Privacy Policy — Muses Exchange

● Last updated April 22, 2026

Plain-English summary Muses Exchange is a paper-trading platform. The personal data it handles is your email address, a hashed password, and the virtual portfolio you build inside your account. It uses privacy-friendly analytics (Plausible) and an error-reporting service (Sentry) that only receives anonymous identifiers. Your data is never sold, never shared with advertisers, and can be deleted on request by emailing privacy@muses.exchange.

Who we are

This website and the paper-trading platform at muses.exchange (together, the "Service") are operated by Muses Exchange (referred to as "Muses", "we", "us" or "the operator" in this document). Muses is based in the Netherlands and serves users globally.

For all data-protection matters, Muses is the data controller as defined in Article 4(7) of the EU General Data Protection Regulation (GDPR). You can reach us at privacy@muses.exchange.

Data we collect

Muses is engineered to collect as little personal data as practicable. The categories below are the complete list of what we hold about you.

Account credentials. When you create an account, we record your email address and a cryptographically-hashed version of your password. We do not store or have any way to retrieve your plaintext password. Password hashing is performed by our authentication provider (Supabase) using industry-standard algorithms.
Profile data. Any display name, handle, avatar, bio, or preference you choose to set while using the platform. You can edit or clear these at any time from your account settings.
Paper-trading portfolio. The virtual holdings, virtual cash balance, transaction history, watchlist, order book, and related activity you generate while using the platform. None of this involves real money, but it is tied to your account and stored on our servers so you can access it across devices.
Waitlist email. If you sign up for the launch waitlist rather than creating an account, we hold only your email address for the purpose of notifying you when access opens.
Anonymous analytics. Aggregated page-view data — referrer, country, browser, device type, page path — collected by Plausible Analytics. Plausible does not use cookies, does not generate a persistent visitor ID, and does not collect anything that identifies you individually. See Plausible's data policy for technical detail.
Error reports. When the application encounters an unhandled error in your browser, we send a diagnostic report to Sentry so we can fix it. The report contains the error message, a JavaScript stack trace, your browser version, and your account's internal user identifier (a UUID). It does not contain your email address, password, or the contents of your portfolio.
Server logs. Our hosting and database providers keep short-lived technical logs — IP address, request timestamp, URL, user agent — for abuse protection and debugging. These logs are not merged with your account data.

What we do not collect: your legal name, phone number, physical address, ID documents, payment details, precise location, advertising identifiers, or any data from third-party tracking cookies.

Why we collect it (legal basis)

Data	Purpose	GDPR legal basis
Account email + password hash	Authenticate you into the Service	Art. 6(1)(b) — contract
Profile data	Personalise the Service and power the public leaderboard (where you have opted in)	Art. 6(1)(b) — contract
Paper-trading portfolio	Persist your session across devices	Art. 6(1)(b) — contract
Waitlist email	Notify you when access opens	Art. 6(1)(a) — consent
Anonymous analytics	Understand aggregate traffic and improve the Service	Art. 6(1)(f) — legitimate interest
Error reports	Diagnose and fix bugs	Art. 6(1)(f) — legitimate interest
Server logs	Abuse prevention and debugging	Art. 6(1)(f) — legitimate interest

Because Plausible collects no personal data and we set no tracking cookies, the Service does not display a cookie-consent banner. For more detail, see our cookies policy.

Processors and sub-processors

We engage the following service providers to operate the Service. Each is bound by a data-processing agreement that restricts the use of your data to the purposes we direct.

Supabase, Inc. (United States) — provides authentication, database, and realtime services. Stores your email address, hashed password, and portfolio data. Privacy policy.
Netlify, Inc. (United States) — hosts the static assets of the Service and runs the waitlist form. Privacy policy.
Plausible Insights OÜ (Estonia, European Union) — provides cookieless analytics. Privacy policy.
Functional Software, Inc. (d/b/a Sentry) (United States / Germany) — provides error reporting. Receives anonymous user UUID and browser diagnostics only. Privacy policy.
Google LLC (United States) — serves the Inter and Fraunces webfonts used on the Service. Your browser makes a direct request to Google's font CDN, which may observe your IP address for the duration of that request. No account data is shared.

We do not sell your data. We do not share it with advertisers. We do not pass your email address to any third party for marketing purposes. We respond to law-enforcement requests only to the extent required by applicable law and will notify you where legally permitted to do so.

Retention periods

Account data (email, password hash, profile, portfolio) — retained for as long as your account is active. On deletion, data is purged from live systems within 7 days, and from routine backups within 30 days.
Waitlist email — retained until the waitlist is retired or you request deletion, whichever is sooner.
Server logs — retained for a period not exceeding 30 days, consistent with our hosting providers' defaults.
Anonymous analytics — retained indefinitely in aggregated, non-personal form.
Error reports — retained for 90 days, after which Sentry automatically deletes the event.

Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you.
Rectify any data that is inaccurate or incomplete.
Erasure — the so-called "right to be forgotten". You can trigger this yourself from Settings → Account → Delete my account, or by emailing us.
Portability — request a copy of your data in a common, machine-readable format.
Restrict or object to processing carried out under legitimate interest.
Withdraw consent for the waitlist at any time.
Lodge a complaint with your national data-protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens; if you are elsewhere in the EU or the UK, contact your domestic supervisory authority.

To exercise any right not available as a self-service control, email privacy@muses.exchange. We respond within 30 days of receiving a verified request, as required by Article 12(3) of the GDPR.

Security

We protect your data with industry-standard controls: TLS 1.2+ encryption in transit, encryption at rest for the account database, password hashing at the authentication layer, row-level access controls on the database so your records are isolated from other users', and a coordinated vulnerability-disclosure process. No system is perfectly secure, but we treat account data as highly sensitive and will notify affected users without undue delay if a personal-data breach ever occurs, in accordance with Articles 33 and 34 of the GDPR.

International transfers

Several of our processors are based in the United States (Supabase, Netlify, Sentry, Google). Where personal data is transferred outside the European Economic Area, we rely on the EU Standard Contractual Clauses (2021/914) as the transfer mechanism, supplemented by appropriate technical safeguards. Plausible processes data entirely inside the EU. You can request copies of the relevant clauses by emailing us.

Minors

The Service is intended for users aged 16 or older. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with their data, contact us and we will delete it.

Changes to this policy

When this policy changes in a way that materially affects how we process personal data, we will update the "Last updated" date at the top of the page and, where we hold your email address, notify you before the change takes effect.

Contact

General privacy queries, data-subject requests, and complaints: privacy@muses.exchange. Given the current scale of the Service, we have not appointed a Data Protection Officer — this is permitted under Article 37 of the GDPR because our processing does not meet the thresholds that require one. Queries are handled directly by the controller.

Further detail on the trackers (or lack thereof) used on the Service is available in our cookies policy. Risk information relating to the paper-trading simulation is set out in the risk notice.

Privacy policy.