Privacy Policy

This Privacy Policy explains how Refract Funding, the operator of refractfunding.com ("Refract Funding", "we", "us", or "our"), collects, uses, discloses, and retains personal information in connection with our website, simulated-trading service, competitions, paid Evaluations, funded and affiliate programs, Discord community features, payouts, and support (collectively, the "Service"). For privacy questions or requests, email support@refractfunding.com.

This policy should be read with our Terms of Service and Risk Disclaimer. It covers personal information we control; third-party services have their own privacy notices.

Information we collect

Account and contact information. We collect your email address, display name, age-of-majority attestation, authentication method, and, if you choose to provide one, phone number. Email/password accounts use a salted password hash; we do not store the password itself. We also store email and phone verification status, password-reset and verification-token records, account creation time, opaque session tokens, and the timestamp and document versions associated with your legal acknowledgement during interactive authentication, including sign-in, signup, or password reset when that flow signs you in.

Google sign-in information. If you use Google sign-in, we receive the limited profile data permitted by the "openid email profile" scopes: your Google account identifier, verified email address, display name, and profile-picture URL. We do not receive your Google password.

Discord and community information. If you link Discord, we receive your Discord user identifier and username and record when the account was linked. We may create and associate a personal invite code with your account. To administer invite rewards and prevent repeat claims, our Discord bot may process member identifiers, join times, roles, invite codes and usage, and related membership events for people in the Refract Funding Discord server. We keep a record of Discord identities and members that have already participated in the reward program, as described under "Retention and account deletion."

X account and repost-reward information. If you link X, we receive your immutable X account identifier, username, display name, and the time of linking; we do not receive your X password. To administer approved repost rewards, we process identifiers and timestamps for native reposts of eligible posts from the official Refract Funding X account, the associated original-post identifiers, current visibility or deletion status, qualification decisions, and reward-ledger records. We do not ask for permission to post, repost, follow, or otherwise modify your X account.

Simulated-trading and program activity. We record your simulated balances, positions, orders, fills, prices, fees, volume, realized and unrealized values, combinations, perpetual positions, settlements, account ledger, competition score and rank, Evaluation purchases and results, funded-account activity, rule breaches, risk-control events, payout eligibility, payout requests, and related timestamps. Anonymous visitors may receive a per-browser demo account, and its activity is associated with that browser by cookie.

Public profile information. Signed-in accounts have public leaderboard and profile features. Depending on your activity, we publicly expose your Refract Funding user identifier, display name, avatar, linked Discord or X username, join date, rank, simulated return and realized profit and loss, fees, volume, win rate, trade count, open positions, combinations, fills, and trade history. We do not publish your email address, phone number, password hash, payment details, or payout destination. Public responses may be cached briefly.

Purchase and payment information. NOWPayments collects cryptocurrency payment information — such as the paying wallet address, chosen currency, transaction identifiers, and amounts — directly on its hosted checkout. Refract Funding does not receive or store card numbers (we no longer accept card payments) or your wallet private keys. We store order and payment identifiers, selected tier, amount, currency-equivalent internal amount and any account credit, payment and refund status, timestamps, the legal acknowledgements and document versions accepted at checkout, any affiliate attribution or discount, and the Evaluation or funded account associated with the purchase. Purchases made before July 16, 2026 were processed by our previous card-payment provider under its own privacy notice.

Payout, identity, and tax information. If you request or become eligible for a competition, funded, affiliate, or other payout, we may collect payout-method and destination details such as a blockchain network and wallet address, payout status, transaction hash, and disbursement records. We or a provider may also collect your legal name, address, date of birth, government identification, tax forms or identifiers, identity or legal-eligibility screening results, and other know-your-customer information when needed to verify eligibility, comply with law, or make a payment. We do not require all of this information merely to browse the Service.

Affiliate information. If you follow an affiliate link, we collect the referral code, record a click, and may attribute a later signup or purchase to that affiliate. If you apply to or join the affiliate program, we collect your application, X/social handle, description of your content, affiliate code, referral and commission activity, payout requests, and wallet address. A referring affiliate may see limited purchase attribution, such as a masked referred-user name and commission amount or status; we do not provide the affiliate with your email, payment-card details, or trading credentials.

