← Refract Funding

Privacy Policy

Last updated August 28, 2026.

This Privacy Policy explains how Refract Enterprises Inc., the Delaware corporation that owns and operates Refract Funding and refractfunding.com ("Refract Funding", "we", "us", or "our"), collects, uses, discloses, and retains personal information in connection with our website, simulated-trading service, competitions, paid funded accounts, affiliate programs, Discord community features, payouts, and support (collectively, the "Service"). For privacy questions or requests, email support@refractfunding.com.

This policy should be read with our Terms of Service and Risk Disclaimer. It covers personal information we control; third-party services have their own privacy notices.

Information we collect

Account and contact information. We collect your email address, display name, age-of-majority attestation, authentication method, and, if you choose to provide one, phone number. Email/password accounts use a salted password hash; we do not store the password itself. We also store email and phone verification status, password-reset and verification-token records, account creation time, opaque session tokens, and the timestamp and document versions associated with your legal acknowledgement during interactive authentication, including sign-in, signup, or password reset when that flow signs you in.

Google sign-in information. If you use Google sign-in, we receive the limited profile data permitted by the "openid email profile" scopes: your Google account identifier, verified email address, display name, and profile-picture URL. We do not receive your Google password.

Discord and community information. If you link Discord, we receive your Discord user identifier and username and record when the account was linked. We may create and associate a personal invite code with your account. To administer invite rewards and prevent repeat claims, our Discord bot may process member identifiers, join times, roles, invite codes and usage, and related membership events for people in the Refract Funding Discord server. We keep a record of Discord identities and members that have already participated in the reward program, as described under "Retention and account deletion."

X account and repost-reward information. If you link X, we receive your immutable X account identifier, username, display name, and the time of linking; we do not receive your X password. To administer approved repost rewards, we process identifiers and timestamps for native reposts of eligible posts from the official Refract Funding X account, the associated original-post identifiers, current visibility or deletion status, qualification decisions, and reward-ledger records. We do not ask for permission to post, repost, follow, or otherwise modify your X account.

Simulated-trading and program activity. We record your simulated balances, positions, orders, fills, prices, fees, volume, realized and unrealized values, combinations, perpetual positions, settlements, account ledger, competition score and rank, funded-account purchases, funded-account activity, rule breaches, risk-control events, payout eligibility, payout requests, and related timestamps. Anonymous visitors may receive a per-browser demo account, and its activity is associated with that browser by cookie.

Public profile information. Signed-in accounts have public leaderboard and profile features. Depending on your activity, we publicly expose your Refract Funding user identifier, display name, avatar, linked Discord or X username, join date, rank, simulated return and realized profit and loss, fees, volume, win rate, trade count, open positions, combinations, fills, and trade history. We do not publish your email address, phone number, password hash, payment details, or payout destination. Public responses may be cached briefly.

Purchase and payment information. For card payments, MIDsource's gateway-hosted Collect.js fields collect and tokenize your card number, expiration date, and security code directly. Refract Funding receives a single-use payment token, not those raw card details, and does not store your full card number or security code. We process any cardholder name and billing postal code you enter long enough to send them to the gateway for payment verification. For cryptocurrency payments, NOWPayments collects information such as the paying wallet address, chosen currency, transaction identifiers, and amounts on its hosted checkout; Refract Funding does not receive your wallet private keys. We store order and payment identifiers, processor and transaction references, selected tier, amount, currency-equivalent internal amount and any account credit, payment and refund or dispute status, timestamps, the legal acknowledgements and document versions accepted at checkout, any affiliate attribution or discount, and the funded account associated with the purchase.

Payout, identity, and tax information. If you request or become eligible for a competition, funded, affiliate, or other payout, we may collect payout-method and destination details such as a blockchain network and wallet address, payout status, transaction hash, and disbursement records. We or a provider may also collect your legal name, address, date of birth, government identification, tax forms or identifiers, identity or legal-eligibility screening results, and other know-your-customer information when needed to verify eligibility, comply with law, or make a payment. We do not require all of this information merely to browse the Service.

