What we hold, and why

1. Who is responsible

The controller for the data described here is the operator of this website, trading as Yodoya. Write to legal@yodoya.xyz about anything in this policy, including a request under section 9.

2. What we collect

Opening an account

• Your email address, which is also how you sign in. There is no password.
• The country you declare, and separately the country we detect from your connection. We keep both, including when they disagree — the disagreement is the signal, so it is evidence to record rather than a conflict to resolve.
• An account identifier from our sign-in provider, if you sign in through it.
• Your referral code, and who referred you if you arrived through someone’s link.
• The date you signed up.
• Your confirmation that you are 18 or over: when you gave it and the IP address you gave it from. We do not ask for your date of birth.

Buying a challenge

• The tier, the price, and the status of the purchase.
• The blockchain address that paid and the transaction hash, both read from the public chain. If you take a refund, the address it was sent back to and that transaction’s hash.
• The EUR value of the purchase at the moment it cleared, and the rate used — a tax record, captured then because the rate moves daily.
• The VAT included in a challenge fee, the rate, and the two location facts it was based on — the country you declared and the country your connection resolved to at signup. VAT law requires us to keep this evidence of where you were.
• The two checkout confirmations, each with its timestamp and the IP address it came from. This is the record that you asked for your account to open straight away, understood that your right to cancel ends once you have traded, and accepted the risk warning. Without it, we could not honour either side of that arrangement.

Trading

• Every order you place, every position it opens or closes, and every fill — each fill stored together with the quote snapshot it was computed from, both feeds and both timestamps.
• Your account’s equity curve, sampled roughly every second, and the exact tick of any breach.
• An audit log of account-level events: geo checks and their reason codes, purchases, promotions, payout state changes.

This is dispute evidence first and product data second. It is why we can answer "why did my account close" with the actual tick rather than an apology.

Payouts

• The blockchain address you ask to be paid at, the amounts, and the transaction hash once sent.
• The outcome of screening that address against the OFAC SDN and EU consolidated sanctions lists.

Technical data, every visit

• Your IP address, used to determine the country you are connecting from, to record checkout consent, and to rate-limit abuse. Where we look the country up ourselves it is done against a database on our own server — your address is not sent to a geolocation service.
• Ordinary server logs: the request, the time, the response, the user agent.
• The cookies in section 11, and analytics only if you accept them.

We do not build advertising profiles, we do not run ad tracking, and we do not sell or rent personal data to anyone.

3. Why we are allowed to

• To perform our contract with you (GDPR Art. 6(1)(b)) — your account, your purchases, the trading records that decide whether you pass, and your payouts.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records, the consent evidence consumer law requires us to keep, and not paying money to anyone the EU sanctions rules that bind us forbid us to pay.
• Our legitimate interests (Art. 6(1)(f)) — screening payout addresses against sanctions lists, confirming you are an adult, preventing fraud and multi-accounting, enforcing the jurisdictions we cannot serve, keeping the platform secure, and holding enough evidence to answer a dispute. We have weighed these against your interests; none of them involves profiling you for marketing.
• Your consent (Art. 6(1)(a)) — analytics cookies, and marketing email. You can withdraw either at any time, without affecting anything done before you did.

4. Automated decisions

Two decisions here are made by software without a person looking, and you should know about both:

• The geographic gate. Signup, purchase and payout are each checked against the country you declared and the country your connection resolves to. A blocked jurisdiction stops the action outright. Every decision is logged with a reason code.
• Sanctions screening of a payout address. A match rejects the payout. It is a hard gate by design: nobody here can override it, including from the admin interface.

If either blocks you and you believe it is wrong — a mislocated IP address, a false name match — write to us. A person will look at it, tell you what the check found, and correct the record if it is wrong.

Chart Draft fair-play checks

Paid Chart Draft matches are checked for signs that someone had outside help. What we look at is the match itself: the moves made, how the time on your clock was spent across them, and how often the moves matched what our own engine would have chosen.