Communications. We collect messages and contact details when you contact support, apply to a program, respond to us, or otherwise communicate with Refract Funding. We record whether an account email or phone has been verified; communications providers process message delivery information under their own notices.

Device, network, and security information. Our servers and service providers process IP address, request time, requested route, browser or device information sent in standard HTTP headers, referring page, response and error information, and similar logs needed to deliver and secure the Service. We use IP addresses for rate limiting, abuse prevention, security review, and Cloudflare Turnstile verification. An IP address can indicate an approximate country or region, but we do not request precise GPS location.

How we collect information

We collect personal information:

• from you, when you create an account, trade in the simulation, buy or start an Evaluation, link an account, apply to a program, provide a payout destination, or contact us;
• automatically, through cookies, browser storage, server requests, logs, and your use of the Service;
• from providers, including Google, Discord, NOWPayments, communications, identity-verification, anti-abuse, and payout providers; and
• from public and third-party sources, including Kalshi and Polymarket market data and public blockchain records. Market data is generally not personal information about you.

How we use information

We use personal information to:

• create, authenticate, secure, and support accounts and demo sessions;
• operate the simulator, public profiles, leaderboards, competitions, Evaluations, funded accounts, affiliate and invite programs, rule enforcement, and payouts;
• process purchases, discounts, refunds, disputes, commissions, payout requests, and transaction records;
• verify age, identity, account ownership, location, tax status, fair play, and other legally required eligibility;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• send verification, password-reset, security, account, purchase, program, and support communications;
• diagnose errors, monitor reliability, analyze aggregate use, and improve the Service;
• comply with law, enforce agreements, establish or defend legal claims, and protect people and the Service; and
• complete a financing, merger, acquisition, reorganization, or sale involving the Service.

We do not use personal information to make recommendations for real-money trading. We do not use third-party behavioral advertising trackers on the Service. We use Vercel Web Analytics to measure aggregate site traffic. It does not use third-party cookies and does not collect identifiers that track or cross-check visitors across other applications or websites: visits are counted with a temporary hash of the incoming request that is automatically discarded within 24 hours, and the recorded data (page URL, referrer, coarse geolocation, device and browser type) is anonymous and used for aggregated statistics only.

Legal bases for EEA and UK processing

If European or UK data-protection law applies, our legal bases are:

• contract, to create and operate your account, provide requested features, process an Evaluation purchase, apply program rules, and handle a payout request;
• legitimate interests, to secure and improve the Service, prevent abuse, maintain public competition features, administer affiliate and invite attribution, communicate with you, and protect legal rights, balanced against your rights and expectations;
• legal obligations, including payment, accounting, tax, identity, eligibility, consumer, and law-enforcement obligations that apply to us; and
• consent, where the law requires it, such as for optional marketing. You may withdraw consent at any time without affecting earlier processing.

Automated calculations and review

Automated rules calculate simulated fills and balances, leaderboard rank, rule breaches, Evaluation pass/fail outcomes, and preliminary funded and payout eligibility. These rules are described in the Program Rules. Funded activation and payout requests may also receive human eligibility, fair-play, risk, or error review. If you believe an automated result is wrong, contact support@refractfunding.com to request review. We do not use personal information for unrelated credit, employment, housing, insurance, or similar eligibility decisions.

Cookies and browser storage

We use the following first-party cookies and storage technologies to provide the Service. Blocking them may prevent sign-in, account persistence, referrals, or workspace features from working.

