Privacy Policy

Effective 2026-09-15Up Your Game LLCSharjah Media City (Shams)

Up Your Game LLC operates Lemoney. This policy explains what personal data we collect, why, who else handles it, how long we keep it, and what you can ask us to do with it. It applies to the website, the Lab, and any API or MCP server we offer.

The short version

We keep your email address, your plan, the portfolios you save, and records of how you use the product. If you publish a portfolio, it is public, with your public name beside it. Payments are handled by Stripe, and we never see your card number. We use one analytics tool, PostHog, hosted in the EU, with everything you type masked. No advertising trackers. We do not sell your personal data or share it for advertising.

1. Who is responsible 2. What we collect 3. What is public 4. What we do not do 5. Why we use it, and our legal basis 6. Cookies and similar storage 7. Who else handles it 8. International transfers 9. How long we keep it 10. Your rights 11. Security 12. Children 13. Changes 14. Contact and complaints

1. Who is responsible

The data controller is Up Your Game LLC, registered in Sharjah Media City (Shams), Sharjah, United Arab Emirates. Privacy contact: privacy@lemoney.money.

2. What we collect

Account

Your email address, which you give to sign up and which we use for sign-in codes and service notices. Also your plan, when the account was created, your public name if you have published, the site or link you arrived from, and any note we make about the account.

Your portfolios

The portfolios you save: their names, the instruments and settings you chose, whether each is private or public, and the results computed for them. We also count how many optimizations you run each month, to apply your plan’s limits.

What you enter in the Lab

Tickers and settings you enter are sent to our engine to compute results. Unless you save a portfolio, they are not stored against your account.

Payments

If you subscribe, Stripe collects your card and billing details. We receive and keep your Stripe customer and subscription identifiers, plan, subscription status and dates, and the invoice and tax details tax law requires. We never receive or store your full card number.

Support messages

If you use the Ask panel or email us, we keep your messages, our replies, the email address you give, and the page you asked from.

API keys, if you use them

A one-way hash of each key and a short prefix for display, never the key itself, plus when it was created, last used and revoked. For each request, the endpoint, status, duration and time, to enforce quotas.

Analytics and session replay

The pages you visit, when, the referring page, your browser, operating system, and approximate country and region inferred from your IP address. We also record a replay of the interface as you use it, to find where pages confuse people. Everything you type is masked in your browser before it is sent. Before you sign in this is tied to a random identifier. After you sign in it is tied to your account.

Technical data

Our hosting providers see IP addresses and request details in their operational logs, for security and abuse prevention. To stop one address flooding the Lab, our servers count requests per IP address for about a minute in memory, and never write that to a database.

3. What is public

Portfolios are private by default. When you publish one, anyone on the internet can see its name, its instruments, weights, settings and results, and the public name of the person who published it. You choose that name the first time you publish, or leave it blank and we generate a random one. It is never taken from your email address. A published portfolio can be copied, linked and indexed by search engines. Making it private or deleting it removes it from Lemoney, but cannot recall copies others have already made. Do not put personal information in a portfolio name.

4. What we do not do

We do not sell personal data, and we do not share it for cross-context advertising.
No advertising pixels, ad networks or cross-site tracking.
No keystrokes or form values in session replay.
No device fingerprinting, and no IP addresses stored in our own database.
We do not buy personal data or enrich your record from outside sources.
No automated decisions that have legal or similarly significant effects on you. Plan limits are applied automatically, but they are the same for everyone on a plan.
We do not ask for your finances, holdings or identity documents, and you should not send them. The Lab needs none of it. Please do not send us special-category data such as health or religious information.

5. Why we use it, and our legal basis

We process personal data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where the EU or UK GDPR applies, we rely on the legal bases below.

Provide the Service

Sign you in, save and publish your portfolios, apply plan limits, and run your account. Basis: performance of our contract with you.

Billing and tax

Take payment, manage subscriptions and keep records. Basis: contract, and legal obligation.

Support and service notices

Answer your questions, and send sign-in codes, security, billing, terms and service notices. Basis: contract, and legitimate interests in running the Service.

Security and abuse prevention

Detect attacks, scraping, account sharing and limit circumvention, and enforce our Terms. Basis: legitimate interests in protecting the Service, its users and our data licences.

Improving the product

Count visits, see which channels bring people, and watch masked replays to fix what is confusing. Basis: legitimate interests, balanced by masking every input and keeping the data out of advertising. You can object at any time, and browsers sending Global Privacy Control or Do Not Track are excluded automatically.

