Privacy Policy

This policy explains what BOOPOLY collects, why, who else processes it, and what you can ask us to do with it. It describes how the Service actually handles your data.

#1What we collect

#From signing in

Sign-in is handled by Privy. When you sign in we receive and store:

• your email address;
• your display name and profile image, if your login method provides them;
• your login method (email, Google, or Discord) and the corresponding provider account ID, plus your Discord username where applicable;
• your wallet addresses (embedded wallet and smart contract wallet).

#Automatically, on each sign-in

• Your IP address and browser user-agent string, stored in an activity log alongside the time of sign-in.
• Sign-in timestamps and a cumulative sign-in count.

We do not currently apply an automatic retention limit to these sign-in records. They are deleted when you delete your account.

#From using the Service

• Trading records: orders, fills, order events, positions, and profit-and-loss history associated with your wallet.
• Configuration: copy-trading setups, automated-trading settings, split-order tickets, and simulated-mode runs.
• Preferences: favourited markets, interface language.
• Notifications generated for you, including deposit and withdrawal alerts, and whether you have read them.
• Deposit records when you use the cross-chain deposit service.
• Usage counts: the number of requests your browser makes to our servers each day, by page or feature, linked to your account or to a random browser identifier. We use these counts to measure operating costs.

#Location

To decide whether to enable order placement, the Service reads the country and region our hosting provider infers from your IP address, and your device's time zone, which your browser sends with requests to our servers. This check is performed per request and the result is not stored in our database. (Your IP address is separately stored in the sign-in log described above.)

#What we do not collect

We do not ask for or store government identity documents, financial account numbers, payment card details, or your wallet's private keys. Your private keys are held in Privy's secure enclave; we do not have access to them.

#2Blockchain data is public and permanent

Your trades settle on the Polygon public blockchain. Your wallet address, its balances, and its complete transaction history are public and permanent: anyone can read them, and neither we nor you can delete them. Polymarket independently publishes trading activity by wallet address.

Deleting your BOOPOLY account removes our records. It does not remove anything from the blockchain or from Polymarket.

#3Why we use it

We do not sell your personal data, and we do not use it for third-party advertising.

#4Who else processes it

The Service relies on the following third-party providers. Each has its own privacy policy, which governs what it does with the data it receives.

Note on translation providers: only public market text is sent for translation. No personal data, wallet address, or trading activity is included.

Note on Sentry: we capture errors only, not analytics or session recordings. Before an error report leaves our servers it passes through a filter that removes authorization headers, cookies, tokens, API keys, signatures, and similar credentials, and strips the IP-address headers our host adds. Reports can still contain technical details of a failed request. A per-error rate limit prevents one repeating fault from sending large volumes of data.

We may also disclose data where we are legally required to, or where necessary to establish or defend legal claims.

#5Security

• Your Polymarket API credentials are encrypted at rest with AES-256-GCM; the key never leaves our server environment.
• Access to the production database is restricted to service credentials held server-side.
• Wallet private keys are held in Privy's secure enclave. We do not have access to them.
• The optional 24/7 trading signer is limited by a Privy policy to order signatures, token approvals, and wallet batches (used to wrap collateral and redeem winnings) on registered BOOPOLY deposit wallets. The policy limits what the signer can be used for; because a batch can include a transfer, it does not make a transfer technically impossible. You can revoke the signer at any time by turning 24/7 trading off.

No system is completely secure, and we cannot guarantee absolute security.

#6Cookies and local storage

We use cookies and browser local storage for things the Service needs to work: keeping you signed in (set by Privy), remembering your language, and caching translations and market data so pages load faster. We do not use advertising or cross-site tracking cookies.

#7Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal data, and to object to it or complain to a supervisory authority.

You can exercise the two main ones directly:

• Export — download a machine-readable copy of the data we hold about you, from your account settings.
• Delete — permanently delete your account and the data associated with it, from your account settings.

For anything else, or if the in-app tools do not work for you, contact boopoly.service@gmail.com. We will respond within 30 days.

#What deletion does

Deleting your account permanently removes, from our systems: your profile, sign-in log (including stored IP addresses), favourites, notifications, trading-strategy configuration, simulated runs, and our copy of your order and fill records. It cannot be undone.

It does not:

• close open positions or cancel resting orders — please do this before deleting your account;
• remove anything from the Polygon blockchain or from Polymarket's records;
• delete your Privy wallet. Your wallet and its funds remain yours; manage or delete that account with Privy directly.

Where we are legally required to keep certain records, we will retain the minimum necessary for the required period and nothing further.

#8Children

The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact boopoly.service@gmail.com and we will delete it.

#9International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

#10Changes

We may update this policy. The "last updated" date at the top of this page reflects the current version, and we will make reasonable efforts to notify you in the Service of material changes.

#11Contact

Privacy questions and requests: boopoly.service@gmail.com