Stray Market RacePrivacy and cookies
What this race stores, which cookies it sets and who else is involved. Last updated 16 October 2026.
Only what the race needs. No advertising, no analytics cookies, no tracking across sites.
Three cookies, all functional. Sign-in, the X sign-in step and invites.
Public by design. Your X name, return and rank are on the leaderboard; your picks only after the race.
When you sign in with X
- Your X user ID, username, display name and the link to your profile picture. Your username, name and picture appear on the leaderboard.
- The date your X account was created and its follower count, to keep out brand-new throwaway accounts.
- A login session, so you stay signed in. We never see or store your X password.
Your entry
- Your four stocks, their weights and the time you confirmed them.
- Your return, virtual portfolio value and rank are public on the leaderboard. Your stocks and weights stay hidden until race start, when they become public.
- Racers you follow stay private: only you see your Following list.
Your wallet
- The EVM address you save in your account, and your claim if you finish in the top 50. We need it to put winners on the mint list.
- Wallet ticket (optional): if you verify a wallet by signing a message, our server reads that address's public on-chain history from public blockchain nodes and services (Blockscout, LI.FI, Ethos) and stores the score and category. You choose whether the category shows on the leaderboard.
- We never ask for or see private keys or seed phrases.
Invites
- Your personal invite code.
- When someone opens your invite link, their browser gets a random token in a cookie and we note the visit, so you are credited if they join. It contains no name and no address.
Cookies
The race sets these three cookies and no others. None of them can be read by scripts on the page.
| Name | What for | Kept for |
|---|---|---|
stray-session | Keeps you signed in | 14 days, or until you sign out |
stray-oauth | Protects the X sign-in step against forgery | 10 minutes |
stray-referral | Credits the friend who invited you, only after opening an invite link | 30 days |
Your browser also keeps your unfinished basket in its local storage (stray-week0-draft-…, stray-week0-pending-tickers), so a reload does not lose it. It never leaves your device.
Who else is involved
- X handles the sign-in; profile pictures load from X's servers.
- Parqet serves the company logos in the stock list; your browser loads them from assets.parqet.com.
- Alpaca supplies the market prices to our server. No personal data goes to Alpaca.
- Railway hosts the race in the EU (Amsterdam). Like every server, it receives the technical data each browser sends, such as the IP address. We use IP addresses only in hashed form, to limit how often one client can sign in or write.
Your data, your call
To see what we hold about you, or to have it deleted, write to us on X: @StraySocietyRH. Deleting your data removes your entry from the race.