hackmarket Privacy Policy

Last updated: October 12, 2026

We collect only what we need to run a free game: your sign-in details, your gameplay and basic technical data, crash reports unless you switch them off, plus usage analytics if you allow them. We do not sell your personal information or show ads.

This policy explains how 127THOUSAND, LLC ("hackmarket," "we," "us") handles information when you use the hackmarket game at https://hackmarket.dev and in our apps (the "Service").

1. What we collect

We never receive your GitHub, Google or Apple password. From GitHub we ask only to read your email addresses and basic profile, not your repositories, code or organizations. From Google we ask only for your basic profile and email address. Google also sends your name; we do not store it. From Apple we ask only for your email address, not your name; with Hide My Email, Apple gives us a private relay address (ending in @privaterelay.appleid.com) that forwards to your real one. We keep Apple's refresh token to keep your sign-in link valid and to revoke it.

2. How we use it

• Create and secure your account and keep you signed in
• Run the game: process trades, calculate portfolios, show leaderboards and player profiles
• Detect cheating, abuse, bots and multiple accounts
• Fix bugs, keep the Service running, and measure how it is used to improve it
• Send the push notifications you allow: your stop loss and take profit hits, liquidations, resting order fills, rank changes, and @mentions of you in the floor chat
• Send emails: a welcome email, the daily recap and weekly digest unless you switch them off, a notice when a market you listed is delisted, a confirmation when your account is deleted, and product updates only if you turn them on
• Contact you about your account or about changes to these policies, when needed
• Comply with legal obligations

For users in the EU and UK, our legal bases are performing our contract with you (running the game, including sending the push notifications you allow and the account emails), our legitimate interests (security, preventing cheating, keeping the Service running, finding and fixing crashes through crash reports, counting visits without cookies, and sending daily recaps and weekly digests you can switch off), and your consent for usage analytics, for push notifications (given in your phone's permission prompt) and for product update emails, which you can withdraw at any time.

3. What other players see

Leaderboards and player profiles are visible to other signed-in players. They show:

• your username;
• your avatar: your GitHub profile picture if you sign in with GitHub; if you sign in with Google, your initial (your Google picture is shown only to you); if you sign in with Apple, your initial;
• your in-game results: rank, number of trades, win rate and profit or loss in play money;
• your open in-game positions: which markets you hold, how much, at what prices, and their open profit or loss in play money (not your stop, target or trailing orders);
• your daily in-game results for the last 30 days.

The floor chat is visible to every signed-in player too. It shows:

• your messages, with your username and avatar, until you delete them or they are 7 days old;
• when you join hackmarket, and when you come online after being away;
• your in-game trades as they happen: what you bought or sold, how much, at what price, and the profit or loss in play money of what you closed, including take profits, stop losses and liquidations. You can switch this off at any time in Settings, then Chat, then "Show my trades in the floor chat";
• when you enter, rise in or drop out of today's top 10;
• your @mentions of other traders, which are part of your public messages (the trader you mention may also get a push notification);
• how many players are online (a count, not who).

If you list a GitHub repository as a new market, it is shown publicly as listed by you: your username appears on that market and in the floor chat. If you delete your account, the market stays listed but no longer shows your name.

Your email address is never shown to other players.

4. Who we share it with

We do not sell your personal information or share it for advertising. We share it only with:

• Our hosting provider, Serverpod Cloud (Serverpod AB), which hosts our servers, database and stored profile pictures in Europe under contract with us
• Our analytics provider, PostHog, Inc., in the United States, which receives usage analytics on our behalf to show us how the game is used: in full if you allow them, as a cookieless count of web visits if you decline (section 5)
• Our crash reporting provider, Sentry (Functional Software, Inc.), in the United States, which receives crash reports on our behalf so we can find and fix errors
• Our push notification provider, Firebase Cloud Messaging (Google LLC), in the United States, which receives your push token and the notification text on our behalf to deliver push notifications to your phone
• Our email provider, Loops (Loops.so, Inc.), in the United States, which receives your email address, username, app language and the content of each email (including the in-game figures in recaps and digests) on our behalf to send our emails
• GitHub, Google and Apple, only as needed to sign you in, and for Apple also to revoke hackmarket's Sign in with Apple authorization. When the Service shows a GitHub profile picture, your browser or app loads it directly from GitHub, which receives your IP address as with any web request
• Authorities, when required by law or to protect the rights and safety of hackmarket or others
• A buyer or successor, if hackmarket is sold or merged, under this policy's protections

Our servers and database are hosted in Europe, and usage analytics, crash reports, push notifications and emails are processed by PostHog, Sentry, Firebase Cloud Messaging and Loops in the United States. We are based in the United States, so your information may also be accessed from the United States. Where the law requires, we use appropriate safeguards for these transfers.

