Ball Street Exchange/Privacy

Privacy Policy

Last updated September 22, 2026

1. Who we are

Ball Street Exchange ("BSX," "we," "us," or "our") operates a virtual-currency market simulation where users trade synthetic shares of professional athletes. This Privacy Policy describes how we collect, use, disclose, retain, and delete personal information in connection with:

  • The Ball Street Exchange mobile application (iOS and Android builds of our Expo app)
  • Our marketing website at https://ballstreet.exchange (download call-to-action and related pages)
  • Backend services that power the app (hosted authentication and database)

BSX is not a fantasy contest, sportsbook, prediction market, or real-money brokerage. Phase 1 uses virtual "BSX Dollars" only. This policy is written to satisfy Apple App Store and Google Play requirements for a publicly accessible privacy policy URL, including clear disclosure of data collected, purposes, sharing, retention/deletion, and how to contact us or request account deletion.

Privacy contact: aaron@ballstreet.exchange

2. Scope and store disclosures

Apple requires every App Store app to link a privacy policy that identifies what data is collected, how it is collected, how it is used, with whom it is shared (including third-party SDKs), retention/deletion practices, and how users can revoke consent or request deletion. Google Play requires a privacy policy that discloses how the app accesses, collects, uses, shares, and protects user and device data; an accurate Data safety declaration; and — when accounts can be created — a pathway to request account and associated data deletion (including a web-accessible request method).

App Store Connect "privacy labels" and Google Play "Data safety" answers must remain consistent with this policy. If our practices change, we will update this page and our store declarations.

3. Information we collect

Depending on how you use BSX, we may collect the categories below.

3.1 Account and identity

  • Sign-in identifiers. We use Supabase Auth with OAuth. Google sign-in is currently enabled; Apple Sign In may be enabled later. From the identity provider we typically receive an account identifier, email address, and display name (and related profile fields the provider shares with our Auth configuration).
  • App profile. We store a user profile in our database aligned to your Auth user id, which may include email, first name, last name, display name, signup source, simulation acknowledgement, and portfolio preference fields (for example risk percentage).
  • Public roster name. A public leaderboard / book name you choose or that we seed for you. Public surfaces are designed to show roster name — not your email or legal name.

3.2 Trading and portfolio activity (app functionality)

  • Virtual cash and athlete positions, portfolio aggregates, and portfolio snapshots
  • Orders, fills, and transaction ledger rows for market and limit trading
  • Watchlist selections
  • Leaderboard rankings and earned in-app credentials (badges)
  • Optional product feedback you submit (type and message, linked to your user id)

These records are required to operate the exchange simulation. They are not real-money bank or brokerage accounts. We do not collect payment card numbers, bank account details, or government ID for Phase 1.

3.3 Device, session, and technical data

  • Auth session tokens and related keys stored locally on your device (via secure app storage / AsyncStorage patterns used by our Supabase client) so you stay signed in
  • Standard server and network logs that may include IP address, timestamps, user agent, and request metadata when you reach our hosted backend or website

3.4 Content you choose to share

If you use in-app share cards (for example trade or portfolio claims), the app may generate an image or text that includes your roster name, portfolio stats, or trade details. Sharing uses the device share sheet (or a download on web). We do not operate a social network feed inside the app; what you share outside BSX is subject to that destination's policies.

3.5 Sports and market information (not your personal data)

The app displays athlete, team, game, news, and price data from our sports information and market planes. That information is about public sports markets and instruments — not about you — and is described here only for clarity.

3.6 Marketing website

The public website is a download call-to-action for the mobile app. It does not operate an email waitlist form. Standard web server or hosting logs may still be produced when you visit the site. Historical waitlist records (if any) collected under a prior email-capture version may remain in our database until deleted under Section 7.

