Privacy Policy

Summary

This table is the short version. Sections 1–16 below have the detail.

1. Who we are

• Controller: Shark Belly Industries LLC, a New Mexico limited liability company (the “Company”, “we”, “us”).
• Postal address: 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, USA.
• Email: hello@email.dasreplay.com.
• Product: DAS Replay (the “Service”, as defined in our Terms of Service). It runs mainly on:
  • dasreplay.com: our marketing site;
  • dasreplay.com/support: our help center;
  • app.dasreplay.com: the app, including public share pages.
• What DAS Replay is: a trading simulator that replays historical market data. It places no real orders and moves no real money.
• Representatives in Europe: we have not yet appointed a representative in the EU or UK. Contact us directly at the address above.
• Data protection officer: we have not appointed one. We are not required to.
• Other terms: This policy works alongside our Terms of Service, our Cookie Notice and, if you hold a Founders Lifetime seat, the Founders Lifetime Terms.

2. Data we collect

2.1 Data you give us

• Signup (/access form). We collect:
  • first name, last name and email;
  • your trading experience and the asset class you trade;
  • any setups you describe, and an optional note.
• Email pop-up. A pop-up on our marketing site’s content pages asks for your first name, email and, optionally, your asset class.
  • Submitting it creates a DAS Replay account. The pop-up says so on its face (“Your account is created on submit”). It posts to the same signup endpoint as the /access form, so we create your account, store your first name and asset class on it, and email you an invitation to confirm your email and set a password.
  • It also starts account and marketing email. You get the invitation and the other account emails you can’t opt out of, plus the welcome note, our onboarding emails and our newsletters. Every marketing message carries an unsubscribe link (see Section 5). The pop-up does not ask you to accept the Terms; you accept them when you finish signing up and at checkout.
  • Beta only. The pop-up runs during the beta. We plan to retire it when paid plans begin after 11:59 p.m. ET on October 5, 2026; after that, accounts are created through /access or a shared link.
• Signup through a shared link. If you sign up from someone’s share page, we collect your email and a one-time code we send you, and we create your account.
• Account data. We collect:
  • your email and password (the password is stored hashed by our authentication provider);
  • your display name;
  • your time zone, which your browser detects automatically.
• Simulator content. This covers:
  • simulated trades, orders and fills;
  • simulated P&L and journal notes;
  • chart drawings (which can include text you type) and chart templates;
  • layouts, hotkeys and preferences;
  • starting cash, leverage and balance-reset history;
  • challenges you create or join.
• Imported trade history. This covers trade-history files exported from your real brokerage platform (for example, DAS Trader reports).
  • We store the parsed orders and fills, the file name and a fingerprint (hash) of the file. We don’t store the raw file.
  • This feature is currently limited to our administrators. Before it opens to users, we’ll update this policy, including the legal basis we rely on.
• Symbols you request. If you type a symbol we don’t carry yet, we record what you typed.
• Billing. We keep:
  • your plan, subscription status and trial dates;
  • invoice amounts and refund records;
  • your Stripe customer ID.
  • Stripe collects your card details directly. We never see or store your full card number. See Section 7.
  • Paid plans and first charges begin at 12:00 a.m. ET the day after October 5, 2026.
• Messages to us. If you reply to our emails or write to us, we keep the message and your email address. Replies go to our Zoho mailbox.
• Help-center feedback. If you use “Was this helpful?”, your vote is saved in your browser and sent to Google Analytics. We don’t keep our own copy, and there is no free-text comment box.
• Help-center searches. What you type into the help-center search box appears in the page address. We redact the search term before the address is sent to Google Analytics (see Section 2.2).
• Public bug reports. Our support tracker is a public GitHub repository.
  • Anything you post there, including your GitHub username, is visible to everyone and is governed by GitHub’s privacy statement.
  • Don’t include personal or account details.

