Effective 23 October 2026 · Applies to nevabase.com and every nevabase market (such as nevabase.com/coal and nevabase.com/coffee)
This Privacy Policy describes how nevabase ("nevabase", "we", "us", "our") collects, uses, stores and shares information when you visit our website, create an account, and use the market pages, backtests and paper-trading accounts (together, the "Service"). It also explains the rights and choices you have. Please read it together with our Terms of Service. If you do not agree with this policy, please do not use the Service.
nevabase is the data controller for personal data processed through the Service. You can reach us at privacy@nevabase.com.
We do not collect precise location, contacts, calendars, files or messages from any account you connect. We do not run advertising trackers or sell personal data. We do not use your queries or account data to train machine-learning models.
You can sign in to nevabase with Google, with GitHub or with an email address and password. Authentication is handled by Firebase Authentication, a Google service. When you choose Google sign-in, nevabase requests only the basic profile scopes (openid, email and profile) and receives the following data from your Google account:
We use this Google user data only to create and secure your nevabase account, to show who is signed in, to attribute your paper-trading accounts to you, and to contact you about your account. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service, and we do not read, store or share any other Google data.
Limited use. nevabase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not transfer Google user data to third parties except as needed to provide the Service, to comply with law or as part of a merger or acquisition; we do not use it for advertising; and no human reads it except with your consent, for security purposes, or to comply with law.
Revoking access. You can remove nevabase's access to your Google account at any time at myaccount.google.com/permissions. Doing so signs you out of nevabase; your nevabase account and paper accounts remain until you delete them (section 12). GitHub users can revoke access under Settings → Applications on GitHub.
Where the GDPR or UK GDPR applies, we rely on: performance of a contract for account, paper-trading and support data; legitimate interests for security logging, abuse prevention and service improvement, balanced against your rights; consent for optional marketing email, which you can withdraw at any time; and legal obligation for records we must keep.
We share personal data only with the following categories of recipients, and only as needed to run the Service:
| Recipient | Purpose | Data involved |
|---|---|---|
| Google Firebase Authentication | Sign-in and session management | Account identifier, email, name, picture |
| Our hosting provider (Amazon Web Services, Tokyo region) | Running servers, storage and backups | All Service data at rest, encrypted |
We may also disclose information if required by law, to protect the safety of any person, to prevent fraud or abuse, or as part of a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy. We do not sell personal data and we do not share it with advertisers or data brokers.
Prices, spot and basis, exchange rates and weather shown on nevabase come from public sources (Sina Finance, Yahoo Finance, 100ppi via AkShare, the European Central Bank via Frankfurter, and Open-Meteo). This data is not personal data. Reviews, relation tests and backtests are computed by our code from that data; nothing you do in a paper account is shared with these sources.
The Service uses only strictly necessary storage:
We do not use analytics, advertising or cross-site tracking cookies, and we do not respond differently to "Do Not Track" signals because we do not track you across sites in the first place. You can clear all of this storage from your browser settings at any time.
| Data | Retention |
|---|---|
| Account profile (name, email, picture) | Until you delete your account, then removed within 30 days |
| Paper-trading accounts, orders and fills | Until you delete the paper account or your account |
| Server logs (IP address, user agent, path) | 30 days, then deleted |
| Support email | 24 months after the conversation closes |
| Backups | Rotated every 30 days; deleted data leaves backups within that period |
All traffic to the Service is encrypted in transit with TLS. Data at rest is stored on encrypted volumes. Access to production systems is limited to the people who operate the Service, protected by strong authentication, and logged. If we become aware of a security breach affecting your personal data we will notify you and, where required, the competent authority without undue delay.
Depending on where you live, you may have the right to:
To exercise any of these rights, email privacy@nevabase.com. We will verify your identity by asking you to write from the email address on your account and will respond within 30 days. We never discriminate against you for exercising your rights. Residents of California have the rights described in the CCPA/CPRA, including the right to know, delete and correct; we do not "sell" or "share" personal information as those terms are defined there.
You can delete any paper account yourself on its market page at any time. To delete your whole account, email privacy@nevabase.com from the account's email address with the subject "Delete my nevabase account". Within 30 days we delete your profile and all paper accounts in every market, and we remove your Firebase authentication record.
Our servers are located in Japan (Amazon Web Services, Tokyo). Firebase Authentication and our other providers may process data in the United States and other countries. Where data leaves the European Economic Area, the United Kingdom or Switzerland we rely on the recipients' standard contractual clauses or equivalent safeguards.
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
We may update this policy as the Service or the law changes. We will post the new version here and update the effective date. For material changes we will also email account holders at least 14 days before the change takes effect. Earlier versions are available on request.
nevabase
Email: privacy@nevabase.com (privacy and data requests) · legal@nevabase.com (legal notices) · security@nevabase.com (security reports)