Affiliate information. If you follow an affiliate link, we collect the referral code, record a click, and may attribute a later signup or purchase to that affiliate. If you apply to or join the affiliate program, we collect your application, X/social handle, description of your content, affiliate code, referral and commission activity, payout requests, and wallet address. A referring affiliate may see limited purchase attribution, such as a masked referred-user name and commission amount or status; we do not provide the affiliate with your email, payment-card details, or trading credentials.

Communications. We collect messages and contact details when you contact support, apply to a program, respond to us, or otherwise communicate with Refract Funding. We record whether an account email or phone has been verified; communications providers process message delivery information under their own notices.

Device, network, and security information. Our servers and service providers process IP address, request time, requested route, browser or device information sent in standard HTTP headers, referring page, response and error information, and similar logs needed to deliver and secure the Service. We use IP addresses for rate limiting, abuse prevention, security review, and Cloudflare Turnstile verification. An IP address can indicate an approximate country or region, but we do not request precise GPS location.

How we collect information

We collect personal information:

  • from you, when you create an account, trade in the simulation, buy a funded account, link an account, apply to a program, provide a payout destination, or contact us;
  • automatically, through cookies, browser storage, server requests, logs, and your use of the Service;
  • from providers, including Google, Discord, NOWPayments, communications, identity-verification, anti-abuse, and payout providers; and
  • from public and third-party sources, including Kalshi and Polymarket market data and public blockchain records. Market data is generally not personal information about you.

How we use information

We use personal information to:

  • create, authenticate, secure, and support accounts and demo sessions;
  • operate the simulator, public profiles, leaderboards, competitions, funded accounts, affiliate and invite programs, rule enforcement, and payouts;
  • process purchases, discounts, refunds, disputes, commissions, payout requests, and transaction records;
  • verify age, identity, account ownership, location, tax status, fair play, and other legally required eligibility;
  • detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
  • send verification, password-reset, security, account, purchase, program, and support communications;
  • send marketing and promotional communications about Refract Funding — such as product news, competitions, promotions, and offers — where permitted by applicable law and subject to any consent that law requires. You can opt out at any time through the unsubscribe link in a marketing message or by emailing support@refractfunding.com. Opting out of marketing does not stop the service communications described above;
  • diagnose errors, monitor reliability, analyze aggregate use, and improve the Service;
  • comply with law, enforce agreements, establish or defend legal claims, and protect people and the Service; and
  • complete a financing, merger, acquisition, reorganization, or sale involving the Service.

We do not use personal information to make recommendations for real-money trading. We use Vercel Web Analytics to measure aggregate site traffic. It does not use third-party cookies and does not collect identifiers that track or cross-check visitors across other applications or websites: visits are counted with a temporary hash of the incoming request that is automatically discarded within 24 hours, and the recorded data (page URL, referrer, coarse geolocation, device and browser type) is anonymous and used for aggregated statistics only.

We also use the Meta Pixel, an advertising-measurement tool from Meta Platforms, Inc., on our production website, together with Meta's Conversions API. The pixel tells us whether our Meta ads led to a visit, an account, or a purchase and lets Meta measure our ad performance and build audiences for our advertising. When the pixel loads, Meta receives your IP address, browser and device information, the pages you visit and when, the Meta cookie identifiers described under "Cookies and browser storage," and conversion events: that an account was created, that a checkout was started, and that a purchase was completed, with the account tier and the amount paid. When a purchase is confirmed, our servers also send Meta the same purchase event through the Conversions API so it is counted even if the pixel was blocked or the payment confirmed after you left the page. That server event carries the amount and tier, the purchase reference, the IP address, browser identification, and Meta cookie identifiers recorded when you checked out, and hashed (SHA-256) versions of your email address, phone number, name, country, and postal code where we hold them. Meta uses these hashed values only to match the purchase to a Meta account and then discards them under its own privacy policy; we never send Meta your unhashed contact details, password, or trading activity. Meta account holders can manage how Meta uses this data in their Meta ad preferences.

We also use the X Pixel, an advertising-measurement tool from X Corp., to determine whether ads on X led to a site visit or completed account registration. When enabled, the X Pixel receives your IP address, browser and device information, visit time, X cookie or ad-click identifiers, and a completed-signup event containing a pseudonymous conversion reference. We configure the pixel to hide the page location and do not send X your email address, phone number, password, trading activity, checkout activity, purchase activity, or payment information. X handles this information under its privacy policy.