2.2 Data we collect automatically

• Usage telemetry (first-party). When you use the app, we record:
  • replay session start and end events (ticker, date, asset class);
  • refused session starts;
  • how many seconds you were actively engaged each day and how long replays ran;
  • request and data-transfer counts;
  • the server that handled your session.
• Performance and reliability data. We collect page-load and responsiveness measurements (web vitals) and connection-failure codes. These may be linked to your account.
• Sign-in activity. Our authentication provider records:
  • sign-in and session-refresh times;
  • security logs, which typically include IP address and browser type.
• Error reports (Sentry). When something breaks, we send an error report to Sentry. It contains:
  • technical details (browser, operating system, page URL, stack trace);
  • your internal user ID, but not your name or email.
  • We do not use session recording or replay.
• Analytics (Google Analytics 4). GA4 runs on all three surfaces, including public share pages. It records:
  • the pages you view, as their web address;
  • interactions such as sign-up, sign-in, starting a replay, seeing or submitting the email pop-up, clicking a call-to-action button and help-center votes;
  • device and browser type;
  • approximate location, which Google derives from your IP address.
  • It uses cookies, and it links your visit across dasreplay.com and app.dasreplay.com.
  • Page addresses can carry codes. Some links carry a code in the address, such as sign-in and password-reset links, share links, unsubscribe links and help-center searches. We redact those codes and search terms before the address is sent to Google Analytics.
  • We do not send your name, email or user ID to Google Analytics as analytics data. See the Cookie Notice.
• Cloudflare. All traffic passes through Cloudflare, which processes your IP address, request data and security signals.
  • Bot check (Turnstile). Cloudflare’s bot check loads on our marketing-site pages (it’s part of the email pop-up), on the /access form and on share-page signup. It collects device and browser signals to tell people from bots.
  • On the app, Cloudflare may also add a small performance (“RUM”) script.
• Google Fonts. The marketing site, the help center and the app (including public share pages) load fonts from Google’s servers. As a result, Google receives your IP address and browser details.
• Server logs. Our API host (Fly.io) keeps application logs, which include your user ID and may include your IP address.
• Ad measurement (Meta Pixel and Conversions API). We run ads on Facebook and Instagram, and we tell Meta when those ads lead somewhere. Section 6 explains why and how to opt out.
  • In your browser (Meta Pixel). A Meta script on dasreplay.com and app.dasreplay.com records the pages you view and a few steps: viewing pricing or our ad landing page, signing up and starting checkout. It sets the _fbp and _fbc cookies (see the Cookie Notice). It does not load if your browser sends Global Privacy Control or you chose “Do not share”.
  • From our servers (Conversions API). When you sign up, start checkout, start a trial or pay, our server tells Meta. The report carries the step’s name and time, a one-time event code, the page address, your email and user ID as SHA-256 hashes, and the _fbc/_fbp click codes. Trial and payment reports also carry the amount in US dollars.
  • IP address and browser type go to Meta only with reports made while you’re on the site (signing up, starting checkout), taken straight from that request. We don’t store them for this.
  • What we keep. We store the _fbc/_fbp click codes against your account, so later reports (trial start, payments) can be matched to the ad you clicked.
• Email engagement. Our emails contain a tracking pixel. We record when an email is delivered, opened, bounced or marked as spam, and we store that against your email address.

2.3 Data from third parties

• Stripe tells us whether a payment succeeded, failed or was refunded, and the status of your subscription.
• Cloudflare Turnstile tells us whether a signup looks like a bot. To check, we send it your IP address. We don’t store the IP address.
• Resend tells us about email delivery, opens, bounces and complaints.
• Referrals. If you sign up through someone’s shared replay link, we record that you came from that link.
• Instagram (OpenReply). If you comment on or message our Instagram account, our auto-reply tool gets your Instagram username, your message and related metadata from Meta. It uses them to send you a direct message.

2.4 What we don’t collect

• We don’t collect government IDs, dates of birth or precise location.
• We don’t collect health, biometric or similar data.
• Your account password is the only data we hold that some laws (for example California’s) class as “sensitive”. We use it only to sign you in.
• We don’t use ad pixels other than Meta’s (none from X, TikTok, LinkedIn or Google Ads).
• We don’t give your content to AI or large-language-model providers.

2.5 Data map

GitHub, not us, controls what you post on our public bug tracker.

