Privacy, in
plain English.

01 / SERVICE & CONTACT

Contact StratDuel

Service: StratDuel. For privacy questions, corrections, access to your information or deletion requests, contact stratduel@gmail.com.

The service runs on its operator-managed VPS hosted by Strato. The operator administers the application, its database and protected operational backups. Service providers process the information needed for the features described below.

02 / SIGN-IN

An account keeps your workspace separate

Username accounts. We store your username, an internal account identifier, creation/update times, a salted password hash and a hash of your recovery code. We do not store your plaintext password or account recovery code. No email address is requested for this sign-in method. If you contact us by email, we receive your address and message.

Optional X sign-in. When available and chosen by you, we request your X ID, handle, display name and profile image URL from X’s authenticated-user endpoint. These identify your X account in StratDuel. Your X password stays with X; we do not request it. A local account and an X account remain separate even if their usernames match.

X requires the users.read and tweet.read permissions for this identity lookup. StratDuel uses them for sign-in only: it does not read your timeline, post for you, request your email, access private messages or request ongoing access. The temporary X access token is used for the identity request and is not saved. Profile details refresh when you sign in again.

Your browser visits X for consent and contacts X’s image servers when displaying your profile image. X handles those interactions under its Privacy Policy ↗. Signing out of StratDuel ends this browser’s session. You can separately remove the app’s authorization in X connected-app settings ↗.

03 / YOUR WORK

Private testing, with optional AI help

We store the strategies you save, including their names, rules and any source prompt you choose to save. Backtests and background runs store their configuration, progress, simulated positions, events, results and relevant error states. Account identifiers connect this information to your workspace. Signing out does not stop a background run.

AI is an explicit action. When you request AI assistance or strategy interpretation, your submitted text and the selected timeframe where relevant are sent to OpenAI to draft trading rules. The app does not add account passwords, recovery codes, X credentials or wallet keys to that request. Do not put secrets in your strategy text. Review the draft before applying it. You can use presets or the manual rule editor without making an AI request.

These API requests disable OpenAI response storage. That setting is not a promise of zero retention by every service involved; see OpenAI’s API data controls ↗ and privacy information ↗. StratDuel records request dates, status and token usage for capacity limits. The usage table does not store your submitted prompt; a source prompt is retained if you save it with a strategy.

What visitors can see. Ordinary accounts, prompts, private strategies, wallet associations and runs are not automatically published. The homepage shows only founder-owned paper runs explicitly selected for publication and identified historical research. It does not select visitors’ runs by performance or account activity. If you create and share a challenge link or exported result, its included strategy details can be seen by its recipients.

04 / PUBLIC CHAIN DATA

Checking an address does not identify its owner

You can enter a public Solana address without signing in or connecting a wallet. It is sent to StratDuel and, once the official platform coin is configured, the configured Solana RPC provider to read public on-chain data. Successful observations may be reused for up to 30 seconds; expired in-memory entries are cleared during subsequent checks or on restart. They are not saved as an account or workspace link. The lookup depends on StratDuel and its RPC provider; it is not a fully trustless ownership or eligibility check.

If you choose optional wallet verification while signed in, the application checks a signed message and stores the verified address, verification time and any bot association you explicitly make. Pending verification messages include the address, website origin, a workspace identifier, nonce and expiry. A signature establishes control of an address, not your real-world identity or prize eligibility.

You can unlink the address from your workspace. That removes the application link; it cannot erase public blockchain history. We never ask for your seed phrase or private key. The current verification message does not authorize transactions or reward claims. Holder prizes and claims remain inactive until their separate requirements are met.

05 / ESSENTIAL STORAGE

Sessions, preferences and service protection

StratDuel uses secure, HttpOnly account-session cookies to keep you signed in. Sessions expire 14 days after sign-in. X sign-in also uses a short-lived cookie and browser-bound state that expire after 10 minutes. Signing out revokes this browser’s session; recovering a username account revokes all its previous sessions.

Your browser can retain account-specific editor drafts, the last selected run and tutorial preferences. Older preview users may also have a private workspace-access code in browser storage until they clear it. Save that code privately if you need to import the old workspace. Clearing browser storage does not delete server-side data.

We process network addresses and request activity to apply abuse limits and maintain service availability. Short-lived rate counters are held in memory or the application database; server diagnostics and backups support operation and recovery. StratDuel currently includes no advertising trackers or third-party analytics scripts. External services you choose to visit have their own practices.

06 / RETENTION

The current storage limits

• Accounts, saved strategies and verified wallet links: no automatic expiry is configured. Saved strategies can be deleted and wallet links can be removed in the product. Account deletion is handled through the contact route below.
• Completed or failed backtests: routine cleanup removes jobs more than 30 days after creation and limits stored history to the most recent 100 jobs across the service. Older results can therefore disappear sooner.
• Stopped or completed background runs: routine cleanup removes records more than 30 days after their last update, and retains at most 30 per workspace and 300 across the service. Active runs are excluded from this cleanup. The event table keeps the latest 500 events per run.
• Temporary authentication data: expired sessions, X sign-in states, wallet challenges and abuse counters are removed during cleanup. A wallet challenge expires after five minutes.
• Operational records and backups: AI usage counters and protected backups do not currently have an automatic expiry. A backup may contain earlier data after it has been removed from the live database. A deletion request must therefore also consider relevant backups and operational records.

Export results you want to keep. These storage limits are part of the beta and are not a promise that every result will remain available for the full period.