• pp_auth is an HTTP-only signed-in session token that lasts up to about 30 days and may be invalidated earlier for security, account, or legal-version changes.
• pp_session is an HTTP-only identifier for an anonymous browser demo account that lasts about one year and is refreshed as the demo account is used.
• pp_oauth_state, pp_oauth_return, pp_oauth_age, pp_oauth_legal, and pp_oauth_phone are HTTP-only values used for Google sign-in security, return routing, and carrying an age confirmation, legal acknowledgement, or optional phone through the sign-in flow. They last about 10 minutes.
• pp_discord_state and pp_discord_return are HTTP-only values used to secure Discord linking and return you to Refract Funding. They last about 10 minutes.
• pp_ref stores an affiliate referral code for up to 30 days. Unlike the cookies above, it is readable by Refract Funding's page code so the code can be shown and applied at checkout.
• Local storage remembers your open workspace tabs and active tab. Session storage temporarily remembers a pending trade during sign-in and avoids counting the same affiliate click repeatedly in one browser session.
• pp_admin is an HTTP-only 12-hour cookie used only by authorized Refract Funding administrators; it is not set for ordinary users.

In production, Refract Funding's HTTP-only cookies are sent over secure connections. Third-party pages or widgets, such as Google sign-in, the NOWPayments checkout, Discord, and Cloudflare Turnstile, may use their own cookies or similar technologies under their privacy notices. Refract Funding uses its own cookies and browser storage for the requested Service, security, preferences, and referral attribution. We do not use them for cross-site behavioral advertising. You can delete or block cookies and browser storage through your browser controls, although some features may stop working.

When we disclose information

We disclose personal information in the following circumstances:

• Publicly. Public profile, leaderboard, competition, and payout-proof features disclose the information described above. Public blockchain transfers may reveal wallet addresses, amounts, and transaction hashes independently of Refract Funding.
• Cloud and infrastructure providers. Vercel hosts the web application, and Railway hosts backend services, databases, caches, and operational logs. Other infrastructure providers may support data delivery, storage, backups, or caching.
• Identity and community providers. Google supports optional sign-in. Discord supports optional account linking, community membership, and invite rewards.
• Payment and payout providers. NOWPayments processes Evaluation checkout and refunds in cryptocurrency (purchases made before July 16, 2026 were handled by our previous card-payment provider, which retains those records under its own policy). Identity-verification, eligibility, tax, banking, crypto, or other payout providers may process the information needed to verify and pay an eligible recipient.
• Communications and security providers. Resend delivers account email, Twilio delivers phone verification texts when enabled, and Cloudflare Turnstile helps detect automated abuse.
• Content and live-data hosts. Your browser may request fonts, flags, asset icons, community counts, or live reference prices directly from Google Fonts, FlagCDN, CoinCap, Discord, Polymarket, or a similar content host. Like any direct network request, the host receives your IP address and standard request headers.
• Affiliates. An affiliate associated with your referral or purchase may receive limited, masked attribution and commission information as described above.
• Professional advisers and authorities. We may disclose information to auditors, lawyers, insurers, financial advisers, law enforcement, regulators, courts, or other parties when reasonably necessary to comply with law, investigate fraud, enforce agreements, or protect rights and safety.
• Business transfers. Information may be reviewed or transferred as part of a financing, reorganization, merger, acquisition, bankruptcy, or sale of all or part of the Service, subject to appropriate confidentiality and applicable law.

Kalshi and Polymarket supply or originate market data. We do not send them your Refract Funding account or simulated trading activity merely to price the simulation. We do not sell personal information for money and do not share it for cross-context behavioral advertising.

International processing

Depending on where you live and how our providers are configured, information may be processed outside your country, including in the United States. Those countries may have different privacy laws. Where applicable law requires a transfer mechanism, a lawful safeguard—such as an adequacy decision, approved contractual clauses, or an applicable data-privacy framework—must support the transfer. Contact us for information relevant to your transfer.

Retention and account deletion

We keep information for as long as reasonably needed for the uses above, taking into account the life of your account or program, security and dispute needs, payment and payout status, legal limitation periods, and tax, accounting, regulatory, and other retention duties.