3. How we use your data

• Run the Service. Create your account, run replays, save your work, and restore your session if you reconnect.
• Billing. Start trials, charge subscriptions, send billing emails, apply plan limits, and check whether you qualify for founder or early-signup pricing (we match your signup email to your account email).
• Security and abuse prevention. Bot checks, rate limits, audit logs of administrator actions.
• Reliability. Find and fix errors; watch capacity and performance.
• Improve the product. See which features and instruments people use and ask for.
• Measure our ads. Tell Meta which ad clicks led to a sign-up, checkout, trial or payment (see Section 6).
• Communicate with you. Send transactional and marketing email (see Section 5).
• Profiling for email. We use your data in these ways to decide when and what to email you:
  • Send-time profiling. We look at the hours when you usually sign in and use the app, plus your time zone, to work out your active hours. We then send newsletters and onboarding emails during that window, for example in your local morning.
  • Asset-class grouping. We sort you into a group (for example, equities, futures or forex) to choose which onboarding emails you get.
    • If you told us your asset class, we use that.
    • For older signups, we inferred it automatically from the text you wrote (for example, “I trade ES futures”).
  • These choices only affect the timing and topic of emails.
• No significant automated decisions. We make no decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Art. 22).
• Legal. Comply with law, enforce our Terms, and defend legal claims.
• Administrator access. A small number of our staff can view account data for support and operations. That includes read-only “view as user” access. It lasts 15 minutes, and each use is logged (staff can add a reason).

4. Public sharing (share cards, spectate, challenges)

• You choose to share. Nothing you do in DAS Replay is public unless you create a share link.
• What a share card shows to anyone who has the link (no login needed):
  • Your first name (the first word of your display name). Today it is added automatically to every card you share. If you don’t want it shown, change your display name before sharing.
  • Ticker(s), replay date and time, number of fills, win rate and duration.
  • Simulated net P&L and return %. Together, these can reveal your simulated account size.
  • Challenge cards also show starting cash and leverage.
  • Versus cards also show your opponent’s first name and stats.
• Spectate. Every share link also lets anyone watch a replay of the session, including every simulated fill (time, side, quantity, price).
• Link previews. Share links are unguessable. But anyone you send one to can forward it. And social networks and messaging apps may fetch and cache a preview image when the link is posted.
• Signup invitations. Someone who signs up through your link is recorded as your referral.
• Revoking a share. You can revoke a share at any time.
  • After you revoke it, the link stops working, and we delete the stored image and the spectate data.
  • We keep a private record of the card (including the name and results it showed) until your account is deleted. It is not visible to anyone else.
  • Copies already cached by browsers, content-delivery networks or third-party apps may persist briefly. Our cache is about 5 minutes; third parties set their own cache times.
  • We cannot recall screenshots or copies others have made.
• What we don’t have. There are no public profiles, usernames, avatars or leaderboards.
• Legend. Shared results are simulated and do not represent real trading.

5. Email

• Sender. Emails come from christian@email.dasreplay.com and are sent through Resend.
• Who gets marketing email. Everyone who creates an account (through /access, the email pop-up or a share link) gets marketing email unless they unsubscribe. We don’t ask for separate opt-in consent.
• Open tracking. Our emails contain a tracking pixel. When your email app loads images, we learn that you opened the email and when. We store this against your email address.
  • You can prevent it by turning off automatic image loading in your email app.
• Links. Links in our emails carry campaign tags (utm_campaign), so Google Analytics can tell which email brought you to the site.
• Unsubscribing takes effect immediately, and at the latest within the 10 business days required by law.
  • Complaints and hard bounces also stop marketing email automatically.
  • We keep your address on a suppression list so we don’t email you again.
• Postal address. Every marketing email includes our postal address.

6. Selling, sharing and ad measurement

• No selling. We do not sell personal data. We have not sold it in the past 12 months.
• Sharing with Meta for ads. We advertise on Facebook and Instagram and measure those ads with the Meta Pixel and Meta’s Conversions API (what is sent is listed in Section 2.2). California and some other US states may count this as “sharing” personal data for cross-context behavioral advertising, or as “targeted advertising”. We treat it that way, and you can opt out.
  • Why. To learn which ads bring people who sign up, start a trial and pay, and to stop paying for the ones that don’t. Meta also uses these reports, under its own terms, to decide who sees our ads and to improve how it delivers them.
  • Only hashed identifiers. Your email and user ID leave our systems only as SHA-256 hashes. We never send Meta your name, your simulator content or your card details.
  • No customer lists. We don’t upload customer lists to Meta or build retargeting audiences from your data.
  • US only. We run these ads in the United States only.
  • Meta handles what it receives under the Meta Privacy Policy and its Business Tools Terms.
• How to opt out.
  • Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out: the Meta Pixel doesn’t load, and our server doesn’t report your sign-up or checkout to Meta.
  • Your privacy choices. Choose “Do not share” there. It sets a cookie on dasreplay.com that keeps the Meta Pixel off our sites in that browser. If you have an account, it applies to your account the next time you open the app; from then on our server stops reporting your trial and payments to Meta too.
  • Email us at hello@email.dasreplay.com with the subject “Privacy request”, and we’ll opt your account out by hand.
  • Not retroactive. Opting out stops future reports. It doesn’t recall reports Meta already received.
  • Opting out doesn’t change the product, your price or your plan.
• Google Analytics is not used for advertising. Google signals and ad personalization are switched off, and we don’t link it to Google’s advertising products.
• No selling or sharing of minors’ data. We do not knowingly sell or share the data of anyone under 16.

