Archived version
GBoarse privacy notice
Seventy database tables, five columns of personal data, and why an order book is not information about you.
This is the current version. It is kept here under a fixed address so it can be cited and compared. The live document is the same text.
Who is responsible
Gelhaus Solutions, Eichenwald 3, 49624 Löningen, Germany, egelhaus@ennogelhaus.de, where we host it.
For an instance you run yourself, you are the controller and we process nothing.
What is stored about you
Very little, and it is worth saying exactly how little, because a product with seventy database tables sounds like one that knows a lot about you. Sixty-five of them are instruments, orders, trades, ledgers and simulated economics.
About a person, this system holds:
- your email address, your display name, your role, whether the account is a bot, and your interface preferences;
- the link to your identity in our self-hosted Stack Auth;
- the accounts you own in the simulation and their configuration;
- API keys you create: name, prefix, scopes, instrument allowlist, rate limit, expiry, revocation and last use — with the secret held only as a hash;
- an admin audit log where you take an administrative action, recording who, what, when, the parameters and the decision.
Everything else — every order, position, trade and balance — is about a simulated market, and is only about you in the sense that a chess game is about the person who played it.
Why
Operating the service and your account is performance of a contract, Art. 6(1)(b). The admin audit log and rate limiting are legitimate interests under Art. 6(1)(f).
How long
Account and API key records last as long as the account. Simulation state persists as the simulation, and engine snapshots exist so a run can be restored.
Who else touches it
Where we host it: IONOS SE (Germany), Contabo GmbH (Germany, being wound down), and our own hardware in Germany. Identity runs on our own self-hosted Stack Auth. All in the EU.
No error reporting service, no analytics, no advertising network, no AI provider.
Your rights
Access, rectification, erasure, restriction, portability and objection. An informal email is enough.
You may complain to a supervisory authority. Ours is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.
Version identifier
gboarse-privacy-2026-09-06
Content hash, SHA-256
8333e0d3ed8c530792096e1da2cd0b25f497dc5ab1309de4847c988c25451ba9