Privacy policy
Hoops Stock Exchange is a free beta service. The website and its PostgreSQL database are hosted by Render in Ohio, United States. Render may process technical information and service logs to operate, secure, and support the service. See Render’s Privacy Policy for its handling of information.
Who operates HSE
Hoops Stock Exchange (“HSE,” “we,” or “us”) is operated from Kansas, United States. For privacy or account questions, contact HoopsStockExchange@yahoo.com.
Information we collect and store
- Votes: the two assets compared, your selection, the time of the vote, and a random browser identifier used to prevent repeat votes on a matchup. Votes are not connected to an account or email, but the random identifier is stored with each vote so the restriction can work. Votes and vote-derived market history are retained.
- Accounts: if you create an account, we store your email address, a salted password hash (not your readable password), sign-in session tokens in hashed form, and the player/pick list you save to the account. If one-time email verification or password recovery is used, its token is stored as a hash and expires after one hour.
- Guest teams and preferences: a guest roster, roster sort choice, selected asset-table columns, and the current comparison position are stored in your browser. If you create an account, your roster is sent to HSE and stored with the account so it can sync across devices.
- Abuse prevention: to limit automated or excessive requests, HSE creates keyed, one-way identifiers from request IP addresses and, for failed sign-in limits, account email addresses. The raw IP address and email are not stored in these rate-limit records. These temporary records expire within about an hour. Render may independently process IP addresses and technical request information in its service logs; its log retention depends on its plans and policies.
- Messages you send us: if you email HSE, we receive the address and message contents you choose to send.
Cookies and browser storage
HSE uses an essential first-party dse_voter cookie to remember the random browser identifier used for voting. It is HttpOnly, limited to HSE, and expires after one year. When you sign in, HSE uses an HttpOnly dse_session cookie; sessions expire after 30 days or sooner when you sign out or reset your password. Guest rosters and display preferences are kept in your browser’s local storage until you clear it. These are used for site features, not cross-site advertising.
How information is used
Votes are used to calculate and display community market values, rankings, movement, and history. Account information is used to create and secure your account, sign you in, save and sync your team, and provide password recovery; email verification may be used when enabled. We use temporary request identifiers to rate-limit activity and protect the service. We do not currently use third-party advertising or analytics tools, and we do not use account emails for promotional messages.
Service providers and data sources
- The website and PostgreSQL database are hosted by Render in Ohio, United States. Render may process technical information and service logs as described in Render’s Privacy Policy.
- If email delivery is configured, HSE sends account-verification and password-reset messages through Resend.
- Player birth dates are sourced from Wikidata. Player positions, draft details, and regular-season production used only to calculate preliminary starting estimates are sourced from BALLDONTLIE, with Wikidata filling available metadata gaps. Raw player stat lines are not displayed. Data refreshes are performed by HSE’s server-side tools; your account and votes are not sent to these data sources.
- The site loads fonts from Google Fonts. Your browser requests font files from Google, which may receive technical information such as your IP address. See Google’s Privacy Policy.
- HSE does not currently use third-party advertising or analytics tools.
Your choices and deletion
You can delete your account and cloud-saved team from the signed-in account menu. This removes your account, saved team, sign-in sessions, and recovery tokens. Any guest roster copy in another browser’s local storage remains on that device until cleared. Votes are stored separately from accounts and retained for market values and history, so account deletion does not remove past votes. Because votes are not tied to your account, HSE cannot identify and selectively remove your votes. For privacy questions or requests, email HoopsStockExchange@yahoo.com.
Password-reset and verification links expire after one hour; sign-in sessions expire after 30 days. Temporary rate-limit records expire within about an hour. Render and email providers may retain operational records under their own terms and retention policies.
Security
Passwords are stored as salted cryptographic hashes, and account sessions and one-time email tokens are stored as token hashes. We use reasonable safeguards for the current service, but no website or storage system can be guaranteed completely secure.
Children and changes
HSE is not directed to children under 13, and we do not knowingly request personal information from children under 13. If you believe a child provided account information, contact us so we can review it.
We may update this policy as the service changes. The “Last updated” date above identifies the latest revision. Material changes will be posted on this page.