7. Who we share data with

We share data only with the service providers below. Most handle it on our instructions (as processors). Where a provider uses data for its own purposes, we say so. We may also disclose data:

• if the law requires it;
• to protect rights and safety;
• to a buyer or successor if we sell or reorganize the business (we’d notify you first).

• No user data goes to our other providers. We use market-data vendors (for example Alpaca, Finnhub, Databento, SEC EDGAR), an uptime monitor, and Google Gemini, which reads public SEC filings only. None of them receive your personal data.
• Contracts. We have data-processing terms with each provider where they offer them.

8. International transfers

• Where your data is processed. We are based in the United States, and our servers and most of our providers are in the US. If you use the Service from outside the US, your data is transferred to and processed in the US, where privacy laws may differ from yours.
• EEA, UK and Swiss transfers. For data from these regions, we rely on one of two safeguards:
  • the provider’s certification under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. DPF); or
  • the European Commission’s Standard Contractual Clauses (and the UK Addendum) included in the provider’s data-processing terms.
• Our own status. The Company itself is not DPF-certified.
• Getting a copy. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

Account deletion:

• There’s no self-serve delete button yet. Email us and we’ll delete your account manually.
• Deleting your account removes your profile, simulator content, share cards, challenges, usage telemetry and performance data linked to your account.
• We keep:
  • the suppression list;
  • email events and your signup record (see the table above);
  • administrator-action logs;
  • billing records and agreement records the law requires us to keep;
  • copies in backups and provider logs until they roll off.

10. Security

• Encryption. Data is encrypted in transit (HTTPS; the app also enforces HSTS). Our hosting providers encrypt it at rest.
• Access controls. Row-level security means each user can reach only their own records. Telemetry and email tables are server-only.
• Keys. Server keys are never sent to your browser.
• Payment data. Card data is handled only by Stripe’s hosted checkout.
• Abuse protection. Bot protection on signup, and rate limits.
• Administrator safeguards. Administrator actions are logged. “View as user” is read-only, time-limited and audited.
• Your session token. Your sign-in session token is stored in your browser’s local storage. Sign out on shared computers, and note that some app settings and chart drawings stay in the browser after sign-out (see the Cookie Notice).
• Limits. No system is perfectly secure.
• Breaches. If a breach affects your personal data, we’ll notify you and regulators as the law requires.

11. Your rights

11.1 Everyone

Wherever you live, you can ask us to:

• access or get a copy of your data;
• correct it;
• delete it;
• export it in a portable format;
• stop marketing email (you can also use any unsubscribe link).

We don’t charge for requests and we won’t treat you differently for making one.

11.2 EEA, UK and Switzerland

• Your rights. Under GDPR / UK GDPR you have the right to:
  • access your data (Art. 15);
  • rectification (Art. 16);
  • erasure (Art. 17);
  • restriction of processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on legitimate interests, including profiling (Art. 21). This includes send-time profiling: object and we’ll stop;
  • object to direct marketing at any time (Art. 21(2)–(3));
  • not be subject to solely automated decisions with legal or similar effects (Art. 22). We don’t make any.
• Withdrawing consent. Where we rely on consent, you can withdraw it at any time. That won’t affect processing already done.
• Complaints. You can complain to your local supervisory authority. In the UK, that’s the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to resolve it first.
• What’s required. Account data is needed to provide the Service. Without it we can’t create your account. Everything else is optional.
• Representatives. See Section 1.