The Meta and X pixels do not load, and no related browser conversion event is sent, for browsers that send the Global Privacy Control opt-out signal. Our servers also send Meta no purchase conversion for those browsers. You can opt out in the other ways described under "Your choices and privacy rights."

Legal bases for EEA and UK processing

If European or UK data-protection law applies, our legal bases are:

  • contract, to create and operate your account, provide requested features, process a funded-account purchase, apply program rules, and handle a payout request;
  • legitimate interests, to secure and improve the Service, prevent abuse, maintain public competition features, administer affiliate and invite attribution, communicate with you, and protect legal rights, balanced against your rights and expectations;
  • legal obligations, including payment, accounting, tax, identity, eligibility, consumer, and law-enforcement obligations that apply to us; and
  • consent, where the law requires it, such as for optional marketing. You may withdraw consent at any time without affecting earlier processing.

Automated calculations and review

Automated rules calculate simulated fills and balances, leaderboard rank, rule breaches, funded-account breach outcomes, and preliminary funded and payout eligibility. These rules are described in the Program Rules. Funded activation and payout requests may also receive human eligibility, fair-play, risk, or error review. If you believe an automated result is wrong, contact support@refractfunding.com to request review. We do not use personal information for unrelated credit, employment, housing, insurance, or similar eligibility decisions.

Cookies and browser storage

We use the following cookies and storage technologies. Blocking them may prevent sign-in, account persistence, referrals, or workspace features from working.

  • pp_auth is an HTTP-only signed-in session token that lasts up to about 30 days and may be invalidated earlier for security, account, or legal-version changes.
  • pp_session is an HTTP-only identifier for an anonymous browser demo account that lasts about one year and is refreshed as the demo account is used.
  • pp_oauth_state, pp_oauth_return, pp_oauth_age, pp_oauth_legal, and pp_oauth_phone are HTTP-only values used for Google sign-in security, return routing, and carrying an age confirmation, legal acknowledgement, or optional phone through the sign-in flow. They last about 10 minutes.
  • pp_discord_state and pp_discord_return are HTTP-only values used to secure Discord linking and return you to Refract Funding. They last about 10 minutes.
  • pp_ref stores an affiliate referral code for up to 30 days. Unlike the cookies above, it is readable by Refract Funding's page code so the code can be shown and applied at checkout.
  • Local storage remembers your open workspace tabs and active tab. Session storage temporarily remembers a pending trade during sign-in and avoids counting the same affiliate click repeatedly in one browser session.
  • pp_admin is an HTTP-only 12-hour cookie used only by authorized Refract Funding administrators; it is not set for ordinary users.
  • _fbp and _fbc are set by the Meta Pixel described above when it loads. _fbp identifies your browser to Meta for advertising measurement, and _fbc stores the click identifier from a Meta ad you followed to the Service; each lasts about 90 days. When you check out, we record these values (or the ad-click identifier from the page address) with your purchase so our servers can report the purchase to Meta as described above. They are not set or recorded when the pixel is blocked or when your browser sends the Global Privacy Control signal.
  • X Pixel cookies and similar storage may retain X browser and ad-click identifiers used to connect a site visit and completed signup to an X advertisement. X may use first-party and third-party cookies where the browser permits them. This storage is not set when the pixel is blocked or your browser sends the Global Privacy Control signal.

In production, Refract Funding's HTTP-only cookies are sent over secure connections. Third-party pages or widgets, such as Google sign-in, the NOWPayments checkout, Discord, and Cloudflare Turnstile, may use their own cookies or similar technologies under their privacy notices. Except for the advertising-pixel storage described above, Refract Funding's cookies and browser storage are used for the requested Service, security, preferences, and referral attribution, not for cross-site advertising. You can delete or block cookies and browser storage through your browser controls, although some features may stop working.

