Privacy notice

Applies to: stockarena.eu, the StockArena app for web, Android and iOS, and the StockArena beta programme

1. StockArena as a private project

StockArena is a non-commercial leisure and hobby project that I develop and operate as a private individual.

Use is currently offered free of charge. StockArena is not intended to make a profit and in particular contains no personalised advertising, no paid storage packs and no mandatory newsletter.

The GDPR provides an exemption for purely personal or household activities of natural persons. Whether and to what extent this household exemption applies to individual processing in connection with StockArena depends on the specific processing.

In particular for an app that is also made available to other people and processes personal data of several users, it cannot be assumed across the board that every processing falls under that exemption.

I therefore do not claim that StockArena is generally exempt from the GDPR.

Regardless of the legal classification, I voluntarily follow the main GDPR principles when developing and operating StockArena and try to handle personal data with a high level of protection.

This includes in particular:

• data minimisation
• purpose limitation
• storage periods as short as possible
• transparent information
• appropriate technical and organisational measures
• simple deletion options
• no marketing of personal data
• no personalised advertising
• no covert user analytics

Where the GDPR or other data-protection rules apply to a specific processing, the corresponding legal requirements are observed.

This notice is meant to show transparently which data StockArena actually processes and how they are handled.

2. Controller and contact

Where I decide purposes and means of a processing and data-protection law applies, I am the controller:

Alexander Di Bernardo
Oberdorfer Straße 11a/4
9554 St. Urban
Austria

Email for privacy requests:
team@stockarena.eu

Further contact:
alexander@di-bernardo.eu

Website:
https://stockarena.eu/

Legal notice:
https://stockarena.eu/impressum

A privacy request can usually be sent to team@stockarena.eu.

For requests about an existing account, please state the email address used to register the StockArena account so the request can be matched.

3. Which data does StockArena process?

StockArena processes only data that are required for the respective functions or that you provide voluntarily.

Account

Depending on use, this may include email address, first and last name, optional nickname, language/locale, country, account status and technical authentication information.

The password is processed by the authentication service. StockArena does not store the password in clear text.

Profile

Optional extra information may be stored. A stored signature may be kept in cloud storage for scoresheets. A profile picture is currently used only locally on the device, where that function is implemented.

Beta programme

An application may include desired platform, rough device model, store email, optional club, optional motivation, beta status, confirmed terms/privacy version and the time of confirmation. The store email may differ from the login email.

Training

Saved sessions may include date, format, attempts and results, notes, favourite status, and optional place, coordinates, weather and temperature. Location is processed only if you search, pick a map point or use a location function. Training works without a place.

Encounters and scoresheets

Depending on the function: teams, end/game information, points and results, status, venue, pairing information and signatures.

Groups

Membership, posts, comments, events, polls and images.

Feedback

Type, text, app version and an optional screenshot you add.

Technical data

For operation and security this may include server logs, authentication events, technical errors, IP address where systems log it, device and browser information, abuse-protection information and a Turnstile token on protected forms.

Passwords or secret access tokens must not be written to application logs.

4. What are the data used for?

Personal data are processed in particular to provide registration and login, account administration, the beta programme, training, scoresheets and encounters, pairing, groups, events and polls, group images, feedback, technical error analysis, abuse protection, moderation, necessary system mail, password reset and information about beta access or status.

Personal data are not used to build advertising profiles. StockArena does not sell or rent personal data.

5. Legal bases where the GDPR applies

Where the GDPR applies, processing is based in particular on:

Providing StockArena

Processing needed to create an account and provide the functions you request is generally based on Art. 6(1)(b) GDPR. This may include pre-contractual steps or providing a free-of-charge use relationship.

Voluntary functions

If you actively enable optional data or functions, processing is either to provide that requested function or — where expressly provided — based on consent under Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

Security and abuse protection

Technical logs, rate limits, abuse protection, moderation and similar measures may be based on Art. 6(1)(f) GDPR. The legitimate interest is in particular to keep StockArena working, detect attacks and manipulation, prevent abusive sign-ups, analyse technical errors and protect other users and their data.

Beta and store access

A store email needed for Google Play or Apple is used only to set up or manage the beta or test access you requested.

6. External services and recipients

StockArena uses external technical providers for individual functions. These currently may include:

Provider / service	Purpose
Supabase	Authentication, database, file storage, functions and realtime
IONOS SE	Hosting of the website and related services
Google Maps	Map display or choosing a training place
Google Weather	Weather for a chosen training place
Open-Meteo	Place or weather functions
Nominatim / OpenStreetMap	Place search and map data
Cloudflare Turnstile	Protection against automated sign-ups and abuse
Email service	Technical and necessary system emails
GitLab	possible manual transfer of selected feedback
Google Play	Managing approved Android testers
Apple	Managing approved iOS testers

External services receive only the information required for the respective function. Personal data are not shared with advertising networks.

Where a provider processes personal data on instruction and the GDPR applies, the data-protection agreements provided for that purpose are used insofar as they are required and offered by the service.