11.3 United States

• California (CCPA/CPRA). We currently fall below the thresholds that make the CCPA apply to us. We still honor California residents’ requests to:
  • know what we collect;
  • access and delete their data;
  • correct it;
  • opt out of sale or sharing. We don’t sell. We do share with Meta for ad measurement; opt out on Your privacy choices or with Global Privacy Control (see Section 6).
  • Sensitive data. We collect account log-in credentials (email and password), which the CPRA treats as sensitive. We use them only to sign you in, and we don’t use any data to infer characteristics about you. So there is no additional use to limit.
  • We won’t discriminate against you for exercising these rights.
  • You may use an authorized agent. We may ask the agent for proof that you authorized them.
• California “Shine the Light” (Civ. Code §1798.83). We do not share personal information with third parties for their own direct-marketing purposes.
• Categories disclosed. In the past 12 months we collected these categories of personal information:
  • identifiers (name, email, user ID, IP address, cookie IDs, ad click codes);
  • customer records (name, email, billing status);
  • commercial information (plan and purchase history);
  • internet and electronic-network activity;
  • approximate geolocation;
  • content you create (journal notes, drawings, messages to us);
  • sensitive personal information (account log-in credentials, used only to sign you in);
  • inferences (active hours, asset-class group).
  • We disclosed them to the service providers in Section 7, for business purposes.
  • We shared identifiers (hashed email and user ID, click codes, IP address) and internet activity (sign-up, checkout, trial and payment steps) with Meta, for cross-context behavioral advertising (see Section 6).
• Nevada. We don’t sell personal information. You can still send a sale opt-out request to hello@email.dasreplay.com, our designated request address.
• Other states. Residents of other states with privacy laws may have similar rights: access, correction, deletion, portability, and opting out of targeted advertising, sale and profiling. We honor these requests whether or not the law applies to us. To opt out of targeted advertising, use Your privacy choices or Global Privacy Control.
  • If we deny a request, you can appeal by replying to our decision with “Appeal” in the subject. We’ll respond within 60 days.

11.4 Canada

• Your rights. Under PIPEDA and applicable provincial laws, you can access and correct your personal information and withdraw consent, subject to legal and contractual limits.
• Complaints. You can complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner.
• Marketing email. Canada’s anti-spam law applies to our marketing email. You can unsubscribe at any time.

12. How to exercise your rights

• How to ask. Email hello@email.dasreplay.com with the subject “Privacy request”. Say what you want (access, delete, correct, export, object) and which email your account uses.
  • There are no self-serve export or delete tools yet. Requests are handled by a person.
• Verification.
  • We’ll confirm the request comes from the email address on the account (for example, by asking you to reply from it).
  • We may ask for more information if we can’t verify you.
  • We will not ask for government ID unless we have no other way.
• Response time.
  • EEA/UK: within one month, which we can extend by two more months for complex requests.
  • US: within 45 days, which we can extend by 45 more.
  • We aim for 30 days everywhere.
  • If we extend, we’ll tell you why.
• Limits. We may keep data where the law requires it, for example billing records, or to prevent fraud. If so, we’ll tell you what we kept and why.

13. Children

• Age requirement. DAS Replay is for adults 18 and over, in every country. It is not directed at children.
• If we learn a user is under 18, we’ll close the account and delete their data.
• Parents. If you believe a child has given us data, email us.

14. Do Not Track, Global Privacy Control and cookie consent

• Do Not Track (CalOPPA disclosure). Our Service does not respond to Do Not Track browser signals. There is no agreed standard for them.
• Global Privacy Control. We honor Global Privacy Control. A GPC signal opts you out of ad measurement with Meta: the Meta Pixel doesn’t load, and our server doesn’t report your sign-up or checkout to Meta. To make the opt-out follow your account to other browsers, also choose “Do not share” on Your privacy choices.
• Third-party tracking over time and across sites. Google Analytics collects data about your activity over time on our sites, and Google may use it under its own policies. Other providers listed in Section 7 (such as Cloudflare, Google Fonts and Stripe) receive technical data such as your IP address when you use the Service. We don’t permit them to use it for cross-site advertising. Meta is the exception, as Section 6 describes.
• Cookie consent.
  • Today Google Analytics loads for all visitors without asking first.
  • Visitors in the EEA, UK and Switzerland will see a consent banner, with Google Analytics held off (Google Consent Mode “denied”) until they accept. That banner is not live yet.
  • Visitors elsewhere are not asked. You can still opt out (see the Cookie Notice).

15. Changes to this policy

• Updates. We’ll post changes here and update the “Last updated” date.
• Material changes. For material changes, we’ll email account holders and show a notice in the app 30 days before they take effect.
• Consent-based processing. Where the law requires your consent to a change, we’ll ask for it.
• Earlier versions are available on request.

16. Contact

• Shark Belly Industries LLC
• 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, USA
• hello@email.dasreplay.com
• Representatives in the EU and UK: see Section 1.

Related: Terms of Service · Founders Lifetime Terms · Cookie Notice · Risk Disclosure · Refund Policy · Notices