When we disclose information

We disclose personal information in the following circumstances:

  • Publicly. Public profile, leaderboard, competition, and payout-proof features disclose the information described above. Public blockchain transfers may reveal wallet addresses, amounts, and transaction hashes independently of Refract Funding.
  • Cloud and infrastructure providers. Vercel hosts the web application, and Railway hosts backend services, databases, caches, and operational logs. Other infrastructure providers may support data delivery, storage, backups, or caching.
  • Identity and community providers. Google supports optional sign-in. Discord supports optional account linking, community membership, and invite rewards.
  • Payment and payout providers. MIDsource and its underlying payment providers process card tokenization, authorization, charges, refunds, and disputes. NOWPayments processes funded-account checkout and refunds in cryptocurrency. These providers receive payment and device or network information under their own privacy notices. Identity-verification, eligibility, tax, banking, crypto, or other payout providers may process the information needed to verify and pay an eligible recipient.
  • Communications and security providers. Resend delivers account email, Twilio delivers phone verification texts when enabled, and Cloudflare Turnstile helps detect automated abuse.
  • Content and live-data hosts. Your browser may request fonts, flags, asset icons, community counts, or live reference prices directly from Google Fonts, FlagCDN, CoinCap, Discord, Polymarket, or a similar content host. Like any direct network request, the host receives your IP address and standard request headers.
  • Advertising-measurement partners. Meta Platforms receives the Meta Pixel and Conversions API information described above, including conversion events and hashed contact identifiers, so we can measure our advertising and build advertising audiences. X Corp. receives the X Pixel site-visit and completed-signup information described above so we can attribute registrations to X advertisements. Some U.S. state privacy laws treat this as "sharing" personal information for cross-context behavioral advertising; you can opt out as described under "Your choices and privacy rights."
  • Affiliates. An affiliate associated with your referral or purchase may receive limited, masked attribution and commission information as described above.
  • Professional advisers and authorities. We may disclose information to auditors, lawyers, insurers, financial advisers, law enforcement, regulators, courts, or other parties when reasonably necessary to comply with law, investigate fraud, enforce agreements, or protect rights and safety.
  • Business transfers. Information may be reviewed or transferred as part of a financing, reorganization, merger, acquisition, bankruptcy, or sale of all or part of the Service, subject to appropriate confidentiality and applicable law.

Kalshi and Polymarket supply or originate market data. We do not send them your Refract Funding account or simulated trading activity merely to price the simulation. We do not sell personal information for money. The Meta and X Pixel disclosures above may be considered "sharing" for cross-context behavioral advertising under some U.S. state laws; you can opt out as described under "Your choices and privacy rights."

International processing

Depending on where you live and how our providers are configured, information may be processed outside your country, including in the United States. Those countries may have different privacy laws. Where applicable law requires a transfer mechanism, a lawful safeguard—such as an adequacy decision, approved contractual clauses, or an applicable data-privacy framework—must support the transfer. Contact us for information relevant to your transfer.

Retention and account deletion

We keep information for as long as reasonably needed for the uses above, taking into account the life of your account or program, security and dispute needs, payment and payout status, legal limitation periods, and tax, accounting, regulatory, and other retention duties.

  • Signed-in sessions expire within about 30 days and may end earlier; short-lived OAuth values expire after about 10 minutes.
  • The anonymous demo-account cookie lasts about one year, and the affiliate-referral cookie up to 30 days.
  • Account, simulation, competition, funded, affiliate, and payout records are generally kept while your account or the relevant program is active and afterward as needed for reconciliation, fraud prevention, disputes, and legal obligations.
  • Operational and security logs are retained according to our and our infrastructure providers' log and backup cycles.
  • NOWPayments, our previous payment provider (for purchases made while it was our processor), and other external providers retain information under their own policies and legal obligations, even if Refract Funding deletes its copy.

You can permanently delete your signed-in account in account settings. This deletes the user and associated active product records from our primary database, including sessions and simulated account history, subject to records we must or are permitted to retain and provider records outside our direct control. Brief public caches and routine backups may take time to expire.

Discord anti-abuse exception. To prevent the same Discord identity or server membership from repeatedly claiming invite rewards, we may retain Discord identity-claim and previously-seen member identifiers after a Refract Funding account is deleted. These limited records are used for reward integrity, are not used to keep a deleted trading profile active, and may be retained for the life of the invite-reward program or longer where reasonably necessary to prevent repeat abuse.

X reward anti-abuse exception. To prevent one X identity or repost event from earning more than once, we may retain limited X identity-claim, original-post, repost-event, qualification, and payment identifiers after a Refract Funding account is deleted. These tombstone records do not keep a deleted trading profile active and may remain for the life of the repost-reward program or as reasonably necessary to prevent duplicate claims and preserve competition audits.

