

Write to the contact in section 15 and you may:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct anything that is wrong, incomplete or out of date.
• Ask us to delete your data. We will do so, except where we must keep something to meet a legal obligation, or where a run of yours is still being judged or is under review. We will tell you which of those applies.
• Withdraw your consent, as described in section 5.
• Nominate another person to exercise these rights for you if you die or become unable to act.
• Raise a grievance with us, and afterwards with the Data Protection Board of India.

We will respond within a reasonable time, and in any event within the period the law requires.

Access to your data is controlled by row-level security in the database, so a signed in session can read its own rows and not another entrant's. The privileged credential that can read the recorded market and the live run state is used only by server code and is never sent to a browser. Traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the law requires.

Hitpoint is for adults. You must be 18 or older to create an account or to enter the competition, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, write to the contact in section 15 and we will delete it.

If we change this policy in a way that affects what we collect or why, we will say so before the change takes effect, and we will ask for fresh consent where the law requires it.

For any question about this policy, to exercise a right in section 11, or to raise a grievance, write to our grievance contact.

TODO(legal)The grievance contact email address is not filled in. The Digital Personal Data Protection Act requires a named, reachable contact. Supply one real, monitored address, and use the identical address in section 16 of the Official Rules.

If we do not resolve your grievance, you may complain to the Data Protection Board of India.