Privacy Policy

The data controller is Elere Inc., operating the website at wallstmath.com, with a registered address at 270 O’Connor Drive, East York, Ontario M4J 2T7, Canada.

For any question about this policy or about your personal data, contact hello@wallstmath.com. We aim to respond within 30 days. Applicable law permits extensions in defined circumstances; if one is necessary, we will tell you within the initial response period.

We have not appointed a Data Protection Officer. Privacy enquiries go to the address above and are handled by the operator directly. We will revisit whether a formal DPO or representative is required as our processing, scale, and markets change.

We apply the strictest standard we are subject to, globally, rather than varying our practices by where you live. In practice that means the GDPR standard applies to everyone, with two exceptions we call out explicitly: cookie consent, which we gate by region because the law genuinely differs, and marketing email, which follows the consent rules of your jurisdiction.

On that last row: many comprehensive US state privacy laws, including the CCPA/CPRA, use revenue, processing-volume, or other applicability thresholds. Based on our current size and processing, we understand that we are below those thresholds. We will reassess this as the service grows. We extend the core rights — access, deletion, and opt-out — to US residents regardless.

3.1 Information you give us

Every field marked optional can be left blank, and the service works identically without it. You can change or clear them at any time in your account settings. We ask for them to understand who uses the product; we do not use them to make any decision about you individually.

3.2 Information generated by using the service

3.3 What we deliberately do not collect

This list is as much a part of the policy as the rest, and we intend to keep it accurate:

• No raw IP or user-agent fields in our app tables. We store a keyed, pseudonymous IP-derived identifier to limit abusive requests. It is not an anonymous identifier. Expired counters are removed by daily cleanup after 24 hours, so they can remain for approximately 48 hours after their last window. Vercel and Supabase can process IP address, user-agent, request time, device/browser, and approximate location signals in infrastructure and security logs. Google Analytics can receive device/browser, coarse location, page/referrer, and identifier data where analytics is enabled. These provider records are separate from the Wall St Math tables described above and are retained according to each provider's plan and logs policy.
• No device fingerprinting or precise location. We do not request device location or build a fingerprint. Approximate country/region may be inferred by providers from the network request for routing, security, or aggregate measurement.
• No payment data. The service is free. If we introduce payments, a PCI-compliant processor will handle card details and we will never receive or store them.
• No intentional special-category collection. We do not ask for health, race, religion, politics, sex life, biometrics, or union membership. Do not put such information in feedback or other free-text fields; if you send it, we process it only to handle your message and remove it when no longer needed.
• No precise geolocation. We derive a two-letter country code from the network request. We never request device location.

3.4 If you use the service without an account

You can take a drill as a guest. Where analytics is permitted and enabled, we record the result, a country code, and the referring URL against a random identifier stored in your browser. That identifier is not linked to any name or email. If you later create an account, you may choose to migrate those guest results into it — that is the only circumstance in which guest activity becomes associated with an identified person.

Under GDPR and UK GDPR we must have a lawful basis for each purpose. Here is ours, purpose by purpose.

Where the basis is consent, you may withdraw it at any time and it is exactly as easy to withdraw as it was to give. Withdrawal does not affect the lawfulness of anything done beforehand. Where the basis is legitimate interests, we have weighed our interest in running a secure service against your rights, and you may object at any time by writing to us.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you. Your scores are calculated automatically, but they decide nothing beyond your ranking in a game.

Full detail, cookie by cookie, is in our Cookie Policy. In summary:

• Strictly necessary cookies — your login session and your stored cookie preferences. These do not require consent because the service cannot function without them.
• Analytics cookies — our own measurement and Google Analytics. They require consent in strict-consent regions (including EU/EEA, the UK, Brazil, Canada, China, Switzerland, Türkiye, and unknown locations); elsewhere they run under the applicable permitted basis and can be switched off immediately in Privacy Choices.
• Marketing cookies — none are in use today. The category exists so that if we ever add advertising or remarketing, it is off by default and can only be switched on by you.

In strict-consent regions, nothing beyond strictly necessary cookies is set until you opt in, and rejecting is presented exactly as prominently as accepting. In standard regions, analytics may run under the applicable permitted basis by default, but you can switch it off at any time through “Legal & Privacy” in the footer. Marketing is off by default everywhere, for everyone.

We have never sold personal data, and we do not share it for cross-context behavioural advertising. If that ever changes, we will say so here before it happens and obtain consent where the law requires it.