No software here decides anything on its own. A flagged match is held and a person reviews it, and both possible outcomes are set out under “Fair play” in section 9 of the terms: the result stands, or the match is void and both players get their entry back in full. Nothing is forfeited by a check. We rely on our legitimate interest in keeping a paid game honest for the people playing it fairly, and we keep the signals with the match record for as long as we keep the match (section 7). You can ask what a check found on your own match, and object to it, under section 9.

5. Who else processes it

These are every third party involved, and exactly what each one gets. There are no others.

Two further sources carry no personal data at all: the exchange price feed the engine consumes, and the public rate lookup used to record a purchase’s EUR value.

Beyond that we disclose data only where we must: to a public authority acting lawfully, to our professional advisers under confidentiality, or to a successor if the business is transferred — in which case this policy travels with it.

6. Transfers outside the EEA

Several of the processors above are established in the United States, so some of your data is processed there. Those transfers rely on the European Commission’s Standard Contractual Clauses, on the EU–US Data Privacy Framework where the provider is certified under it, and on the safeguards in our contract with each of them. Ask us and we will tell you which applies to which provider.

Blockchain transactions are a special case: a payment or a payout is recorded on a public, worldwide ledger that nobody controls and nothing can erase. Addresses and amounts on it are permanently public.

7. How long we keep it

• Account and trading records — while your account exists, and after it closes for as long as a claim arising from it could still be brought against either of us.
• Purchase, refund and payout records — for the statutory accounting and tax retention period that applies to us, which is measured in years and which we cannot shorten on request.
• Consent evidence at checkout — for as long as the corresponding purchase record.
• Audit and geo-decision logs — kept as evidence that the gates were enforced, which is the whole point of writing them down.
• Server logs — a short operational window, then rotated away.

Where something is kept only because the law requires it, it is kept for that and nothing else: it is not used to market to you, and not used to profile you.

8. What we publish

Some of what happens here is public on purpose, because a platform that publishes nothing cannot be trusted. None of it ever shows your email address:

• The payout ledger lists every confirmed payout with its transaction hash, its tier and its date. No username, no email, no account holder.
• The leaderboard ranks funded accounts by what their traders were paid, by account number only. Its Chart Draft and duel boards rank players by staked wins and show the username you chose, or a generated handle if you have not chosen one.
• In matches against other players, your opponent and anyone watching see the same name, and a match’s result and share card show it too.
• Your public page, a page of your match history at your username, exists only if you turn it on, and shows only the sections you choose.

You can opt out of all of this under Privacy on your profile: you are then left off every board and shown everywhere as “Private trader”, and your public page goes offline.

9. Your rights

Under the GDPR you can ask us to:

• Give you a copy of what we hold about you, and tell you where it came from.
• Correct anything inaccurate.
• Delete what we are not required to keep. Closing an account is not the same as erasing every record of it: purchase, tax and sanctions-screening records survive for their retention period, and we will tell you precisely what was kept and why.
• Restrict or object to processing we base on legitimate interests.
• Receive your data in a portable form — the data you gave us, machine-readable.
• Withdraw consent: analytics through the “Cookie settings” button in the footer of every page, marketing email through the unsubscribe link in it.

Write to legal@yodoya.xyz from the address on the account. We answer within one month, free of charge.

One honest limit: we cannot erase a blockchain transaction. Once a payment or payout has confirmed, that record exists on a public ledger outside anyone’s control, and no request to us can remove it.

10. How it is protected

• The site is served over HTTPS only, with strict transport security, and a content security policy that blocks any script we did not put there ourselves.
• There are no passwords to steal: sign-in is a one-time code to your mailbox.
• Your session cookie is closed to JavaScript and expires after 168 hours; the anti-forgery cookie is closed to JavaScript too.
• Repeated failed admin sign-ins are locked out.
• Access to the production database is limited to the people who operate the platform.

No system is perfectly secure. If a breach ever affects your data and presents a real risk to you, we will tell you and the relevant supervisory authority, within the deadlines the GDPR sets.

