Privacy notice
What personal data StockVirtue collects, why, who sees it, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023.
Contents
This notice explains how Vamigo Media (OPC) Pvt. Ltd. ("we", "us") uses personal data when you use the StockVirtue app and the stockvirtue.com website. Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the Data Fiduciary: we decide how your data is used and we answer for it. Notice version 2026-11. यह सूचना हिंदी में पढ़ें. For another language listed in the Eighth Schedule to the Constitution, write to the grievance officer below.
StockVirtue is for adults. You must be 18 or older to have an account. It is a simulator: every trade uses virtual money, and we never ask for bank, demat, card, PAN or Aadhaar details.
1. What we collect and why
| Personal data | What we use it for | What it lets you do |
|---|---|---|
| Your email address, mobile number and the name you choose; a password if you sign up with email (we store only a scrambled hash of it); your Google name and photo if you sign in with Google. | To create your account, sign you in, keep it secure and contact you about it (sign-in codes, password resets, account notices). | Having a StockVirtue account on the app. |
| Your confirmation that you are 18 or older, the version of this notice you accepted and when, and your choices about optional purposes. | To show what you agreed to, and to keep the service for adults only. | Opening and keeping your account. |
| Your virtual wallet, orders, positions, portfolio history, watchlists and price alerts. | To run the trading simulator for you. Everything uses virtual money. | Practising trades, tracking your portfolio and getting alerts. |
| Your display name, rank and returns; the rooms you create or join. | To run leaderboards and rooms, where other users see your display name and returns. Use a nickname if you prefer. | Competing with other traders. |
| Lessons and quizzes you complete, and badges you earn. | To track your learning progress and achievements. | The academy and badges. |
| Stories you save, your news alert choices, and the stories you open (counted without identifying you). | To keep your saved stories, send the alerts you chose, and see which stories are read. | The news reader and news alerts. |
| Your referral code, who invited you and how many people you invited. | To run invitations and their rewards. | Referral rewards. |
| Your device’s push token and the notifications we send you. | To deliver notifications such as order fills, price alerts and news alerts. | Notifications on your phone. |
| Your IP address, device and browser type, app version and the time of each request; sign-in attempts. | To keep the service secure, stop abuse and investigate incidents. The law asks us to keep these logs for a year. | A safe service. |
| Messages you send us, privacy requests and complaints, and the nominee you name. | To answer you and to act on your rights. | Support and your privacy rights. |
| Only if you agree: which screens and features of the app you use (Google Analytics for Firebase). | To understand what works and improve the app. Never your trades, and not linked to your name. | A better app. Saying no changes nothing else. |
| Only if you agree, on this website: analytics and advertising cookies (see “Cookies” below). | To measure readership and to show ads that suit you. | A free news site. Saying no changes nothing else. |
We don't collect your contacts, your precise location, or any real money or brokerage data, and we never sell personal data.
2. Your consent, and when we don't need it
When you create an account, the app shows a short version of this notice and asks you to confirm you are 18 or older and agree. That consent covers what the account needs (section 1). App analytics, and analytics or advertising cookies on this website, are separate: they are off unless you say yes, and saying no changes nothing else.
Some things we do without asking because the law requires or allows them: keeping security logs for a year (DPDP Rules 2025), answering lawful requests from authorities, and acting to protect someone's safety.
3. Changing your mind
Withdrawing consent is as easy as giving it:
- App analytics: app → Profile → Privacy & your data → turn off “Help improve the app”.
- Website cookies: “Cookie settings” at the bottom of every page (or now).
- Your account: app → Profile → Privacy & your data → Delete my account. Withdrawing consent for the account means closing it, because we can't run it without that data.
Withdrawing doesn't undo what was lawfully done before. We stop within a reasonable time, and so do the providers working for us.
4. Who we share it with
Only with providers who process it for us, under contract, for the purposes above:
- Google Firebase: signing in (email, phone, Google account), push notifications (your device token and the notification), and app analytics if you allow it.
- Our email delivery provider: your email address and the emails we send you.
- Our cloud hosting and storage providers: your account and activity, stored and processed for us.
- Financial Modeling Prep and TradingView: the app loads company logos and charts from them, so they see your IP address and the symbols shown.
- On this website, only if you agree: Google (Analytics, Tag Manager, AdSense), Microsoft (Clarity) and Meta (Pixel). See “Cookies”.
- Authorities, when the law requires it.
These providers may process data in India and other countries. We only transfer data where the DPDP Act allows it.
5. How long we keep it
| What | How long |
|---|---|
| Your account and its activity | While your account is open. |
| A deleted account | It stops being used at once. A locked copy is kept for one year, as the DPDP Rules 2025 require, then erased for good. |
| An account nobody has used for 3 years | Erased, after an email at least 48 hours before. Signing in keeps it. |
| Security logs (IP address, device, sign-ins) | One year, then deleted. |
| Messages you send us | One year after our last reply. |
| In-app notifications | One year. |
| Push tokens | Until you sign out or delete the account, or 270 days after your device was last seen. |
| Privacy requests and complaints | Three years after we answer them. |
| Your cookie choice on this website | Kept in your browser for 180 days; our record of it, two years. |
6. Your rights
Under the DPDP Act you can:
- Get a summary of your data and who we shared it with: app → Privacy & your data → Download my data.
- Correct or update it: edit your profile in the app, or ask us.
- Have it erased: delete your account in the app, or ask us.
- Nominate someone to act for you if you die or can't act: app → Privacy & your data → Nominee.
- Withdraw consent (section 3) and complain (section 8).
Ask in the app (Privacy & your data → Make a request), on our privacy requests page, or by email to the grievance officer. To find your account we need the email address or mobile number registered with it, and we may ask you to confirm it. We answer within 30 days. Please give accurate information and don't make false or frivolous complaints: the DPDP Act asks that of everyone (section 15).
7. Security, and if something goes wrong
Data travels encrypted (HTTPS). Passwords and sign-in codes are stored only as hashes, access is limited to the people who need it and recorded, and we keep backups. If a breach affects your data we will tell you without delay, by email or in the app, with what happened and what you can do, and report it to the Data Protection Board of India as the law requires.
8. Questions and complaints
Aditya Kumar, Grievance Officer, Vamigo Media (OPC) Pvt. Ltd., Pathanpura, Rath, Hamirpur, U.P. 210431. Email: aadi@vamigo.in.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India once you have used our grievance process.
9. Cookies
Necessary, always on: the cookie that remembers your cookie choice (sv_consent, 180 days) and, for newsroom staff only, the sign-in cookie of the staff portal.
Analytics, only if you agree: Google Analytics (_ga), Google Tag Manager and Microsoft Clarity (_clck, _clsk), to see which pages are read.
Advertising, only if you agree: personalised Google AdSense ads (__gads, __gpi) and the Meta Pixel (_fbp). If you say no, ads, where shown, are chosen from the page you are reading, not from you.
In use on this site right now: Google Analytics. Nothing optional loads until you choose, and you can change your choice at any time from “Cookie settings”.
10. Children
StockVirtue is not for anyone under 18. We ask everyone to confirm their age when they sign up. If we learn that a child's data reached us, we delete it; tell the grievance officer if you think this has happened.
11. Changes to this notice
When we change this notice in a way that matters, we update the version and date above and ask you to read and accept it again in the app before you carry on.