We use providers that may act as processors on our instructions or as independent service providers under their own privacy terms, depending on the service. The current list, with what each one receives and where it is located, is maintained at /subprocessors.

Beyond those providers, we disclose personal data only where we must:

• To comply with a law, court order, or other valid legal process
• To establish, exercise, or defend a legal claim
• To protect the rights, safety, or property of our users or the public
• To a successor entity in a merger, acquisition, or sale of assets — you would be notified beforehand and this policy would continue to apply until replaced

Your username or display name and your scores are visible to other users on leaderboards. If you added a country to your profile, its flag is visible there too. That is the point of a leaderboard, but choose a username accordingly — you are not obliged to use your real name, and we would gently suggest you do not.

We are based in Canada and our database is hosted in the United States (Oregon). If you are in the EEA, the UK, or Switzerland, your data is transferred outside your country.

These transfers rely on:

• Standard Contractual Clauses — where required and actually included in the applicable provider terms or agreement, we use the European Commission’s approved clauses and UK Addendum as a transfer safeguard.
• The EU–US Data Privacy Framework only where a recipient is currently certified and the transfer is eligible; we do not rely on it where it is unavailable.
• Canada’s adequacy decision, under which the European Commission recognises Canadian commercial privacy law as providing adequate protection.

You may request a copy of the relevant safeguards by writing to hello@wallstmath.com.

The application targets these periods, subject to provider log policies, backups, and legal holds. When you delete your account, active application-table records linked to that account—including analytics events—are deleted. Pseudonymous guest-session records never linked to the account follow the published 14-month retention period unless you make a separate identifiable-data request. Provider infrastructure logs, backups, or legally required records may persist for the period those providers or laws require.

We keep a record of every email consent decision you make — including refusals — because Canadian anti-spam law places the burden of proving consent on us. Those records are tied to your account and are deleted along with it, so deleting your account really does remove them.

Wherever you live, you can:

The first two and the third are deliberately self-serve. You should not have to ask permission to leave, or wait on us to get your own data.

For anything requiring us to act, email hello@wallstmath.com. We will respond within 30 days and may need to verify your identity first — usually by confirming control of the account email. There is no charge unless a request is manifestly unfounded or excessive, and we will tell you before charging anything.

The self-serve export covers active application and authentication tables. Provider infrastructure logs, backups, and guest or other identifiers not linked to your account may require a separate request to us so we can assess what is identifiable and legally retrievable.

If you are unhappy with our response

Please raise it with us first — we would rather fix it. You also have the right to complain to a regulator without going through us:

• EEA — your national supervisory authority; the full list is published by the European Data Protection Board
• UK — the Information Commissioner’s Office at ico.org.uk
• Canada — the Office of the Privacy Commissioner of Canada at priv.gc.ca
• Switzerland — the Federal Data Protection and Information Commissioner

• All traffic is encrypted in transit with TLS; data is encrypted at rest
• Passwords are stored only as salted hashes. Nobody at Wall St Math can see your password, and we will never ask you for it
• Ordinary authenticated access to user-owned tables is scoped by row-level security; narrowly scoped service and administrative operations can bypass it where necessary
• Administrative access is restricted to named accounts and protected by appropriate access controls
• Requests are rate-limited to blunt automated abuse

No system is perfectly secure and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and notify you without undue delay where the risk is high. We investigate and document security incidents as appropriate; we do not promise a particular internal log format or retention period here.

If you have found a security vulnerability, please report it to hello@wallstmath.com. We will not pursue legal action against good-faith research that respects user privacy and does not degrade the service.

The service is not directed at children. You must be at least 16 to create an account, and we ask you to confirm this at signup.

We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete the account and its data promptly. A parent or guardian who believes their child has created an account should contact hello@wallstmath.com and we will act without requiring any formal process.

We will update this policy as the service changes. The version and date at the top always reflect the current text.

For material changes — a new purpose, a new category of data, or a new recipient — we will give notice in the product before the change takes effect, and where the change concerns anything you consented to, we will ask again rather than assume your previous answer still stands. We will not quietly broaden what we do with your data and rely on you not re-reading this page.

Privacy questions and rights requests: hello@wallstmath.com
Security reports: hello@wallstmath.com
General: wallstmath.com/feedback

Elere Inc.
270 O’Connor Drive
East York, Ontario M4J 2T7
Canada