Privacy policy

Who we are

Human Stock is run by Human Stock, the data controller for the personal data in this policy. For anything about your data, email [email protected].

What we collect

• Your account. Your name, email address and password. We store the password only as a one-way hash, so nobody at Human Stock can read it. We also record that you confirmed you’re 18 or older, when you verified your email, and your email preferences. If you continue with Google, Google gives us your name, email address and an account id, and confirms the email is yours. We never see your Google password.
• Your stock, if you list yourself. Your display name, photo link, headline, bio, city, sector, skills and goals, the claims and proof links you add, your milestones, and the valuation, rating and prospectus our AI analyst writes.
• Your activity. Trades, holdings, your Destiny Coin balance and history, badges, the people you watch, wall posts, reports you send and your notifications.
• Payments. The amount, reference and status of each listing fee, boost and backing, and any message you add to a backing. You enter card or bank details in Bachs’ checkout, not on Human Stock, so we never receive them.
• Payouts. To pay you, we collect your legal first and last name and your bank account number and pass them to Bachs, which opens a payout account in your name and checks the bank account is yours. We keep the bank name, account name and last four digits. Bachs holds the full number and may ask for more to confirm who you are.
• Security codes. One-time codes we email you are stored only as a hash and stop working after 10 minutes.
• Emails. A record of the emails we send you and whether they were delivered.
• Technical data. Our hosting providers keep standard server logs, such as IP address, browser type and request times, to keep Human Stock running and secure.

How we use it

• Run your account, your stock and the game, because that’s the service you signed up for.
• Value you with AI and write your prospectus, because you ask for it when you list yourself.
• Take payments, credit backings and pay out earnings, to provide the service and to meet the law on payments and fraud.
• Email you codes, receipts and payout updates, which are part of the service and can’t be turned off while you have an account.
• Email you about activity on your stock and people you watch, in our legitimate interest in keeping you informed. Turn these off any time in Settings or from the link in each email.
• Review reports, verify claims and suspend listings that break the rules, in our legitimate interest in keeping Human Stock fair and safe.
• Measure how the site is used with Google Analytics, in our legitimate interest in improving Human Stock. Until you accept analytics cookies it runs without cookies and can’t recognise you; if you decline, it stops. Change your answer any time in Cookie settings at the bottom of every page.
• Keep financial records, because the law requires it.

We don’t sell personal data, show ads or use your data for advertising.

What other people can see

• If you list yourself, your stock page is public and can be shared: your profile, claims and proof links, milestones, valuation, rating, prospectus, roast (if you allow it), price history and wall.
• The name on your account appears with your wall posts, on leaderboards with your game results, and on the page of anyone you back, with the amount and your message. You can hide your name when you back someone; you then show as “Someone”.
• Never public: your email address, password, bank details and payment history.

Who we share it with

We share only what each provider needs to do its job for us, and they may not use it for anything else.

• Bachs processes payments and payouts, and checks identity for payouts.
• DeepSeek writes valuations, prospectuses and milestone comments. It receives your stock profile: display name, city, sector, headline, bio, skills, goals and claims. It never receives your email address, bank details or proof links.
• ZeptoMail (by Zoho) or Resend deliver our emails. They receive your email address and the message.
• Google sign-in, only if you choose “Continue with Google”, confirms who you are. Google learns that you signed in to Human Stock, under its own privacy policy.
• Google Analytics counts the pages you visit, how you got here, your device and browser, and your rough location. Until you accept analytics cookies it does this without cookies, so it can’t tell your visits apart; if you decline, it receives nothing. Google doesn’t log or store IP addresses for this, and we never send it your name, email or anything you write.
• Hosting and database providers store and run Human Stock.
• Authorities, when the law requires it or to protect people from harm or fraud.
• A buyer or successor, if Human Stock is sold or merged. This policy would still apply to your data.

Data sent outside Nigeria

Some providers process data outside Nigeria. DeepSeek processes data in China, and our email providers and Google Analytics may process it in other countries, such as the United States. We send data abroad only where the Nigeria Data Protection Act allows it, for example when it’s needed to give you a service you asked for, like your AI valuation.

Cookies and browser storage

Most of what we store is what Human Stock needs to work and to remember choices you make. The one exception is Google Analytics: it only sets its cookies if you accept them in the cookie banner. Before you answer it runs without cookies, and if you decline it switches off. Declining changes nothing else about the site, and you can change your answer any time with Cookie settings at the bottom of every page. We don’t use advertising cookies.

• hs_sessionCookie

  Keeps you signed in. Scripts on the page can't read it.

  Lasts: 30 days, or until you sign out

• themeLocal storage

  Remembers light or dark mode, only if you switch.

  Lasts: Until you clear your browser data

• hs-verificationSession storage

  Remembers when you can ask for a new email code.

  Lasts: Until you close the tab

• hs-analytics-consentLocal storage

  Remembers whether you accepted or declined analytics cookies.

  Lasts: Until you change it in Cookie settings or clear your browser data

• _ga and _ga_*Cookies set by Google

  Only if you accept analytics. Google Analytics uses them to tell visits apart and count how people use the site.

  Lasts: Up to 2 years, or until you decline in Cookie settings

• Bachs checkoutSet by Bachs

  Only when you open a payment. Bachs may use its own cookies for security and fraud prevention.

  Lasts: Under Bachs’ own policy

How long we keep it

• Your account and stock: while your account is open. When you delete your account in Settings, or ask us to, we delete or anonymise your data within 30 days. Your stock is delisted, and people who hold it see it as “Deleted user”. Backings you made stay on the backed person’s page as anonymous, without your message.
• Payment, backing and payout records: as long as Nigerian tax and accounting law requires, usually six years after the transaction, even after you delete your account.
• Trades: they stay in each stock’s price history, without your name.

Your rights

Under the Nigeria Data Protection Act 2023 you can:

• get a copy of your data (download it any time in Settings)
• correct it (you can also edit your profile in My stock at any time)
• have it deleted (delete your account yourself in Settings, with a code we email you)
• restrict or object to how we use it
• take it to another service in a common format
• withdraw consent where we rely on it
• ask a person to review an automated decision about you

For anything you can’t do in Settings, email [email protected] from the address on your account. We reply within 30 days and may ask you to confirm who you are. If you’re unhappy with our answer, you can complain to the Nigeria Data Protection Commission.

Your AI valuation

Your valuation, rating and prospectus are written automatically by AI from what you put in your profile. They’re part of a game: they set your starting share price but have no legal or financial effect on you. You can edit your profile and get revalued before you go public, and our team checks claims that come with proof. If you think your valuation is unfair, email us and a person will look at it.

Keeping it safe

Passwords and codes are stored only as hashes, scripts can’t read your sign-in cookie, connections are encrypted, and withdrawals and deleting your account need a code sent to your email. No system is perfectly secure. If a breach puts you at risk, we’ll tell you and the Nigeria Data Protection Commission, as the law requires.

Under 18s

Human Stock is only for people 18 and older, and we don’t knowingly collect data from anyone younger. If you think someone under 18 has an account, email [email protected] and we’ll delete it.

Changes to this policy

If we change this policy in a way that matters, we’ll tell you by email or in the app before the change takes effect. The date at the top shows the latest version.