Privacy policy
Effective 12 November 2026
Brier keeps the least it needs to run a play-money market: your username, a hash of your password, and your trading. No email, no real name, no ads, no analytics, no trackers, and your data is never sold.
Who runs Brier
Brier is a free, non-commercial project run by Kelvin Anaman, an individual developer in Boston, Massachusetts, United States (“Brier”, “we”, “us”). For the purposes of data protection law, we are the controller of the personal data described here. Contact details are at the end.
Personal data we collect
From you
- Account: your username and password. The password is stored only as an Argon2id hash; we never see or keep it in readable form.
- Confirmations: when you confirmed you are 18 or older and which version of the terms you accepted, with the time.
- Security: hashes of your recovery codes; your two-step sign-in secret, encrypted, if you turn it on; the public half of any API keys you add.
- Activity: your orders, trades, positions, balance, daily-allowance claims, and the forecasts you record. These form the exchange's ledger.
Automatically
- Session cookie: a random token that keeps you signed in for up to 24 hours.
- Network signals: when you sign up or sign in, a keyed hash of your IP address (not the address itself), used to limit sign-ups per network and to spot one person running several accounts. Refused requests (failed sign-ins, blocked admin calls, rate limits) are logged with the same kind of hash.
- Web server logs: like almost every website, our web server records each request: your IP address, the time, the page requested, and your browser's user agent. Passwords, cookies and session tokens are never written to these logs.
From third parties
None. We do not buy, receive or combine data about you from anyone else.
How we use it
- To create and run your account, match your orders, settle markets and keep the ledger correct.
- To keep Brier secure and fair: blocking abuse, limiting sign-ups, and detecting wash trading, manipulation and multiple accounts.
- To show the public parts of the game: leaderboards, profiles and market activity.
- To meet legal obligations, if any apply.
We do not use your data for advertising, profiling, or automated decisions with legal effects, and we do not train AI models on it.
Legal bases (EEA and UK)
- Contract: running your account and the markets you trade, under the terms of service.
- Legitimate interests: security logs, abuse prevention and fair-play checks. These are limited to what protecting the service needs, and you can object (see your rights).
- Consent: keeping your watchlist on your device between visits. You can withdraw it at any time in .
- Legal obligation: where a law requires us to keep or disclose something.
What is public
Your username, your profile, your trades on each market and your scores and rank on leaderboards are visible to everyone, as on any exchange. Nothing else about you is shown.
Sharing
We never sell or rent your data, and we do not share it with advertisers or data brokers. It is handled only by:
- Oracle Cloud (Ashburn, Virginia, United States), which runs our servers and stores the data on our behalf without using it.
- Authorities, only if the law requires it and after checking the request is valid.
Market data comes from public sources (such as the National Weather Service, the Federal Reserve Bank of St. Louis and sports data providers). We send them nothing about you.
International transfers
Brier's servers are in the United States. If you use Brier from elsewhere, including the EEA or the UK, your data is processed in the United States, which may not have the same data protection laws as your country. We protect it as this policy describes wherever you are.
Retention
- Account data: until you delete your account.
- Ledger entries: for as long as the exchange runs, under an anonymous name once the account is deleted, because every trade has a counterparty and the books must balance.
- Web server logs: 14 days. Security and system logs: 30 days.
- Backups: 30 days, encrypted.
Your rights
Depending on where you live, you can:
- Access and portability: download everything we hold about you as a file from your account page.
- Deletion: delete your account from the same page. Your username, password, recovery codes, two-step secret, API keys and network signals are erased at once; backups age out within 30 days.
- Correction, restriction and objection: ask us using the contact below.
- Withdraw consent: at any time, in .
- Complain: to your local data protection authority.
We answer requests within 30 days and never charge for them. Residents of California and other US states with privacy laws have the same rights here: we do not sell or share personal information for advertising, and we do not treat you differently for using your rights.
Security
Passwords are hashed with Argon2id; connections use HTTPS only; two-step sign-in secrets are encrypted; backups are encrypted; the database and exchange are not reachable from the internet; and admin actions need two-step sign-in and are recorded in an append-only audit log. No system is perfectly secure: if a breach affects your data, we will say so on this site as soon as we know. To report a security problem, see our security policy.
Children
Brier is only for people 18 or older. We do not knowingly collect data from anyone younger; if we learn an account belongs to a minor, we delete it.
Cookies
Brier uses one essential cookie for your session and one to remember your cookie choice, and, only if you allow it, browser storage to keep your watchlist. There are no analytics, advertising or third-party cookies. Details are in the cookie policy.
Changes
If this policy changes, the new version and its date appear here. For significant changes, signed-in users see a notice and are asked to accept the updated terms before trading again.
Contact
Privacy questions and requests: send a message on LinkedIn. Please do not post personal data in public places such as GitHub issues.