Privacy policy

This explains what Upside Arena collects about you, why, who else sees it, how long we keep it, and what you can tell us to do about it. We collect as little as the game needs. We do not sell your data and we do not run ads.

1. Who is responsible for your data

Upthink Solutions OÜ, a private limited company in Estonia (registry code 16683946), registered office Aiandi tn 8/2-28, Mustamäe linnaosa, 12915 Tallinn, Harju maakond, VAT ID EE102590654, is the controller of your data. That means we decide what is collected and why, and we are the ones you can hold to this policy. It is the same company behind Upside Lab, though the two products keep separate accounts and separate databases.

For anything about your data, email privacy@upthink.ee.

We are based in the European Union, so European data protection law applies to everything we do with your data, wherever you live. If you live in California, section 11 sets out the extra rights you have.

2. What we collect

Almost all of it comes from you, or from your use of the game. We do not buy data about you from anyone.

• Your account. Your email address. If you sign in with Google, also the name and profile picture Google gives us. We never see your Google password.
• Your profile. The name and player tag you choose, and the date you confirmed you are 16 or older.
• Your game history. Your trades, your scores, your leagues, your streak and your standing.
• What you agreed to. Which version of these documents you accepted, and when.
• Technical records. When you use Arena our hosting provider records your IP address, your browser and the pages you asked for. This happens for every website and we use it to keep the service working and to spot abuse.
• How the app is used, only if you allow it. Which screens are opened, which buttons are pressed, how quickly pages load. Never what you searched for, what you bought, what your league is called or how much you have. We ask you first, and Arena works exactly the same if you say no.
• Which days you opened Arena. The date, and nothing about what you did. We use it to count how many people come back, which is the one number that tells us whether the game is any good.
• What you have bought, if you buy anything. Which subscription or coin bundle, when, and whether it is still running. We never see or store your card number: our payment provider handles the card and tells us only that a payment succeeded.
• Weeks you choose to share. When you press share on a finished week, we save a copy of that result: your name, the title you were wearing, how the week went, where you finished in a league, your streak, and the daily figures behind it. That copy is what the link shows. It is frozen, so it never reveals anything that happens afterwards, and you can take it down whenever you like.
• What your portfolio was worth each day. Recorded once per trading day for everyone playing, so a shared week can show its shape rather than a single number.
• What breaks. When a screen fails to draw, we record the error message it produced and which page it was on, so we find out about a broken screen without waiting for somebody to write in. That record holds nothing about who it happened to: no name, no address, no account, and the address of the page is stored without anything after the question mark, so nothing you were looking at is in it. Repeats of the same failure are counted rather than kept separately.
• Notifications, only if you turn them on. If you allow notifications in your browser, we store the address your browser’s push service gives us, the keys needed to encrypt a message to it, a description of the browser, and the time zone your device reports so nothing arrives in the middle of your night. We also keep a record of what we sent you and when, which is what stops the same thing being sent twice and keeps us to our own daily limit.

We do not collect anything about your health, your beliefs, your politics, your ethnicity or anything else the law treats as sensitive. Please do not put that kind of information into a name, a league name or a message.

3. Why we use it, and what allows us to

The law says we need a reason for each thing we do with your data. Ours are:

• To give you an account and run the game. We need this to do what you asked us to do, which is let you play. Without it there is no account and no game.
• To show you to the other players in your league. Same reason. A league you joined cannot work without showing who is in it.
• To keep the game fair and to stop abuse. We have a legitimate interest in Arena not being ruined by bots, cheating or multiple accounts. We have weighed that against your privacy and kept it to the minimum that works.
• To keep the service secure and working. Also a legitimate interest, and one you benefit from directly.
• To answer you when you contact us. A legitimate interest in being able to help you.
• To measure how the app is used. Only with your consent, which you can take back at any time.
• To count how many people play and come back. We have a legitimate interest in knowing whether Arena works, and we do it by counting our own records rather than by sending anything about you to anyone. Nothing produced this way names a person, describes a person, or could be traced back to one: it is totals, such as how many accounts exist and how many people opened the app yesterday.
• To take a payment and give you what you paid for. We need this to do what you asked us to do. We also have to keep records of what was sold, because tax and accounting law requires it, which is a legal obligation rather than a choice.
• To let you share a week. We do this to do what you asked us to do, which is make that one week postable. Nothing is shared until you press the button, and taking it down ends it.
• To send you notifications. Only with your consent, which you can take back at any time from your profile page or in your browser’s own settings. Every email we send carries a link that turns them off. We only send things that describe something that has actually happened in your game, never marketing.
• To record that you agreed to our terms, and to meet other legal duties. We have to be able to show this.

If you object to anything we do on the basis of a legitimate interest, tell us and we will stop unless we have a strong reason not to.

4. Cookies and similar technology

We use two kinds, and only two:

• Sign-in cookies, always on. These keep you signed in and keep your session secure. Arena cannot work without them, so we do not ask permission for these.
• Measurement, only if you allow it. Page views and load times. We ask before any of it runs, and nothing is recorded until you say yes.

You can change your mind whenever you like from the banner or from your profile page. We do not use advertising cookies and we do not let anyone track you across other websites.

