Privacy notice
Fleethall, at https://platform.fleethall.com, is a practice platform: people trade play money against live order books. This notice says what it keeps about you, why, and for how long. Last updated 30 October 2026.
Who we are
The controller under the GDPR is Mykyta Rohovyi, privacy@fleethall.com. No data protection officer is appointed.
Display name
Why: your account, and the leaderboard. Everyone signed in to Fleethall, and every holder of a Fleethall key, sees it there beside your account's return, its return against holding what it traded, its deepest drawdown, its number of fills and when it was made. Choose a name that doesn't identify you if you'd rather not be known. Lawful basis: contract, Art. 6(1)(b). Kept until you delete the account.
Email address
Why: confirming the account, recovering it, and messages about it; no marketing. Lawful basis: contract, Art. 6(1)(b). Kept until you delete the account; an account whose email is never confirmed is erased when someone signs up with the same address more than 24 hours after it was made. It is also held in memory only, as counters, for at most 24 hours: how many sign-ups named it this hour and how many messages went to it today, so nobody can use our sign-up form to flood an address; lawful basis for that: legitimate interest, Art. 6(1)(f). If a message to you bounces or is marked as spam, our email provider keeps the address on a do-not-send list until we remove it.
Passkeys
The public key, the credential id, the sign-in counter and dates; never a password or a private key. Why: signing you in without a password. Lawful basis: contract, Art. 6(1)(b). Kept until you remove the passkey or delete the account.
Session
A random token in one cookie, kept on our side only as a hash, with its start and end times. Why: keeping you signed in. Lawful basis: contract, Art. 6(1)(b). Kept 30 days, or until you sign out. It is the only cookie; there are no analytics, and no page loads anything from a third party.
IP address
Why: limiting sign-up, sign-in and email requests, market-data requests made without signing in, and open connections, against abuse. Lawful basis: legitimate interest, Art. 6(1)(f): keeping the service secure and available. Held in memory only, as counters, at most one hour; never written to disk or to logs.
Play-money trading history
Orders and the reasons given for them, fills, positions, balances, and equity each minute. Why: the practice platform itself. Lawful basis: contract, Art. 6(1)(b). Kept until you delete the account. Only you, and keys you make, see them; other people see only the leaderboard's figures above, never an order, a fill, a position, an instrument or a reason.
Backups
Daily server backups hold all of the above for up to 7 days after deletion.
Who processes it for us
Amazon Web Services. It hosts the platform (Lightsail) and sends our email (SES, from no-reply@fleethall.com), both in the Stockholm region (eu-north-1). For any transfer outside the EEA, AWS's data processing terms include the EU Standard Contractual Clauses. We sell nothing and show no ads.
Your rights
Access, rectification, erasure, restriction, portability, and objection to the IP-based limits. Write to privacy@fleethall.com. You can also complain to a data protection authority, in particular where you live or work.
What is required
A display name, an email address and a passkey are needed to have an account; without them we can't open one. There is no automated decision-making or profiling.