Privacy Policy

1 INFORMATION WE COLLECT

We collect information to provide, maintain, and improve our virtual trading and startup discovery services:

1.1 Account & Profile Information

• Personal Identity: Full name, username, email address, password hash (Argon2id/BCRYPT), profile bio, and avatar images.
• Social Handles: Optional social media handles (Twitter/X, LinkedIn, GitHub, YouTube, website URL) provided in trader profiles.

1.2 OAuth & Single Sign-On (Google Sign-In)

When you log in or register using third-party OAuth authentication (such as Google), we retrieve your verified email address, full name, Google profile ID, and avatar image. We do not store or access your Google account password.

1.3 Startup Submission Data

When startup founders pitch or list a startup, we collect the startup name, category, tagline, detailed description, website link, logo image, stage, and founder details for public directory display.

1.4 Virtual Market Activity & Financial Logs

We record virtual trading transactions, prediction history (Bulls vs. Bears positions), Prediction Coin balances, trader scores, win rates, and leaderboard rankings within our ACID-compliant simulation engine.

1.5 Technical & Security Logs

To defend against bot networks, Sybil attacks, and security vulnerabilities, we automatically log client IP addresses, browser user-agent strings, device identifiers, and request timestamps.

2 HOW WE USE YOUR INFORMATION

We use the collected information for the following purposes:

• To operate and maintain the OGStartups virtual stock market simulation.
• To display public trader profiles at ogstartups.com/trader/{username} and calculate live leaderboard rankings.
• To allow startup founders to showcase high-growth startups to the community.
• To manage virtual Coin allocations, Welcome Coins, rewards, and trading positions.
• To detect, prevent, and mitigate fraud, automated bot abuse, Sybil attacks, and security breaches.
• To send account verification, security notifications, and platform support communications.

3 COOKIES & TRACKING TECHNOLOGIES

We use essential session cookies and local storage tokens to keep you securely logged in, remember UI theme preferences, and maintain secure CSRF token validation during form submissions. You can disable non-essential cookies through your browser settings, though doing so may affect login persistence.

4 DATA SHARING & THIRD-PARTY SERVICES

We do not sell, rent, or trade your personal data to third parties. We may share data only under the following strictly defined conditions:

• Public Profiles & Leaderboards: Your public name, username, avatar, trader score, and public portfolio positions are visible on public leaderboards.
• Service Providers: We integrate trusted third-party providers for hosting infrastructure, payment processing, and Google OAuth authentication.
• Legal Compliance: We may disclose information if required by applicable law, court order, or governmental authority.

5 SECURITY & OWASP DEFENSE PROTOCOLS

OGStartups employs enterprise-grade OWASP security standards to safeguard your data:

• Cryptographic Password Hashing: Passwords are stored using strong Argon2id/BCRYPT hash algorithms with unique salts.
• Prepared SQL Statements: All database queries use PDO prepared statements to completely eliminate SQL injection vectors.
• Rate Limiting & Sub-Second Velocity Defense: Sub-second bot detection limits rapid automated calls to 6 calls per 2 seconds.
• HTTPS SSL Encryption: All client-server communications are encrypted in transit via TLS 1.3.

6 YOUR DATA RIGHTS & CHOICES

Depending on your jurisdiction, you possess rights regarding your personal data:

• Access & Correction: You can view and update your profile details via account settings.
• Account Deletion: You may request permanent account deletion by contacting support. Upon deletion, your personal details are purged from active databases.
• Data Portability: You may request a copy of your personal data in a structured JSON format.

7 CHILDREN'S PRIVACY

OGStartups is not intended for children under the age of 18 (or the applicable minimum legal age in your jurisdiction). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately for deletion.

8 CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically. When material updates occur, we will revise the "Last Updated" date at the top of this page. Your continued use of OGStartups after updates take effect signifies your acceptance of the revised Privacy Policy.