11. Cookies and local storage

Yodoya sets two cookies that are strictly necessary — they keep you signed in and stop cross-site request forgery — and under the ePrivacy rules they need no consent. A third is set only if you arrive through a referral link: it holds that link’s code for 30 days, so the person who referred you is credited if you sign up, and it is read only by our server. Analytics cookies are never set unless you accept them. The support chat sets its own cookie only once you open it, because it is what keeps your conversation attached to you; nothing about it loads before then.

We also keep a few small values in your browser’s local storage. These never leave your device and are never sent to us:

• yodoya-cookie-consent — your answer to the cookie banner.
• doji:last-payout-address — the address the payout form pre-fills with, so you do not retype it on a new device.
• yodoya-chart-interval, yodoya-chart-timezone and yodoya-chart-symbol — the candle interval, time zone and market you last chose in the trading terminal.
• yodoya-chart-overlays — which lines and trade markers you switched on or off over the terminal's chart.
• yodoya-coach-dismissed — that you closed the first-trade guide in the terminal, so it doesn’t come back.
• yodoya-ticket-margins — the order size you last used on each market in the terminal. (The markets you pin to the top of the watchlist are saved to your account instead, so they follow you to other devices.)
• yodoya.duel.sound and draft.* — whether match sounds are on, and your Chart Draft board view settings.

Two values sit in session storage instead, which your browser clears when you close the tab: yodoya:offramp-session, which matches you back to a bank withdrawal when you return from MoonPay’s page, and yodoya:flash, a one-off confirmation message shown on the next page you load.

Privy’s sign-in library also keeps your sign-in session in local storage (privy:token, privy:refresh_token and related values). Unlike the values above, these are sent: to Privy to keep you signed in, and to us once at sign-in, to prove who you are.

How the analytics gate actually works

Analytics consent is denied by default for anyone in the EEA, the UK or Switzerland, and for anyone whose location we cannot determine. Until you accept, no request is made to Google’s servers at all — the analytics script is not merely disabled, it is never fetched. Advertising signals stay denied in every case; this site runs no ads.

Changing your mind

The “Cookie settings” button in the footer of every page reopens the banner. Rejecting there stops analytics immediately. You can also clear cookies in your browser at any time — clearing the session cookie simply signs you out.

Third-party embeds

The price chart inside the trading terminal is drawn by a library served from this website, and its price history is fetched by our server. Its live candle, though, connects your browser directly to Binance’s public price stream, so Binance sees your IP address while the terminal is open. Nothing else is sent to it, and nothing on the chart sets storage of its own.

Our own typefaces are served from this website, not from Google Fonts or any other font service. The one exception is Privy’s sign-in window: it loads its typefaces from Google Fonts, so Google sees your IP address when that window opens. The content security policy allows fonts from this website and from Google Fonts only, and nowhere else.

12. Email you receive

Account email is part of the service, not marketing: a welcome message when you sign up; receipts for purchases, refunds and payouts; trading alerts, such as a warning when your account is close to breaching and the notice when it breaches or passes; and, if you play matches, challenges sent to you and match results. These are on by default because missing one can cost you. You can switch receipts, trading alerts and match emails off separately in your email settings. Sign-in codes are sent by Privy whenever you ask for one.

Anything else — product news, announcements — is marketing, goes out only on your consent, and carries an unsubscribe link that works immediately. Your address is held in our email provider’s contact list for that purpose; unsubscribing removes you from it.

13. Under-18s

Yodoya is for adults. We do not knowingly hold data about anyone under 18, and an account we find belongs to a minor is closed and its data deleted.

14. Changes to this policy

The version in force is the one published here, dated at the top. If we change how we use your data in a way that materially affects you, we will tell registered users by email before it takes effect rather than quietly editing this page.

15. Contact and complaints

Yodoya · legal@yodoya.xyz

If you are unhappy with how we have handled your data you can complain to the data protection authority in Sweden, or to the one in the EU country where you live or work. We would rather you came to us first — most of it is fixable in a single email.

The contract itself, including refunds and the trading rules, is in the terms of service.