5. Cookies, local storage and your consent

We use your browser's or device's storage to keep you signed in and to remember your settings. These are needed for the Service and are not used to track you.

Usage analytics are optional, and we ask first. Until you answer the cookie and analytics question shown when you open hackmarket, nothing is stored for analytics and no analytics are collected.

• If you allow them, PostHog stores a random identifier on the web in a cookie and local storage, and in the apps on your device, so it can tell visits from the same browser or device apart, and collects the usage analytics described in section 1.
• If you decline, nothing is stored on your device for analytics. In the apps, no analytics are sent. On the web, PostHog only counts your visit: it combines your IP address and browser details into a one-way code on its servers, with a key that changes daily and is then deleted, so it cannot identify you or follow you from one day to the next.

You can change your answer at any time in the app (Settings, then About, then Usage analytics); withdrawing consent stops the analytics from then on. We do not use advertising cookies, and the game works the same whatever you choose.

Crash reports are on unless you switch them off, at any time, in the app (Settings, then About, then Crash reports); switched off, nothing is sent to Sentry from then on. On the web, crash reporting stores nothing on your device. In the apps, Sentry keeps a random installation identifier on your device to count crash-free sessions; it is not linked to your account.

Push notifications are sent only if you allow them in your phone's permission prompt. You can turn them off at any time in your phone's settings, or choose which ones you get in the app (Settings, then Notifications).

Daily recaps and weekly digests are on unless you switch them off; product updates are off until you turn them on. You can change each one at any time in the app (Settings, then Emails), or with the one-click unsubscribe link in every recap, digest and product update. Welcome, delisting and account deletion emails are part of running your account.

6. How long we keep it

We keep account and gameplay data while your account exists. Your account value history is kept for 30 days, and floor chat messages and activity for 7 days. Crash reports are kept by Sentry for up to 90 days. When you delete your account in the app (Settings, then Delete account), we delete it and its data at once: your username, profile and profile picture, sign-in link, positions, orders, trades, settings, account value history, and your chat messages, activity, reports and chat settings. If you ask us by email instead, we do the same within 30 days. Reports of a message are kept with it, for review, and deleted with it. Server logs, which may still reference your account's ID, are kept only as long as needed to run and secure the Service, and we may keep anything we must for legal or security reasons. We may delete accounts that have been inactive for a long time. Anonymized, aggregated game statistics may be kept indefinitely.

A push token is deleted when you sign out on that phone, when you delete your account, or when Firebase Cloud Messaging reports it is no longer valid; your notification switches are deleted with your account.

Loops keeps a contact for you only if you turn product updates on; we delete it when you delete your account. Loops keeps its logs of the emails it has sent for its own retention period.

7. Your choices and rights

• Delete your account at any time in the app (Settings, then Delete account), or by emailing [email protected]. If you signed in with Apple, deleting your account also revokes hackmarket's Sign in with Apple authorization with Apple.
• Access, correct or delete your data, or get a copy of it, by emailing [email protected].
• Disconnect sign-in by revoking hackmarket's access in your GitHub or Google account settings, or, for Apple, by choosing to stop using Sign in with Apple with hackmarket in your Apple Account settings (on iPhone: Settings, then your name, then Sign-In & Security, then Sign in with Apple; or at account.apple.com). Apple then tells us, and we end your sessions signed in through Apple. If you delete your Apple Account, Apple tells us and we delete your Apple sign-in link.
• Allow or decline usage analytics, and change your answer at any time, in Settings, then About, then Usage analytics.
• Switch crash reports off (or back on) at any time, in Settings, then About, then Crash reports.
• Turn push notifications off in your phone's settings, or choose which ones you get in Settings, then Notifications.
• Choose your emails in Settings, then Emails, or unsubscribe in one click from any recap, digest or product update.

Depending on where you live (for example the EU, UK, California or Texas), you may have additional rights, including to object to or restrict processing and to appeal our decision on a request. We will not discriminate against you for exercising them. We respond within the time the law requires, normally 30 to 45 days. EU and UK users may also complain to their local data protection authority.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has an account, contact us at [email protected] and we will delete it.

9. Security

We use reasonable safeguards, including encryption in transit and access controls, to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy. If a change is material, we will notify you in the Service before it takes effect.

11. Contact

127THOUSAND, LLC · 6605 Grand Montecito Pkwy, Suite 100, Las Vegas, NV 89149 · [email protected]