Privacy

Last updated 4 September 2026

Middlemen is a closed beta run by one person. It is built to hold as little about you as possible, and this page says exactly what that is.

What we collect

Your account. A username you chose, a one-way hash of the password you chose, and timestamps for when the account was made, first used and last seen. Beta accounts carry no email address.
Which signup code you used. Codes are per-channel, so this tells us you arrived from, say, Reddit rather than LinkedIn — and nothing else. It is a fact about the code, not about you: it does not identify you, it is not shared, and it is deleted with the account.
An email address, only if you gave us one. Beta credentials are issued without one. Accounts created before the beta may have one attached.
A session cookie, so you stay signed in between pages.
Your IP address, briefly and in memory only, to limit how fast requests can be made. It is not written to disk and not kept.
Anything you choose to tell us in the feedback form or in a message.

What we do not collect

No analytics. No advertising. No tracking pixels, no fingerprinting, no third-party scripts of any kind. No web-server access logs. We do not sell, rent or share personal information with anyone, and there is no third party receiving your data as a side effect of visiting — the typefaces this site uses are served from our own servers precisely so that visiting does not announce you to anybody else.

Cookies

Two, both strictly necessary and neither used to track you: a session cookie that keeps you signed in, and a short-lived state cookie used only during a Google sign-in to prevent request forgery. There are no analytics or advertising cookies, which is why this site shows you no cookie banner — there is nothing to consent to. Signing out clears the session cookie.

Beta accounts

Access is by a signup code, posted publicly wherever you found us. You choose your own username and password, and we never ask for your name, email or payment details. Some earlier accounts were issued directly instead; they work the same way. An account works for 30 days from the first time it is used, after which it and its session are deleted automatically. An issued credential nobody claims retires on its own after 90 days.

Because the account holds no email address, there is no password reset and no way for us to contact you inside the product. If you lose your password, sign up again with a current code.

Market data on this site

During the beta the prices, order books, trading volumes and the exchanges themselves are synthetic — generated by us, not quoted from any real venue. Every page carries a banner saying so. Nothing here is financial advice, and nothing here is an offer to trade.

Where the data lives

On a single server hosted with Amazon Web Services. Traffic is encrypted in transit. Account records are backed up in encrypted form; the backups cannot be read without a key that is not stored on the server.

How long we keep it

Beta accounts: deleted automatically 30 days after first sign-in.
Sessions: expire with the account, or when you sign out.
IP addresses: held in memory for rate limiting and never written down.
Feedback you send: kept while it is useful for building the product.

Your choices

You can ask what we hold about you, ask for it to be corrected, or ask for your account to be deleted — write to the address below and it will be done. Deleting an account removes it along with its sessions, saved preferences and watchlist. Depending on where you live you may have further rights under laws such as the GDPR or PIPEDA; ask and we will honour them.

Children

Middlemen is not intended for anyone under 18, and we do not knowingly hold information about children.

Changes

If this notice changes, the date at the top changes with it. While the beta is small, material changes will be told to beta users directly.

Contact

Questions about privacy, or a request about your data: [email protected].