Privacy Policy

1. Who we are and what this covers

This policy explains how PM.finance ("the platform", "we") collects, uses, shares and protects your personal data when you use this platform. Together with the Terms of Service it forms the agreement between us.

For anything in this policy, write to app@pm.finance.

1.1 What this policy does not cover

This policy applies to this platform only. The platform links and redirects to third-party sites and services — Google / GitHub sign-in, payment pages, and the pages of the clearing and custody partner among them. What you do on those sites is governed by their own privacy policies, not this one, and a link does not mean we endorse or have reviewed them. Please read their policies before you use them.

1.2 Terms used

• De-identification — technical processing that makes personal data unable to identify a specific individual without additional information. De-identified data is still personal data.
• Anonymisation — technical processing that makes personal data unable to identify a specific individual and impossible to reverse. Anonymised data is no longer personal data.
• Pseudonym — the codename this platform generates or accepts for external display of a strategy or an entrant (a strategy codename, a contest alias), kept separate from the real identity.

2. What we collect

2.1 Information you give us

• Account information: email address, password (we store only an irreversible hash, never the plaintext), display name, avatar, language and time-zone preferences.
• Wallet sign-in: when you sign in with a digital wallet we receive your wallet address — we never touch your private key or recovery phrase.
• Contest registration: team name, team size, year founded, region, contact email and phone number, strategy short name, and the supporting files you upload.
• What you create in the workbench: what you enter, and what the workbench produces for you — strategies, backtests and reports. We keep it so you can pick up where you left off, and so a published backtest can be reproduced. By default only you can see it — who may access it, and in what circumstances, is set out in "Internal access".
• Settlement details (collected only where needed): bank name, account type and account holder.
• Qualification and identity documents: entering a contest or applying for certain statuses may require you to upload supporting documents, including identity documents, business licences and proof of enrolment. These files are stored on our servers, no public link is ever issued for them, and they can only be read by authorised reviewers through the admin console.

2.2 Information we collect automatically

• Sign-in and session information: sign-in time, IP address, browser or client identifier (User-Agent), session lifetime.
• Usage records: function calls and points consumption, payment records, audit logs.

2.3 Information we get from third parties

Some information does not come from you directly, but from a third party when you use the corresponding function:

• Third-party sign-in: when you sign in with Google or GitHub, that provider returns the account's unique identifier and email address to us.
• Identity verification results (only where that flow is enabled): verification for some flows is carried out by a specialist provider. In that case your document images and document number are submitted directly to that provider, which collects and stores them; what we receive back from it is the outcome (pass or fail) and an applicant identifier that contains no document content. Our own database does not store your document number.
• Screening results: we obtain and keep the conclusions of compliance screening — whether a sanctions list was matched, whether the region is high-risk, a risk score and any flagged terms — not the document content the screening was based on.
• Information returned by the clearing and custody partner: when you connect your account to that partner, it returns its own user identifier for you, your verification status there, and, where it provides one, the email address associated with that account.

2.4 Whether you have to provide this data

Most of what we collect is required to provide the service, and without it the corresponding function cannot work:

• Required to have an account: an email address or a third-party sign-in, or a wallet address.
• Required to enter a contest: the registration details, and any documents a reviewer asks for. Without them the entry cannot be assessed.
• Required by law before certain payouts: identity verification. Without it we cannot pay a prize.
• Optional: your avatar, display name, time-zone preference, and settlement details until you request a payout.

3. Cookies and local storage

A cookie is a small piece of information a site stores in your browser when you visit; local storage is another place the browser offers, the difference being that it is not sent back to the server with every request. We use both only for running the service and remembering your interface preferences — we set no advertising cookies and use no third-party analytics or behavioural profiling.

They are used for: remembering the interface language you chose, keeping you signed in, restoring your signed-in state straight after a reload, remembering your interface preferences (whether the sidebar is collapsed, which prompts you dismissed), and completing the Google / GitHub sign-in redirect. What holds your signed-in state is cleared when you sign out; the language cookie lasts a year; your interface preferences, and a marker recording that an account has signed in on this device (no account details — it only decides whether the entry button reads "Log in" or "Sign up"), stay until you clear your browser data.

How to refuse or clear them: you can refuse or delete cookies and clear local storage in your browser settings, and signing out clears what holds your signed-in state. Note that the sign-in part is required for the service to work — once cleared you will need to sign in again, and your language and interface preferences return to their defaults.

Cookies set by third parties are outside this policy: when you are redirected to a Google / GitHub sign-in page, a payment page or a page of the clearing and custody partner, any cookie that party sets on its own domain is governed by its privacy policy, and we can neither access nor control it.

