Privacy Policy

This policy explains what tyca collects, why, and your choices. By using tyca.io you agree to this policy.

1. What we collect

• Account details — your email and display name when you sign up. If you sign in with Google or GitHub, they share your email and basic profile (name, avatar) with us to create the account.
• Gameplay — your trades, positions, parlays, coin balances, watchlists, price alerts, referral links, comments, streaks, and leaderboard standings.
• Technical — standard request data (IP address, device/browser type) needed to run, secure, and rate-limit the Service.
• Notifications — if you enable push notifications, your browser’s push subscription.
• Correspondence — messages you send us (support, disputes, feedback).

We do not collect payment information — tyca is free and involves no money.

2. How we use it

To run the game: create your account, record your trades and positions, compute balances and leaderboards, keep you signed in, send notifications you asked for, prevent fraud and multi-accounting, and keep the Service secure. We don’t sell your personal data.

3. Cookies & local storage

We use a small, fixed set of cookies and browser storage:

• lf_access — an HttpOnly session cookie holding your login token. JavaScript cannot read it; it is what keeps you signed in.
• lf_authed — a non-sensitive hint cookie that tells the page a session exists (it holds an expiry timestamp, not a credential), so the site can render your logged-in state without a flash.
• Local storage — interface preferences (e.g. dismissed banners, display settings) and your analytics consent choice.
• Analytics cookies — set by Google Analytics and, when we run ad campaigns, the Meta Pixel, as described in section 4; in the European Union these are set only after you consent via the analytics banner.

None of these are sold or used to build advertising profiles of you; the Meta Pixel is used only to measure whether our own ads work.

4. Analytics

We use Google Analytics to understand how the site is used (pages visited, approximate location, device type) so we can improve it. For visitors in the European Union, analytics loads only after you accept the analytics banner, and you can decline it entirely. Everywhere, you can opt out with the Google Analytics opt-out browser add-on. Google processes this data under its own terms. When we run ad campaigns on Meta platforms (Facebook, Instagram), the Meta Pixel measures whether those ads lead to sign-ups; it loads under the same consent rules as Google Analytics and can be declined the same way. We do not sell data or run third-party ad networks on tyca. Like most sites, we do not respond to browser “Do Not Track” signals.

5. Third parties

We rely on a small number of providers to run tyca: our hosting provider (servers and databases), Google and GitHub for optional sign-in, an email delivery provider for account emails, Google Analytics and the Meta Pixel (above), and third-party sports and market data sources (e.g. match scores, price feeds, team crests and flags). These providers process data on our behalf or under their own terms. Public parts of your profile — display name, avatar, trades on the public tape, and leaderboard standing — are visible to other users by design, and the same already-public information (for example a leaderboard placing or a notable settled call, with your display name) may occasionally be featured on tyca’s official social channels (e.g. X, Instagram). We never post your email or anything not already public on the site.

6. Data retention

We keep your account data while your account is active. You can delete your account yourself in Settings (deletion is scheduled with a 7-day grace window during which you can cancel by logging back in or via the emailed link), or request deletion by contacting us (see below). One honest caveat: the exchange runs on an append-only, tamper-evident ledger (see our Transparency page) whose records cannot be edited or deleted without breaking its integrity guarantees — so when you delete your account we remove or anonymize your personal identifiers (email, display name), while the anonymized ledger and trade rows are retained.

7. Your rights

Depending on where you live (e.g. GDPR in Europe, CCPA in California), you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. Contact us and we’ll honor these within the limits described in section 6. We don’t discriminate against you for exercising them.

8. Children

tyca is not directed to children under 13, and we don’t knowingly collect their data. If you believe a child has provided us data, contact us and we’ll remove it.

9. Where data is processed

tyca is operated from where our hosting provider runs its servers; your data may be processed there and by the providers above in their own regions. Wherever it is processed, this policy applies.

10. Security

We use reasonable technical safeguards — encrypted connections, hashed credentials, access controls, and a tamper-evident ledger — but no online service can guarantee perfect security.

11. Changes

We may update this policy; we’ll revise the date above when we do.

12. Contact

Privacy questions or requests: [email protected].