Stonkie privacy policy
Last updated: October 30, 2026
Stonkie is an educational game: you get $10,000 of pretend money to invest in real US stocks at real prices, and compete in a monthly leaderboard. No real money is ever used, and nothing in the app is investment advice. This page explains, in plain language, what data the app uses, why, what is public, and how to delete it.
The game's rules (nicknames, pictures, fair play and suspensions) are in the terms of use.
What data we use
- Your Google account, only to sign in. Your name, e-mail and profile photo are not stored on our server. We never have access to your password.
- A code that identifies your account without revealing who you are: the server keeps only a scrambled code (HMAC-SHA256) derived from your Google account, used to recognize you when you sign in again.
- Nickname, chosen by you when you first sign in, and your avatar: the mascot, your nickname's initials or a picture you choose. Don't use your real name as your nickname.
- Avatar picture, if you choose one: the app crops and shrinks it on your phone (256×256 pixels) and sends only the result. It is reviewed before other players can see it, and it is deleted when you change or remove it, delete your account, or if it is rejected. Don't use a photo of yourself or anything that identifies you.
- Country, if you choose to give it: its flag shows next to your nickname. The app suggests the country your connection comes from (as reported by Cloudflare), which is saved only if you confirm it. You can pick "Prefer not to say", and change or hide it in Settings.
- Your game portfolio: buy and sell orders, holdings, cash, portfolio value over time and each season's results.
- Who you follow and who you blocked.
- Searches with no result: when you look for a stock that isn't in the game, we keep the text you typed, to find out which companies to add.
- Reports you send: the reason, the nickname or stock reported and any details you write, and our reply, if we send one. Each report has a number; you can see yours and the replies in Me → My reports.
- The app's language and technical sign-in data: device model, Android and app versions, so you can see and end your sessions and so we can find problems.
The app does not use your device's location (GPS), contacts, camera or microphone. It has no access to your photos: it only receives the one picture you pick in Android's photo picker for your avatar, and has no ads or third-party tracking.
What is public
For educational purposes, as in an open competition, any player can see your nickname, avatar (your picture, once approved), country (if given), leaderboard rank, portfolio value and return, cash available to invest, the stocks you hold and your trades in the game, including past seasons' (the portfolio at each close and its trades). Other players can also copy the companies and weights of your portfolio into their own. That's why your nickname should not identify you. There is no chat or messaging between players. A nickname that is reported and found offensive is replaced with a generic one (like user-1a2b3c4d), and you can choose another.
Rules and suspensions
Offensive pictures and nicknames are removed. Players who break the rules can have their account suspended for 7 days, 30 days or permanently. During a suspension the account is hidden from leaderboards and profiles, pending orders are cancelled and stocks are sold at the current price, so the portfolio is frozen (no gains or losses). We keep which companies you held and what each was worth, so you can restore your portfolio when the suspension ends. A player still suspended when a season closes gets no rank in it. The suspension record (the account code, the reason and the dates) is kept even if you delete your account, so the suspension comes back if you sign up again with the same Google account. We also keep a moderation record: every picture removed or rejected, every nickname reset (the old and the new one) and every suspension, with the date and the reason. Removed or rejected pictures are not kept: only a fingerprint (a short code computed from the image, which can't be turned back into it), used to stop the same picture from being uploaded again. The record lets us apply the rules consistently and defend ourselves in a dispute.
Why we use it
- To identify you and keep your portfolio, so nothing is lost if you change phones.
- To fill your orders at market prices and compute each season's leaderboard.
- To show leaderboards, the portfolios of players you follow and the stocks players buy the most.
We never sell or share your data. Stock prices come from a market data provider, which receives none of your data.
Where it is kept and how we protect it
Data is kept on a DigitalOcean server in the United States (New York), so it is transferred outside Brazil, as the LGPD allows in order to provide the service. It only travels over encrypted connections (HTTPS), through Cloudflare, which protects the site from attacks and speeds up downloads. DigitalOcean and Cloudflare only host and carry the data for Stonkie and don't use it for anything else. On your phone, access to your account is protected by a key kept in Android's secure storage. We make daily database backups, kept for up to 14 days on the server and, in case the server fails, a copy for up to 30 days in Cloudflare's encrypted storage (R2).
How long
As long as your account exists. When you delete your account, your data is deleted right away (and leaves the backups within 30 days), except the suspension and moderation records described above, which are kept for 5 years after the account's last action. Searches with no result are kept for up to a year, and reports are kept for record; if you delete your account, both remain but are no longer linked to you.
How to delete your data
In the app, open Settings → Delete my account. This permanently deletes your account, nickname, portfolio, history, results and the list of players you follow, and removes you from the leaderboards. Since the server doesn't store your name or e-mail, we can't find your account by them: deletion is done signed in with the same Google account, in the app or, without the app, at stonkie.app/delete-account.
Your rights
Under Brazil's data protection law (LGPD) and similar laws, you can find out what data we have, correct it or delete it. In the app you can see your portfolio and history, change your nickname and picture and delete your account; for anything else, write to the address below.
Minimum age
Stonkie is for people 13 and older. We collect only the minimum described above, with no advertising and no sharing with third parties (other than the hosting described above).
Contact
Questions or requests about your data: [email protected].