4. Why we use your data, and on what legal basis

Where we rely on legitimate interests, we have weighed them against your rights and use the least intrusive means available; you may object at any time (see "Your rights").

We do not sell your personal data.

5. Automated processing and AI

5.1 Automated decisions about your strategy

The platform scores strategies automatically. A deterministic calculation over your backtest results produces a grade, and a model writes a short explanation of that grade. The grade and the explanation are shown publicly next to your strategy and affect where it ranks.

• What it is based on: performance statistics computed from your own backtest run — return, risk and stability measures. It does not use your identity, your location, or anything you wrote to the AI assistant.
• What it affects: the ranking and visibility of the strategy, not your access to your account or to the product.
• Your rights: you can ask us to explain how a grade was reached, contest it, and have a person review it. Write to app@pm.finance.

5.2 AI processing

When you use the AI strategy workbench, the conversation, the strategy code and the surrounding context are sent to the large-model service that provides inference for this platform, to generate replies and analysis. Recipients of that kind are listed under "Who can see your information".

Please do not type identity document numbers, bank account numbers, passwords, wallet private keys or other people's personal information into the conversation.

6. Who can see your information

There are three routes by which someone else sees your information: authorised people inside our organisation, the third parties that provide services to us, and the recipient in a transfer of the business. What is displayed publicly about a strategy or a contest entry is set out separately in "What is published about a strategy".

6.1 Internal access

When carrying out their review duties, operations and compliance staff see unmasked information in the admin console: the supporting files you uploaded, your contact email and phone number, and the results and materials of identity verification where applicable. Access is limited to authorised people, granted by role, and recorded in the audit log.

Strategy content is not part of this. Your strategy code, parameters and configuration are private by default and platform staff have no right to view them; where access is genuinely required to investigate a technical problem, your express authorisation must be obtained in advance and the access is recorded in the audit log. Your workbench conversations with the AI assistant are not part of it either: no screen in the admin console renders them, and reviewers of a contest entry see a strategy's name and version number, never its code, parameters or conversations. See "Strategy confidentiality" in the Terms of Service.

6.2 Third parties and service providers

We share personal data, only as far as needed, with the categories of recipient below. They do not all stand in the same relationship to us:

• Providers of technical and operational support (email, model inference, cloud and infrastructure) process the data on our instructions and are bound by confidentiality and data-processing terms;
• Identity-verification providers, payment processors, the clearing and custody partner and Google / GitHub may, in meeting their own legal or contractual obligations, process your data in their own right, in which case their own privacy policies apply;
• Anything written to a public blockchain is publicly visible once it is on chain, and no one can withdraw it or limit how it spreads.

We also disclose personal data where the law, legal process or a competent authority requires it, or where it is necessary to protect the platform's or users' rights.

6.3 Transfers of the business

We will not transfer your personal data to a third party except with your prior express consent, where the law requires it, or in a merger, division, restructuring, acquisition or sale of assets, where your data may transfer as part of the transaction. In that case we will tell you beforehand who the recipient is and how to contact them, and require them to remain bound by this policy; a recipient wanting to change the purpose must obtain your consent afresh.

7. Cross-border transfers

We and the third parties that provide services to us are not all in the same country, so your personal data moves between them — the recipients set out in "Who can see your information" sit in different jurisdictions.

Where such a transfer happens, we rely on a lawful transfer mechanism: an adequacy decision where one exists, and otherwise standard contractual clauses with the recipient, or the equivalent instrument its jurisdiction recognises, requiring protection no lower than this policy. You can ask us for a copy of the safeguards in place at app@pm.finance.

If you are in the European Economic Area, the United Kingdom or Switzerland, those mechanisms apply equally to transfers of your personal data out of that area.

8. What is published about a strategy

This is the thing this platform most needs to be clear about: what other people see once you are listed or enter a contest.

Shown publicly:

• The strategy codename or contest alias — a pseudonym you submit when listing, generated by the platform if you do not, and never your real name or your organisation's;
• Market, style and traded-asset labels, and the strategy description you submitted;
• Your contest group, and a contact-free team summary (team size, year founded, region);
• Performance metrics: annualised return, Sharpe ratio, maximum drawdown, and the rest of the statistics recorded for the published backtest run;
• The equity curve (a series of about 500 sampled points);
• Rating, rank, the AI-written explanation of the score, the score for each dimension it is built from and that dimension's weight, and the evidence tier the rating was capped at;
• Whether the strategy is self-verified, and the date it was listed.

Never shown publicly:

• Your strategy source code, parameters and configuration;
• Individual fills and live positions — public pages never emit trade details or current holdings;
• Your real name, organisation, phone number, email address or identity documents;
• Your workbench conversations with the AI assistant.