5. Who else sees your data

• Other players. Your name, player tag, picture and scores are visible to people in a league you have joined. Your email address is never shown to another player.
• Anyone you send a share link to. A shared week is a public web address: whoever holds the link can open it, without an account, and can pass it on. It shows that one week and offers no way to reach anything else about you. We ask search engines not to list these pages, though we cannot force them to obey. Taking a card down makes its link stop working.
• Companies that run parts of the service for us. They may only use your data to do that work, under a written contract, and never for their own purposes. Today they are:
  • Supabase. Our database and sign-in provider. Everything you enter lives there, and it sends your sign-in links. Stored in European Union.
  • Vercel. Hosting. Keeps short-lived server logs, and measures page views and load times if you allow it. Stored in European Union and the United States.
  • Stripe. Takes payments if you buy anything. It receives your email address and your card details, which we never see, and tells us only that a payment succeeded. It handles nothing for people who buy nothing. Stored in European Union and the United States.
  • Resend. Sends the notification emails you have asked for. It receives your email address and the text of the message, and nothing about what you hold or what you have traded. Stored in European Union.
  • Google, Apple, Mozilla and Microsoft. The push services built into browsers. If you turn on notifications, whichever one your browser uses passes the message to your device. It is encrypted on the way, so the service cannot read it. Stored in European Union and the United States.
  • Yahoo Finance. Share prices. We send it a ticker symbol and nothing else: no account, no name, and nothing about what you hold. Stored in United States.
  We keep this list current. Anyone we add later will be named here first.
• Anyone the law requires. If we are legally obliged to hand something over, or need to in order to establish or defend a legal claim. We will tell you unless we are not allowed to.
• A buyer, if our business is sold. They would have to keep to this policy, and we would tell you first.

We do not sell your data, and we never have.

6. Sending data outside Europe

Some of the companies above may store or handle data outside the European Economic Area, including in the United States. When that happens we rely on the protections European law provides for this, which are the European Commission’s standard contractual clauses, or a decision by the Commission that the country protects data adequately. Ask us and we will tell you which applies and send you a copy.

7. How long we keep it

• Your account, profile and game history. For as long as your account is open.
• When you close your account. All of it is erased straight away, including your profile, your game history and the record of what you agreed to. This cannot be undone.
• Technical records. Kept briefly by our hosting provider, normally around thirty days, then deleted automatically.
• Emails you send us. Kept while we deal with your question and for a reasonable time after, in case you come back to us.

8. Your rights

You can ask us to:

• Show you what we hold. You can download all of it yourself, right now, from your profile page.
• Correct something that is wrong. Most of it you can edit yourself on your profile page.
• Delete your account and its data. You can do this yourself from your profile page. It happens immediately.
• Give you your data in a portable form, so you can take it elsewhere. The download from your profile page is exactly this.
• Stop or limit something we are doing with it, including anything based on a legitimate interest.
• Take back your consent to measurement, at any time. That does not undo anything that happened lawfully before you changed your mind.

Email privacy@upthink.ee for anything you cannot do yourself. We will reply within one month. If your request is complicated we may need longer, and we will tell you why. It is free, we will never make you give a reason, and we will never treat you worse for asking.

We may need to check it is really you before we act, so that someone else cannot use these rights against you.

9. Complaining

If you think we have handled your data badly, please tell us first and give us a chance to fix it. You can also complain to a data protection authority at any time, without asking us.

Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee, info@aki.ee. If you live elsewhere in Europe you can go to the authority in your own country instead.

10. Decisions made automatically

The game scores your portfolio and ranks your league automatically, which is the whole point of it. None of that has any legal effect on you or affects you in any comparable way, it is a game. We do not profile you for advertising, and no automated decision we make can deny you a service, a job or credit.

11. If you live in California

California law gives you some extra rights and requires us to say some things plainly.

• The categories of personal information we collect are: identifiers such as your email address and an account number, your account name and picture, internet activity such as pages viewed, and rough location inferred from your IP address. Section 2 lists exactly what is in each.
• We collect it for the purposes in section 3 and we keep it for the periods in section 7.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have not in the past twelve months. We do not sell the personal information of anyone under sixteen, because nobody under sixteen may hold an account.
• You can ask us to tell you what we have collected, to delete it, or to correct it. Sections 7 and 8 explain how, and the buttons on your profile page do all three.
• You may use an authorised agent to make a request. We will ask for proof that you gave them permission.
• We will never deny you service, charge you a different price or give you a worse experience for using any of these rights.

12. Children

Under 13 is never allowed. Arena is for people 16 and older, the same rule Upside Lab uses. We use 16 because some countries in Europe set that as the age you can agree to this kind of service by yourself.

We do not knowingly collect anything from anyone younger. If you believe a child has given us their information, email us and we will delete it and close the account.

13. How we protect your data

Connections to Arena are encrypted. Your data is separated at the database level so one account cannot reach another’s, access to production systems is limited to people who need it, and we do not store passwords at all because we sign you in with a link or with Google.

No service can promise perfect security. If something goes wrong in a way that puts you at real risk, we will tell you and the relevant authority as quickly as the law requires.

14. Where Arena is offered

Arena is currently offered to people in the United States and Canada. We apply this policy to everyone who uses it, wherever they are.

15. Changes to this policy

Every version is dated. If we change something that matters to you, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask you again.

16. How to reach us

Upthink Solutions OÜ, Aiandi tn 8/2-28, Mustamäe linnaosa, 12915 Tallinn, Harju maakond, Estonia.

Product help: app.support@upthink.ee. Questions, data requests or concerns: privacy@upthink.ee. See also our terms.