Privacy Policy

1. What this policy covers / 本政策适用范围

This policy explains how Real Stock Sim collects, uses, stores, and shares information when you register, apply for membership, use the website, connect an Alpaca Paper account, or when the administrator connects and manually trades through a Charles Schwab live account.

本政策说明您在注册、申请会员、使用网站、连接 Alpaca Paper 账户，或管理员连接并通过 Charles Schwab 真实账户进行手动交易时，Real Stock Sim 如何收集、使用、保存和共享相关信息。

2. Information we collect / 收集的信息

Account and membership: name or display name, email address, verified-email status, account identifier, referral relationship, application note, membership type, approval status, and related administrative records.

账户与会员信息：姓名或称呼、邮箱地址、邮箱验证状态、账户标识、推荐关系、申请说明、会员类型、审核状态和相关管理记录。

Authentication and security: protected session identifiers, timestamps, security events, and audit records. Authentication is provided through Supabase. Real Stock Sim does not store your plaintext password.

身份验证与安全信息：受保护的会话标识、时间记录、安全事件和审计记录。身份验证由 Supabase 提供，Real Stock Sim 不保存您的明文密码。

Alpaca Paper connection: the selected Paper account identifier, granted scopes, connection status, encrypted OAuth access token, Paper balances, positions, orders, and related market or trading information needed to provide the Service. Real Stock Sim does not ask members to paste Alpaca API keys and does not collect bank funding information through this connection.

Alpaca Paper 连接信息：所选 Paper 账户标识、授权范围、连接状态、加密保存的 OAuth 访问令牌，以及提供服务所需的模拟账户余额、持仓、订单和相关行情或交易信息。Real Stock Sim 不要求会员粘贴 Alpaca API Key，也不会通过该连接收集银行入金信息。

Schwab administrator connection and manual trading: connection status, granted scopes, encrypted OAuth access and refresh tokens, masked account identifiers, balances, buying power, positions, order history, selected account suffix, manual-trading unlock state, order previews, idempotency keys, submitted or canceled order identifiers, status, and limited broker error details. This connection is restricted to the administrator. Real Stock Sim does not collect Schwab usernames, passwords, full account numbers, or bank funding instructions.

Schwab 管理员连接与手动交易信息：连接状态、授权范围、加密保存的 OAuth 访问令牌和刷新令牌、掩码账户标识、余额、购买力、持仓、订单记录、所选账户尾号、手动交易解锁状态、订单预览、防重复提交标识、所提交或撤销的订单编号与状态，以及有限的券商错误详情。该连接仅管理员可用。Real Stock Sim 不收集 Schwab 用户名、密码、完整账户号码或银行入金指令。

Service activity: strategy settings, simulated trades, saved state, system messages, feature use, and technical information required for operation, reliability, and abuse prevention.

服务活动信息：策略设置、模拟交易、保存状态、系统消息、功能使用记录，以及系统运行、可靠性和防止滥用所需的技术信息。

3. How information is used / 信息用途

Information is used to create and secure accounts, verify invitations and email addresses, administer memberships, provide market and Paper Trading features, display and manually operate the administrator’s separate Schwab live account, enforce account separation and order confirmation, prevent duplicate submissions, send transactional emails, diagnose failures, keep audit records, and improve reliability.

相关信息用于创建和保护账户、验证推荐关系与邮箱、管理会员、提供行情和 Paper Trading 功能、显示并手动操作管理员独立的 Schwab 真实账户、执行账户隔离与订单确认、防止重复提交、发送事务邮件、诊断故障、保留审计记录并提高系统可靠性。

4. Service providers / 服务提供商

Real Stock Sim uses service providers only as needed to operate the Service: Cloudflare for website hosting and server operation; Supabase for email-and-password authentication; Resend for transactional email delivery; Alpaca for market data, OAuth authorization, and Paper Trading; Charles Schwab for the administrator’s live-account authorization, data, and specifically confirmed manual orders; and OpenAI for restricted market-chart analysis functions. These providers process information under their own terms and privacy policies.

Real Stock Sim 仅在运行服务所需的范围内使用第三方服务：Cloudflare 用于网站托管和服务器运行；Supabase 用于邮箱密码身份验证；Resend 用于事务邮件发送；Alpaca 用于行情数据、OAuth 授权和 Paper Trading；Charles Schwab 用于管理员真实账户的授权、数据以及逐笔明确确认的手动订单；OpenAI 用于受限制的市场图表分析功能。这些服务商会依据其各自条款和隐私政策处理信息。

5. Sharing and sale / 信息共享与出售

Real Stock Sim does not sell personal information and does not use member information for third-party advertising. Information may be shared with the providers listed above, when required by law, or when reasonably necessary to investigate abuse, protect accounts, or defend the Service and its users.

Real Stock Sim 不出售个人信息，也不将会员信息用于第三方广告。信息只会在提供服务所需时与上述服务商共享，或在法律要求、调查滥用、保护账户以及维护本服务和用户安全时披露。

6. Cookies and sessions / Cookie 与会话

The Service uses a first-party, protected session cookie to keep you signed in and secure authenticated requests. It is not used for third-party advertising.

本服务使用第一方受保护的会话 Cookie，以维持登录状态并保护已验证的请求，不用于第三方广告。

7. Security and retention / 安全与保留

Reasonable technical and organizational safeguards are used, including server-side authorization, access separation, protected sessions, encryption of Alpaca and Schwab OAuth tokens at rest, session-level Schwab trading locks, expiring order previews, final confirmation, and idempotency controls. Schwab routes are restricted to the administrator, and Schwab automated trading is not implemented. No system can guarantee absolute security. Records are retained while needed to provide the Service, preserve security and audit history, resolve disputes, and meet legal obligations, then deleted or de-identified when reasonably practical.

本服务采用合理的技术和管理保护措施，包括服务器端权限校验、账户隔离、受保护的会话、Alpaca 和 Schwab OAuth 令牌静态加密、会话级 Schwab 交易锁、限时订单预览、最终确认和防重复提交控制。Schwab 路由仅对管理员开放，系统不实现 Schwab 自动交易。但任何系统都无法保证绝对安全。相关记录会在提供服务、保留安全和审计历史、解决争议及履行法律义务所需期间保存，并在合理可行时删除或去标识化。

8. Your choices / 您的选择

You may disconnect Alpaca or Schwab authorization, log out, request correction of account information, or request account deletion through the administrator. Some security, audit, or legal records may be retained where required or reasonably necessary. Authorization can also be revoked through the applicable provider’s account settings.

您可以断开 Alpaca 或 Schwab 授权、退出登录，或通过管理员申请更正账户信息或删除账户。法律要求或安全、审计确有需要的记录可能继续保留。您也可以在相应服务商的账户设置中撤销 Real Stock Sim 的授权。

9. Children / 未成年人

The Service is not directed to children. Do not connect an Alpaca or Schwab account unless you meet the applicable provider’s eligibility requirements and are legally able to authorize the connection.

本服务不面向儿童。除非您符合相应服务商的账户资格要求并能够依法作出授权，否则请勿连接 Alpaca 或 Schwab 账户。

10. Changes and contact / 政策变更与联系

This policy may be updated as the Service changes. Material updates will be posted here with a revised effective date. Privacy questions and account requests may be directed to the administrator through the communication channel used to provide your invitation.

本政策可能随服务调整而更新。重大变更会在本页公布并更新生效日期。隐私问题和账户请求可以通过收到推荐邀请时使用的沟通渠道联系管理员。