Note that the strategy description and team summary are written by you and shown verbatim, so do not put anything in them you would not want published. What a public page shows is the version you submitted and had approved when you applied to be listed — editing the description in the workbench afterwards does not change the public page until it is re-reviewed.

De-identification is enforced on the server: public endpoints emit only the pseudonym fields, and real names never reach the browser in any form. Attempting to identify the real person behind a pseudonym breaches the Terms of Service.

Before you and a capital provider reach a compliance stage that requires your identity to be disclosed, we do not disclose it to them; where you do reach that stage, we will obtain your consent separately.

9. Your rights

You may ask to access, correct, export or delete your personal data; restrict or object to processing; withdraw consent you gave earlier; and ask for a human review of an automated decision (see "Automated decisions about your strategy"). You may also close your account at any time.

Write to app@pm.finance. To protect your account we will verify your identity before acting on a request, and will normally respond within 30 days; where a request is complex or there are many of them, we will tell you within that period how much longer we need and why.

Please note:

• Withdrawing consent does not affect processing already carried out on the basis of it, and after withdrawal we cannot continue to provide the functions that depend on it.
• Records we are required by law to keep — anti-money-laundering records, for instance — may not be deletable on request.
• After an account is closed, its data, entitlements and history cannot be restored.
• Deletion from backups may have to wait for the next backup rotation.

If you are not satisfied with our answer, you may complain to the supervisory authority with jurisdiction.

10. How long we keep it, and how we protect it

10.1 How long we keep it

We keep your personal data for as long as we are providing the service to you, and afterwards only for as long as we still need it — to meet legal, tax and anti-money-laundering obligations, to prevent fraud and abuse, to resolve disputes, and to enforce our agreements. Where the law sets a minimum period for a particular record, that period governs.

In practice that means:

• Account information: kept while the account exists; deleted or anonymised within a reasonable period after you close it. An account closed for long inactivity (see "Long-inactive accounts" in the Terms of Service) is treated the same way.
• What you create in the workbench: kept while your account exists, so that your work and its history are there when you come back. We do not currently delete it on a schedule.
• Identity verification and money-related records: kept for the period the applicable financial regulation requires, which is longer than the life of the account.
• Audit and fund-movement records: append-only and not modifiable.

Once a retention period ends we delete your personal data or anonymise it. After you close your account we no longer use your personal data for commercial purposes.

10.2 How we protect it

Our security measures follow the principles of least privilege and defence in depth. They include:

In transit and at rest

• HTTPS is enabled across the site, so data between you and the platform is encrypted in transit.
• Account passwords are stored only as salted hashes (argon2id, configured to currently recommended parameters). We do not store plaintext passwords and cannot derive yours from what we store.
• Two-factor authentication secrets are encrypted before they are written to the database, and the encryption key itself is not held in the code base.

Access control and audit trail

• Permissions are checked by the backend on every request; the frontend is never the authority. Roles that can see unmasked information are granted individually.
• Changes to personal data, grants of access and other designated sensitive operations are written to an audit log traceable to a specific account and time.
• Anyone who handles personal data is granted the minimum access needed and is bound by confidentiality obligations.

The files you upload

• Storage paths are generated on the server; the file name you submit never becomes part of a path.
• No public link is issued for them, and they can be read only by authorised reviewers through the admin console's download channel.

Abuse prevention

• Sign-in, verification-code sending and similar sensitive entry points are rate-limited by IP, by account and by the combination of the two, with a minimum interval between requests.
• Exceeding a limit returns an increasing wait rather than locking the account — a lockout is itself usable as a denial-of-service against a specific user.

These measures reduce risk substantially, but no system can be guaranteed absolutely secure. If a security incident does occur, how we handle and notify it is set out in the next section.

10.3 Handling and notification of security incidents

If personal data is or may have been leaked, altered or lost, we will begin incident response immediately, assess the scope and take remedial action; notify the competent authority within the time the law requires; and tell affected users promptly by email or in-app notice, setting out what happened, the likely impact, what we have done, and what you can do to protect yourself.

11. Changes to this policy

When this policy is updated we will change the version number and effective date and publish them on the platform. Where a change is material we will notify you before it takes effect, by prominent notice on the page or by email, and where necessary ask you to consent again. Material changes include, among others:

1. a significant change in the service that alters the purpose, categories or manner of processing;
2. a change in the main recipients of shared, transferred or publicly disclosed data;
3. a significant change in your rights over the processing, or in how you exercise them;
4. any other change that may significantly affect your interests in your personal data.

12. Contact us

For any question, request or complaint about this policy, write to app@pm.finance.