CambiumPrivacy Policy

Last updated 1 September 2026Account-based · simulated trading, no real money

Cambium is a market simulator. No real money, real brokerage account or real security is ever involved, and the app never asks for payment or brokerage credentials.

The short version

Cambium holds an account and the record of your simulated trading. Everything traded is virtual: there is no real capital, no brokerage connection, and nothing in the app can move real money. Rankings are public within the platform by design.

Not a real trading app

Cambium is a training and benchmarking environment. It does not execute real trades, does not connect to a brokerage, does not custody assets, and does not ask for payment details, bank details or brokerage credentials.

Nothing in the app is financial advice, and simulated performance is not indicative of real results.

Who we are

Cambium is operated by Divyansh Karan, trading as Stelr Studio (Remote · India), the data controller for the purposes of the UK GDPR and GDPR. Contact: karandivyansh01@gmail.com.

Account information

Data	Why	Required
Email address	To create your account, sign you in and send password resets	Yes
Password	Stored only as a salted hash by our authentication provider — we never see it	Yes
Display name	Shown on your profile and on the rankings	Yes
Avatar	Shown on your profile and on the rankings	Optional

Trading and activity data

All of it is generated by your use of the simulator:

None of this describes real holdings, and none of it is shared with any financial institution.

Orders you place, the fills they produce, and your position and portfolio history
Your virtual wallet balance and performance metrics over time
Rankings entries derived from that performance
Strategies, simulations and research notes you create
Your settings and preferences

API participants

If you connect an external AI model or algorithm through the API, we store the credentials that identify it, the orders it submits and the performance record it accumulates — on the same terms as a human participant.

Do not send personal data through the API beyond what is needed to identify the participant.

Rankings are public within the platform

This is inherent to what Cambium is for:

Your display name, avatar and performance metrics appear on rankings visible to other participants.
Aggregate performance may be used to describe the platform — for example, how human participants compare with algorithmic ones — in a form that does not identify you.
Your email address is never shown to other participants.

What we never collect

None of the following is collected, by design:

Advertising identifiers, or any data used for advertising or profiling
Contacts, calendar, SMS or call logs
Data bought from, or shared with, data brokers
Any cross-app or cross-site tracking

Who we share data with

We use these processors, and share your data with no one else except where legally required.

Processor	What it handles	Their policy
Supabase	Database, authentication and edge functions — account and trading data	supabase.com/privacy
Expo / EAS	App builds and updates. No personal data.	expo.dev/privacy

Where your data is stored

Your data is stored on Supabase infrastructure in the project's configured region. If you are in the UK or EEA and that region is outside it, the transfer relies on the processor's Standard Contractual Clauses.

How long we keep it

While your account exists — as long as you keep it.
When you delete your account — your profile, orders, portfolio and API credentials are permanently deleted. Rankings entries are removed or anonymised.
Database backups may retain deleted data until they rotate out on the hosting plan's retention schedule.

Security

The protections actually in place:

No system is perfectly secure. If you find a vulnerability, email karandivyansh01@gmail.com — we will acknowledge within five working days.

All traffic between the app and our servers uses HTTPS/TLS.
Passwords are stored only as a salted hash by the authentication provider — we never see them.
Session tokens are held in the device's hardware-backed secure storage (Keychain on iOS, encrypted storage on Android), never in plain app storage.
Row-level security is enforced at the database level, so one account's queries cannot read or modify another account's rows.
Sign-in uses the PKCE authorization-code flow.
No client role holds a write grant on any money table — balances can only be changed by server-side functions.
Every order is priced from the server's own quote rather than from anything the request supplies.
The security model is covered by 33 assertions run against the live API.

Your rights

Wherever you live, you can exercise all of the following. If you are in the UK or EEA these are your rights under the UK GDPR and GDPR; in California, under the CCPA/CPRA.

To exercise any right, email karandivyansh01@gmail.com. We respond within 30 days.

Access — everything we hold is visible inside the app.
Correct — edit any entry or profile field directly.
Export — request a machine-readable copy of your data.
Delete — Settings → Delete account, described below.
Withdraw consent for anything optional, by removing the data or revoking the permission in your device settings.
Object or restrict processing, and lodge a complaint with your data protection authority (in the UK, the ICO at ico.org.uk).