1. Overview
CoinSparring ("we", "us", or "our") is a paper trading demo platform. We are committed to being transparent about the data we collect and how it is used. This policy explains what information we gather when you use CoinSparring and your rights regarding that information.
1a. Who controls this data, and how to reach us
The controller of this database is Samuel Joseph Shaul, operating from Israel. For any question about your data, or to exercise the rights in section 8, contact support@coinsparring.com.
We are also reachable through the Feedback control on any page, but a written request through the route above is the one we guarantee a response on.
1b. What you must give us, and what is optional
Required: a username and a password. Without them we cannot create an account, because they are what identifies you and keeps your portfolio yours.
Optional: an email address, and everything else. You can add an email when you sign up, or leave the field blank and use a username only. An address also reaches us if you choose to sign in with Google or GitHub, in which case that provider passes us your name, email and profile picture. We only ever hold an email you chose to give us — it is set at signup and cannot be added or changed later from within the app.
If you decline to provide an email: nothing is withheld from you — every feature works the same. The single consequence is that we have no way to verify it is you if you forget your password, so the account cannot be recovered.
We do not sell personal data, and we do not use it for advertising.
2. Information We Collect
- Account data — the username you register with and, only if you chose to provide one, an email address. The email is optional (see section 1b) and used solely for the purposes in section 3.
- OAuth profile data — if you sign in with GitHub or Google, we receive the username, email address, and avatar image associated with that account.
- AI chat data — the questions you send to the AI assistant, the trade and portfolio context attached to them, and the assistant's replies. These are stored linked to your account.
- Usage data — pages visited, trades placed (virtual), and session duration, collected to improve the platform.
- Cookies — an authentication token stored in an HTTP-only cookie to keep you logged in. See our Cookie Policy for details.
We do not collect payment information, real financial data, or government-issued IDs. CoinSparring involves no real money.
3. How We Use Your Information
- To authenticate you and maintain your session.
- To save your virtual portfolio and trade history.
- To improve platform performance and fix bugs.
- If you gave us an email — to send account-security messages: a password-reset link when you ask for one, and email verification. These are transactional and are how we keep the account yours, so they are sent while an address is on file.
- Only if you turn it on — to send a periodic market and portfolio digest. This is marketing, it is off by default, and you can switch it on or off any time under Settings → Notifications. Every digest also carries an unsubscribe link that turns it off.
We do not sell, rent, or share your personal information with third parties for marketing purposes.
4. Third-Party Services
Live market data is streamed from Gate.io. This service may collect anonymised analytics on its end. CoinSparring does not control its data practices.
4a. Product Analytics (PostHog) and Error Tracking (Sentry)
We use PostHog to see which features get used and Sentry to see when something breaks in your browser. Both act as our sub-processors — they handle this data on our behalf, for our purposes only, not their own.
What this does not include: we do not record your screen or your session ("session replay" is switched off at the code level, not just hidden), and anything you type into a form is masked before PostHog ever sees it. Neither tool ever receives a balance, a trade amount, or a price — error reports are scrubbed of anything money-shaped before they leave your browser, and the product-analytics events we send are a fixed, named list (e.g. "a trade was placed") that carries a rough size category, never the figure itself.
PostHog does not track you by a persistent identifier while you browse signed out; we only tie activity to your account once you are signed in, using your account id rather than your username or email.
5. AI Processing (Anthropic)
The AI assistant is powered by Anthropic's Claude API. When you send a message, your prompt and the trade or portfolio context attached to it leave our servers and are sent to Anthropic in order to generate a response. Please do not enter sensitive personal information into the chat.
Anthropic's handling of that data is governed by their own policy: anthropic.com/legal/privacy.
5a. Email Delivery (Brevo)
When we send you an email — a password-reset link, an email-verification message, or (only if you opted in) the digest — the message is delivered through Brevo (the trading name of Sendinblue SA), an email service provider acting as our sub-processor. To deliver the mail, Brevo processes the recipient email address and the contents of that message on our behalf; it is not permitted to use your address for its own purposes. If you never gave us an email address, nothing about you is sent to Brevo.
Brevo's handling of that data is governed by their own policy: brevo.com/legal/privacypolicy.
6. Data Retention
Your account data is retained as long as your account is active. If you provided an email address, it is kept for as long as your account exists and is removed when the account is deleted. AI chat logs — your questions, the attached trade context, and the assistant's replies — are likewise retained alongside your account and deleted when your account is deleted. You can delete your account yourself at any time from Settings → Delete account, or request deletion by contacting us, after which your data will be removed within 30 days.
7. Security
Passwords are hashed and never stored in plain text. Authentication tokens are stored in HTTP-only cookies, inaccessible to client-side scripts. Despite these measures, no system is 100% secure and we cannot guarantee absolute security.
8. Legal Basis and Your Rights
CoinSparring is operated from Israel, and the Israeli Privacy Protection Law, 5741-1981 applies to our handling of your data. If you are located in the EU or EEA, the General Data Protection Regulation (GDPR) also applies.
Subject to your jurisdiction, you may have the right to:
- Access the personal data we hold about you — including any email address on file.
- Have inaccurate data corrected (rectification).
- Have your data erased.
- Receive your data in a portable format.
- Object to processing of your data.
If you are a California resident, the CCPA and CPRA give you comparable rights — to know what personal information we hold, to have it deleted, to correct it, and to opt out of its sale or sharing. As stated above, we do not sell or share your personal information, so there is nothing to opt out of.
You can delete your account and its associated data — including any email address on file and your AI chat logs — yourself at any time from Settings → Delete account. To exercise any of the other rights above, or to request erasure another way, contact us through the platform or at the address in section 1a. We will respond and complete deletion within 30 days.
9. Changes to This Policy
We may update this policy from time to time. Continued use of CoinSparring after changes are posted constitutes your acceptance of the revised policy.