Privacy Policy

• Account and preferences: your email, username, account status, notification and display settings, and a password hash if you set a password. If you use Google sign-in, we receive and store your Google user identifier and email. An email address is required for an account; Google sign-in is optional.
• Activity and content: markets you create, forecasts, trades, positions, comments, votes, tips, follows, notifications, uploaded images, sharing links, membership and access requests. If you run a bot account, we store its connection to your account and its activity.
• Security information: sign-in records linked to your account include a hashed and masked IP address, browser details and sign-in times. Request and operational logs can include IP addresses, request times, URLs and account identifiers.
• API tokens and connected agents: the credentials, permissions and usage records needed for your API tokens and connections to apps or agents.
• Pro and Supporter billing: payment and subscription records needed to manage your plan. Stripe processes your payment and handles your card details.
• Sandbox chat: your messages, the assistant's replies, the tools it used and their results, notes it saved for you, the sandbox and its simulated date. Chats are linked to your forecasting record. See Sandbox chat and your data.
• Messages to us: the name, email and message you send through the contact form, and correspondence needed to respond to enquiries, support requests, complaints and privacy requests.

Our purposes and lawful bases under UK data protection law are:

• Providing your account and forecasting service: account data, preferences and activity are used to perform our contract with you. This includes authentication, recording forecasts and scores, displaying content to its intended audience, sharing you request and essential account emails.
• Providing Pro and Supporter and administering payments: we use billing information to provide the subscription you buy and manage its payments. This is necessary for our contract with you. We keep financial records where tax and accounting law requires it.
• Protecting the service: our legitimate interests in account security, preventing abuse, maintaining reliable operation and investigating problems. We use security records and logs for these purposes.
• Activity notifications: our legitimate interests in keeping you informed about markets and conversations you participate in. You can disable notification emails in Settings. Sign-in and security emails are needed to operate your account.
• Responding to enquiries and complaints: our legitimate interests in helping users and resolving issues; contract performance where an enquiry concerns your service; legal obligation where we must respond to a data protection request or another legal requirement.
• Sandbox chat: we use your chats to run the chat, which is necessary for our contract with you. With your consent, given before your first retrocasting chat, we also use retrocasting chats to train and evaluate Antistatic's forecasting models. Wargame chats are never used for training. You can withdraw consent in Settings. Withdrawing applies from then on: chats from while you'd agreed stay in our training data; later ones aren't used. See Sandbox chat and your data.
• Optional embeds: your consent to load a chosen provider’s embeds and the cookies and visitor-data processing described below.

We do not sell your personal data or use it for third-party marketing. Antistatic does not run its own advertising or analytics tracking scripts.

Public markets, public posts and associated usernames and activity may be viewed by other people, including through the API. Private-market pages and activity are subject to account access controls. Owners manage membership and access requests, and administrators can access data needed to operate the service.

A connected agent can receive data and act within the permissions you grant, including private data your account can access. You can revoke connections and API tokens in Settings. Revocation prevents future access through those credentials; it does not erase copies already received by the assistant or its provider. Their own privacy policies apply.

We use a session cookie to keep you signed in. If you tick “Keep me signed in on this device”, we also set a cookie that lasts 14 days and can renew while you use Antistatic. Logging out clears these cookies.

We also keep unfinished drafts in your browser so the editing features work. We do not use browser storage for advertising or behavioural profiling.

• Fly.io: application hosting and PostgreSQL database hosting.
• Tigris: storage and delivery of uploaded images.
• Resend: delivery of account, notification and contact-form emails.
• Stripe: subscription checkout, payment processing and billing management. See Stripe's privacy policy.
• Google: optional Google sign-in and YouTube embeds you choose to enable. See Google's privacy policy.
• X: posts you choose to enable, under X's privacy policy.
• Anthropic: generates sandbox chat replies and plans sandbox turns, as our processor. Chat content, the sandbox's context and the inputs to planned turns are sent to Anthropic's API, which is based in the United States. See Anthropic's privacy policy.
• Connected app providers: information shared through the connections you authorise, under their own policies.

Our providers operate internationally, so your information may be processed outside the UK. You can contact us for details of the locations and transfer safeguards relevant to your information, and how to obtain copies.

We may also disclose information where legally required or necessary to investigate abuse or protect people's rights, subject to applicable law.

We keep account information, forecasting records and content while your account exists. You can ask us to delete your information by emailing privacy@antistatic.exchange. We explain any information we need to keep for legal obligations, security, disputes or other people's rights.

Sandbox chats, and copies of them in our training data, are kept until you ask us to delete them. Models already trained on them are not retrained.

For other records, including token and connection records, uploaded images, sharing records, messages, billing, operational logs and backups, retention depends on their purpose, how long they are needed to provide the service or resolve an issue, and legal record-keeping requirements. We consider these records when handling a deletion request and explain any limits that apply.

Subject to the conditions in applicable data protection law, you can ask to access or correct your information, request erasure or restriction, and receive a portable copy where the right to portability applies.

You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent without affecting the lawfulness of earlier processing.

Send requests or privacy complaints to privacy@antistatic.exchange. We may need proportionate information to verify your identity. Email us to request account deletion.

You can ask for a copy of your sandbox chats and related data in the same way. You can withdraw training consent for retrocasting chats in Settings.

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

We protect accounts with password hashing, hashed API credentials, signed session cookies and access controls. Report security concerns to privacy@antistatic.exchange.

We update this policy when our processing changes and show the revision date above.