• Signed-in sessions expire within about 30 days and may end earlier; short-lived OAuth values expire after about 10 minutes.
• The anonymous demo-account cookie lasts about one year, and the affiliate-referral cookie up to 30 days.
• Account, simulation, competition, Evaluation, funded, affiliate, and payout records are generally kept while your account or the relevant program is active and afterward as needed for reconciliation, fraud prevention, disputes, and legal obligations.
• Operational and security logs are retained according to our and our infrastructure providers' log and backup cycles.
• NOWPayments, our previous payment provider (for purchases made while it was our processor), and other external providers retain information under their own policies and legal obligations, even if Refract Funding deletes its copy.

You can permanently delete your signed-in account in account settings. This deletes the user and associated active product records from our primary database, including sessions and simulated account history, subject to records we must or are permitted to retain and provider records outside our direct control. Brief public caches and routine backups may take time to expire.

Discord anti-abuse exception. To prevent the same Discord identity or server membership from repeatedly claiming invite rewards, we may retain Discord identity-claim and previously-seen member identifiers after a Refract Funding account is deleted. These limited records are used for reward integrity, are not used to keep a deleted trading profile active, and may be retained for the life of the invite-reward program or longer where reasonably necessary to prevent repeat abuse.

X reward anti-abuse exception. To prevent one X identity or repost event from earning more than once, we may retain limited X identity-claim, original-post, repost-event, qualification, and payment identifiers after a Refract Funding account is deleted. These tombstone records do not keep a deleted trading profile active and may remain for the life of the repost-reward program or as reasonably necessary to prevent duplicate claims and preserve competition audits.

Security

We use reasonable administrative, technical, and organizational safeguards, including HTTPS for public web and API traffic, HTTP-only production session cookies, salted password hashing, hashed single-use verification and reset tokens, access controls, rate limits, origin checks, signed payment-webhook verification, and server-side session records. No system is perfectly secure, and we cannot guarantee that information will never be accessed, lost, or misused.

Your choices and privacy rights

You can change your public display name, manage certain account and payout details, unlink or stop using some optional integrations where the feature allows it, sign out, block browser storage, or delete your account. Discord identity ownership and invite-reward anti-abuse records may not be removable from the reward system for the reason explained above.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an explanation of personal information; object to or opt out of certain processing; withdraw consent; appeal a refusal; and complain to a regulator. You may also have a right not to receive discriminatory treatment for exercising a privacy right. These rights can be subject to exceptions, including identity verification, fraud prevention, legal claims, and records we must retain.

Submit a request to support@refractfunding.com. Describe the right you wish to exercise and the account involved. We may verify your identity through the email or other information tied to your account and may ask an authorized agent for proof of authority. We will respond within the period required by applicable law. EEA and UK residents may complain to their local data-protection authority; we ask that you contact us first so we can try to resolve the issue.

Additional notice for U.S. state residents

During the preceding 12 months, the categories of personal information we may have collected include identifiers and contact information; account credentials; internet or electronic activity; approximate location; commercial and transaction information; public profile and simulated financial activity; professional or content information supplied in an affiliate application; and sensitive information such as account credentials, government identifiers, precise payout credentials, or tax information when required for verification or payment. The sources, purposes, retention criteria, and recipient categories are described above.

We do not sell personal information for money or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use sensitive personal information to infer characteristics about you. Where a state privacy law applies, residents may use the request process above to exercise applicable access, correction, deletion, portability, opt-out, appeal, and non-discrimination rights.

Adults only

The Service is intended only for people who are at least 18 and the age of legal majority where they live. We do not knowingly collect personal information from children. If you believe a minor has provided personal information, contact support@refractfunding.com so we can investigate and delete it as appropriate.

Third-party links and services

The Service links to or interacts with third parties such as Google, Discord, NOWPayments, Kalshi, Polymarket, blockchain networks, and social sites. Their privacy practices are governed by their own notices, and we do not control how they handle information you provide directly to them.

Changes to this policy

We may update this policy as the Service, providers, or law changes. We will post the revised policy with a new date and provide additional notice when a material change requires it. The version in effect when information is processed governs that processing, subject to applicable law.

Contact

Refract Funding, the operator of refractfunding.com, is responsible for the processing described in this policy. Privacy questions and requests can be sent to support@refractfunding.com.