Security

We use reasonable administrative, technical, and organizational safeguards, including HTTPS for public web and API traffic, HTTP-only production session cookies, salted password hashing, hashed single-use verification and reset tokens, access controls, rate limits, origin checks, signed payment-webhook verification, and server-side session records. No system is perfectly secure, and we cannot guarantee that information will never be accessed, lost, or misused.

Your choices and privacy rights

You can change your public display name, manage certain account and payout details, unlink or stop using some optional integrations where the feature allows it, opt out of marketing communications, sign out, block browser storage, or delete your account. Discord identity ownership and invite-reward anti-abuse records may not be removable from the reward system for the reason explained above.

You can opt out of the Meta Pixel, Meta Conversions API, and X Pixel sharing described above at any time. We honor the Global Privacy Control signal as an opt-out: when your browser or a browser extension sends it, the pixel does not load and our servers send Meta no conversion event for your purchase. Blocking the pixels or their cookies through your browser or a content blocker stops browser-side events, but not Meta's server-side purchase event, so use the Global Privacy Control signal or submit an opt-out request through the process below to stop both.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an explanation of personal information; object to or opt out of certain processing; withdraw consent; appeal a refusal; and complain to a regulator. You may also have a right not to receive discriminatory treatment for exercising a privacy right. These rights can be subject to exceptions, including identity verification, fraud prevention, legal claims, and records we must retain.

Submit a request to support@refractfunding.com. Describe the right you wish to exercise and the account involved. We may verify your identity through the email or other information tied to your account and may ask an authorized agent for proof of authority. We will respond within the period required by applicable law. EEA and UK residents may complain to their local data-protection authority; we ask that you contact us first so we can try to resolve the issue.

Additional notice for U.S. state residents

During the preceding 12 months, the categories of personal information we may have collected include identifiers and contact information; account credentials; internet or electronic activity; approximate location; commercial and transaction information; public profile and simulated financial activity; professional or content information supplied in an affiliate application; and sensitive information such as account credentials, government identifiers, precise payout credentials, or tax information when required for verification or payment. The sources, purposes, retention criteria, and recipient categories are described above.

We do not sell personal information for money and have not done so in the preceding 12 months. Beginning August 18, 2026, the Meta Pixel discloses limited internet-activity information and identifiers to Meta Platforms for advertising measurement and audiences, and beginning August 24, 2026 we also disclose conversion events (account creation, checkout, and purchase with its amount) and hashed contact identifiers to Meta through the pixel and its Conversions API, which some state laws treat as "sharing" for cross-context behavioral advertising. Beginning August 28, 2026, the X Pixel discloses limited site-visit, browser, ad-click, and completed-signup information to X Corp. for advertising measurement; it does not receive page locations, contact information, checkout activity, purchase activity, or payment information from us. Before August 18, 2026 we did not share personal information for cross-context behavioral advertising. You can opt out of this sharing through the Global Privacy Control signal, which we honor by not loading the pixel and sending no server-side event, or through the request process above. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you. Where a state privacy law applies, residents may use the request process above to exercise applicable access, correction, deletion, portability, opt-out, appeal, and non-discrimination rights.

Adults only

The Service is intended only for people who are at least 18 and the age of legal majority where they live. We do not knowingly collect personal information from children. If you believe a minor has provided personal information, contact support@refractfunding.com so we can investigate and delete it as appropriate.

Third-party links and services

The Service links to or interacts with third parties such as Google, Discord, NOWPayments, Kalshi, Polymarket, blockchain networks, and social sites. Their privacy practices are governed by their own notices, and we do not control how they handle information you provide directly to them.

Changes to this policy

We may update this policy as the Service, providers, or law changes. We will post the revised policy with a new date and provide additional notice when a material change requires it. The version in effect when information is processed governs that processing, subject to applicable law.

Contact

Refract Enterprises Inc., the owner and operator of Refract Funding and refractfunding.com, is the controller responsible for the processing described in this policy. Privacy questions and requests can be sent to support@refractfunding.com.

Refract Enterprises Inc.
1401 Pennsylvania Ave. Unit 105 #5191, Wilmington, DE 19806, USA
+1 (787) 237-0618