4. How we collect information

  • Directly from you — when you sign in, set a roster name, trade, manage a watchlist, submit feedback, or share claim cards
  • From identity providers — Google (and Apple when enabled) via OAuth through Supabase Auth
  • Automatically — session storage on device; infrastructure logs from our hosting and database providers
  • From our own systems — server-side bootstrapping that creates your profile, roster name, and starting virtual cash when you first authenticate

5. How we use information

We use personal information to:

  • Create and secure your account; keep you signed in across sessions
  • Operate trading, portfolio, leaderboard, watchlist, and related exchange features
  • Display public books and ranks using roster names and portfolio performance metrics
  • Respond to feedback and improve product reliability and clarity
  • Protect against abuse, debug failures, and maintain security and integrity of the service
  • Comply with law, enforce terms, and respond to lawful requests
  • Communicate service-related notices when needed (for example account or security issues)

We do not sell personal information. We do not use personal information to run third-party advertising networks inside the app today. If that changes, we will update this policy and store disclosures before doing so.

6. Sharing and processors

We share personal information only as needed to run BSX, and with providers that process data on our behalf under contractual obligations. Current categories:

  • Supabase — authentication, Postgres database, Row Level Security, Edge Functions, and related hosting for app data and sports ingest jobs
  • Google (and Apple when enabled) — as identity providers for OAuth sign-in; their processing of your account is also governed by their policies
  • Hosting / deployment — for example Vercel for the marketing website
  • Other users — limited public profile surfaces (roster name, portfolio performance, ranks, badges, anonymized market tape) that are part of the product
  • Legal and safety — when required by law, to protect rights and safety, or in connection with a corporate transaction (merger, acquisition, or asset transfer), subject to appropriate safeguards

Sports data vendors (for example Balldontlie and public sports sources) supply athlete/game information to our information plane; they are not used as a channel to sell your personal account data.

7. Retention, deletion, and your choices

Retention

We retain account, portfolio, order, fill, and ledger data for as long as your account remains active and as needed to operate the simulation, resolve disputes, debug systems, and meet legal obligations. Feedback and logs may be retained for a reasonable period for product and security purposes, then deleted or aggregated.

Access, correction, and consent withdrawal

You may update certain profile fields in-app where the product allows. You may sign out at any time, which ends the active session on that device. Because account creation uses OAuth, you can also revoke BSX access from your Google (or Apple) account permissions settings.

Account and data deletion

To request deletion of your Ball Street Exchange account and associated personal data, email aaron@ballstreet.exchange from the address associated with your account (or include enough detail for us to locate it). We will verify the request and delete or de-identify personal account data, subject to limited retention needed for security, fraud prevention, legal compliance, or anonymized market integrity records (for example historical fills that no longer identify you).

This email pathway is our web-accessible deletion request method for Google Play account-deletion requirements. Signed-in users can also delete from the mobile app: Menu → Delete account, which calls the same deletion process.

8. Security

We use industry-standard safeguards appropriate to a cloud-hosted consumer app, including encrypted transport (HTTPS/TLS), provider-managed database security, authentication via OAuth, and row-level access controls so users cannot write another trader's portfolio. No method of transmission or storage is 100% secure; we encourage you to protect your identity-provider account and device.

Client apps use a public anon API key scoped by security policies — never a service-role secret.

9. Children

Ball Street Exchange is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

10. International processing

We and our processors may process information in the United States and other countries where our service providers operate. If you access BSX from another region, your information may be transferred to those locations.

11. Permissions and data we do not seek

As of the date above, the mobile app's core flows do not require:

  • Precise location
  • Contacts, photos library browsing, microphone, or Bluetooth
  • SMS / call log access
  • Payment wallet credentials for real-money deposits or withdrawals

If a future feature needs a sensitive permission, we will request it in context, disclose the purpose, and update this policy and store forms before shipping.

12. Third-party links and services

The app may show news headlines or links to third-party sites. Those destinations have their own privacy practices. OAuth providers and share destinations likewise operate under their own terms.

13. Changes to this policy

We may update this Privacy Policy as the product, infrastructure, or legal requirements change. We will revise the "Last updated" date on this page. Material changes may also be highlighted in-app or on the website when appropriate. Continued use after an update means you acknowledge the revised policy.

14. Contact

Questions, privacy requests, or account deletion requests:
Ball Street Exchange
Email: aaron@ballstreet.exchange
Web: https://ballstreet.exchange

This document is provided for transparency and store compliance. It is not legal advice. If you need jurisdiction-specific terms (for example GDPR DPA language or CCPA "Do Not Sell" notices beyond our current no-sale practice), consult counsel before production distribution.