Marketing email

Only if you opt in, with an unsubscribe link in every message. Basis: consent, which you can withdraw at any time.

Legal

Comply with law, respond to lawful requests, and establish or defend legal claims. Basis: legal obligation, and legitimate interests.

6. Cookies and similar storage

All are first-party. None are for advertising.

Sign-in session

Set by our authentication provider to keep you signed in. Strictly necessary. Clearing it signs you out.

Arrival channel

Records which site or link brought you, for up to 30 days, and is deleted when you sign up.

Support thread

A random token, kept for up to a year, so you can return to a conversation in the Ask panel without an account. We store only a hash of it.

Analytics

A PostHog cookie and browser storage entry holding a random identifier, so repeat visits count as one person. Not set if your browser sends Global Privacy Control.

7. Who else handles it

Supabase

Authentication and database hosting. Your account, portfolios, usage and support records.

Stripe

Payments, subscriptions, invoices and tax. Your card and billing details, and your email. Stripe is also an independent controller of some payment data, for fraud prevention and its legal duties, under its own privacy policy.

Resend

Delivery of support replies and service email. Your email address and the message.

PostHog

Analytics and session replay, on EU infrastructure. Page views, masked replays, your account identifier and email once you sign in, and your IP address.

Vercel

Website hosting and delivery. Request data, including IP address, in its logs.

Fly.io

Hosting for the engine that computes results. The instruments and settings you enter, without your name or email.

Cloudflare

Storage and delivery of files and exports. No account data.

GitHub

Source code and scheduled data builds. No customer personal data in normal operation.

Each processes personal data under a written agreement and on our instructions. We update this list when we add a provider. We also disclose data when the law requires it, to protect our rights, users or the Service, and to a buyer or successor if the business or its assets are transferred, in which case this policy continues to apply to your data.

8. International transfers

We operate from the United Arab Emirates, and our providers run infrastructure elsewhere, including the United States and the European Union. Where EU or UK GDPR data is transferred outside those areas, the transfer relies on Standard Contractual Clauses or an equivalent safeguard in the provider’s agreement. Where the PDPL applies, transfers are made as that law permits.

9. How long we keep it

Account, email and portfolios: while the account exists, then up to 90 days after it is closed, so an accidental closure can be undone.
Payment and tax records: as long as tax law requires, currently five years from the end of the tax period.
Support messages: up to 24 months after the last message, even if the account is closed, as the record of what was asked and answered.
API key hashes: until revoked, then up to 12 months.
API request logs: 13 months. Monthly totals for as long as the account exists.
Session replays: 90 days.
Analytics events: 12 months. Totals with no identifier may be kept indefinitely.
Legal holds: anything needed for a dispute, investigation or legal obligation, until it is resolved.

10. Your rights

Depending on the law that applies to you, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format, and you can withdraw any consent you gave. Residents of some US states have similar rights to know, delete and correct, and to opt out of sale or sharing, which we do not do. We will not treat you differently for using any of these rights.

Email privacy@lemoney.money from the address on your account. We reply within 30 days, or tell you if we need longer as the law allows. It is free unless a request is clearly unfounded or excessive. We may need to verify your identity first. Some data must be kept for legal reasons, and if so we say which and why.

Closing your account deletes your account record, email and saved portfolios, including published ones, and we delete your analytics profile and replays. Records we must keep, such as invoices and support correspondence, are kept for the periods in section 9.

11. Security

Traffic is encrypted in transit. Sign-in is by one-time email code, so there is no password to steal. API keys are stored only as hashes. Database access is limited to the application and the operator. No system is perfectly secure, and we cannot guarantee that yours will not be accessed without authorisation. If a breach affects your personal data in a way that creates a risk to you, we will tell you and the relevant authority as the law requires.

12. Children

The Service is not for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, email privacy@lemoney.money and we will delete it.

13. Changes

We update this policy when what we do changes. The effective date at the top shows the current version. We will email account holders before a material change takes effect.

14. Contact and complaints

Up Your Game LLC, Sharjah, United Arab Emirates. Privacy contact: privacy@lemoney.money.

Please contact us first, so we can put it right. If you are not satisfied, you can complain to the UAE Data Office, or, where the EU or UK GDPR applies, to the data protection authority where you live or work.

Version effective 2026-09-15. See also the Terms of Service.