7. Transfers outside the EEA

Individual providers may process data outside Austria or outside the EEA. Where such a transfer falls under the GDPR, it should take place only on a GDPR basis, for example an adequacy decision, appropriate safeguards, standard contractual clauses or another statutory transfer ground. The concrete ground can depend on the provider and its infrastructure.

8. Retention

StockArena aims not to keep data longer than needed for the respective purpose.

For self-created training and encounters currently:

• up to 50 regular items per area
• plus up to 5 favourites
• non-favourites may be deleted after one year
• if the limit is exceeded, the oldest regular items may be removed
• favourites are excluded from that age clean-up
• merely spectating a paired encounter does not count toward your volume

Further currently planned periods: group pinboard, closed polls and past group events up to 90 days; private moderation archive after operator deletion up to 90 days; technical error logs up to 90 days; privileged audit logs up to 365 days.

Beta applications may remain linked to the account while the process runs or the status is needed for administration.

Database backups may still contain deleted data for the backup period. Such data are not put back into the live set except as part of a necessary restore.

9. Signatures

Signatures on scoresheets may be stored as images. They are used only for the intended StockArena function and not for biometric identification or automated identity checks.

Where a public signature view is provided, it can be opened without login if the address or access token is known. Such links should be shared only on purpose.

10. Images and group content

Images uploaded in groups are generally intended for members of that group. Deleting a post through the app also removes the related image in the regular deletion process.

Upload only images you are allowed to use and that do not infringe other people’s rights.

11. Feedback and screenshots

A feedback screenshot sent through StockArena is not public at first. An administrator may review feedback and, if needed, copy it manually into an internal issue or development system. Feedback is not published automatically. If individual content is published to document a bug, personal or unnecessary content should first be removed or anonymised.

12. Public links

Some functions are expressly meant to be shared via a link. Anyone who has the link including the required token can access the information released there. Treat such links like an access link and share them only with the intended people.

13. Local storage on the device

Some data may be stored only or also locally, for example language, theme, export format, caches and technical app settings. They can partly be removed by deleting the app, app data or via operating-system settings.

14. Cookies, tracking and analytics

StockArena currently uses no personalised ad trackers and no marketing analytics to build user profiles. The website may use technically necessary local storage, for example for language. Cloudflare Turnstile may protect registration or form functions.

If optional analytics, marketing or other consent-required technologies are added later, this notice will be updated and consent obtained where required.

15. Security

StockArena is developed to protect personal data reasonably against unauthorised access, unintended change, loss, misuse and unauthorised publication. Technical and organisational measures are used depending on the system. Concrete mechanisms and internal configuration are not fully documented in public. No technical system can guarantee absolute protection against incidents.

16. No automated decisions

StockArena currently does not use solely automated decisions with legal or similarly significant effect under Art. 22 GDPR. In particular there is no profiling for advertising, credit or insurance purposes.

17. Use by minors

StockArena is currently not directed at persons under 16. Regular registration therefore requires a minimum age of 16. StockArena does not try to collect personal data of children below that age on purpose. If it becomes known that an account is used contrary to this rule by a younger person, the account may be reviewed or deleted.

18. Deleting data yourself

Where technically possible, StockArena provides deletion functions in the app. Under Account you can in particular:

Delete your own app data

This can remove data you created yourself, such as encounters, games, signatures and training sessions, without removing the account.

Delete the account completely

This deletes the StockArena account and the own data assigned to it in the live system, unless technical or legal reasons require temporary further storage. After account deletion, login is no longer possible.

Leaving a beta programme or losing beta access does not automatically delete the account.

19. Rights of data subjects

Where the GDPR applies to the processing, data subjects may in particular have rights of access, rectification, erasure, restriction, objection, data portability where the legal conditions are met, and withdrawal of consent with effect for the future.

Requests can be sent to team@stockarena.eu.

An appropriate identity or account-matching check may be required to avoid disclosing or deleting data for an unauthorised person. Where statutory deadlines apply, requests are answered within those deadlines.

20. Right to lodge a complaint

Where the GDPR applies, you may lodge a complaint with a supervisory authority.

In Austria this is:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria

Email: dsb@dsb.gv.at

You can still contact StockArena at any time at team@stockarena.eu.

21. Provision of data

Some data are required for StockArena to work. For example an account needs an email address. Optional fields need not be filled in. If you do not want to provide required data, you may be unable to use the dependent function.

22. Changes to this notice

StockArena is under ongoing development. New functions may mean additional data, new external services, changed retention or adapted processing. This notice is therefore updated when there are material changes.

The current version is available at https://stockarena.eu/datenschutz. The version date at the beginning shows the information status.

23. StockArena principle

StockArena is a private, non-commercial project. Data protection should still be taken seriously even where a legal duty may not apply.

My aim is to process only the personal data actually needed for the offered functions, to explain that handling transparently and to give users as much control over their data as possible.