Privacy Policy

This policy explains what personal data WhaleWatch ("we", "us") collects, why, and what rights you have. We keep it short and honest — we collect the minimum needed to run the service.

Controller and contact

The data controller is Dujam Mario Tudor, a natural person based in Croatia and the owner of the WhaleWatch project. Privacy requests may be submitted through the contact form. The dedicated privacy address is privacy@whalewatch.live; the form securely forwards privacy requests to the same official inbox. No data protection officer has been appointed because WhaleWatch is not currently required to appoint one.

What we collect

• Account data — your email address, optional display name, a hashed version of your password when you set one, the provider-specific account identifier when you choose Google or Apple sign-in, and an encrypted Apple authorization token used only to revoke access when you delete the account.
• Passkey data — the public key, credential identifier, device label and technical security counters needed to verify a passkey. Face, fingerprint and other biometric data stay on your device and are never received by WhaleWatch.
• Product activity — markets you like, follow, or set reminders for, and public blockchain wallet addresses you choose to track.
• Basic product usage — when your account was created and last seen, paths visited within WhaleWatch, actions such as opening a signal, approximate click targets, time spent in page sections, scroll depth and the last section reached. We also store a country code derived by our host from the request solely for aggregate geographic statistics. Product analytics events are not stored with IP addresses, persistent advertising identifiers, activity outside WhaleWatch or form contents.
• Security data — network identifiers and request metadata may be processed briefly for authentication, abuse prevention, rate limiting and incident investigation.
• Public market data — public blockchain wallet addresses, public trades, positions and public profile labels obtained from Polymarket APIs and blockchain sources. A wallet address may be personal data when it can be linked to a person.

We do not collect browsing history outside WhaleWatch, run advertising trackers, or sell personal data.

Why we process it (legal bases under GDPR)

• To provide the service (contract) — accounts, plan gating, likes/follows/reminders, and saved wallet tracking.
• To secure the service (legitimate interests and, where applicable, legal obligation) — prevent fraud and abuse, enforce limits, keep audit evidence and investigate incidents.
• To send optional emails (consent) — event timing reminders, the Daily Whale Brief and fresh strict whale-activity alerts that you enable. These controls are off by default. Removing a reminder or disabling the profile setting withdraws consent without affecting earlier lawful processing.
• To understand and improve the product (legitimate interests) — aggregate first-party event counts, page-section engagement, click targets, scroll depth and country-level totals help us see where visitors find value or leave. A temporary in-memory visit identifier groups events from one open page; it is not saved in a cookie or reused across visits. This measurement uses no advertising cookies and is never used for cross-site profiling.
• To build public market research and an auditable track record (legitimate interests) — analyze public trades and pseudonymous wallets, detect unusual activity, prevent results from being rewritten after the fact, and publish proportionate market-level evidence. We do not try to identify natural persons behind wallets.

Where public wallet data comes from

We usually obtain wallet and market data indirectly from public Polymarket APIs and public blockchain records, rather than from the wallet holder. We retain immutable signal snapshots and evaluation results so the published research record cannot be selectively rewritten. If a public label is inaccurate or creates a particular risk to you, contact us so we can assess correction, restriction or objection rights against the public-interest and integrity reasons for retaining the record.

Who we share data with

Only service providers needed to run WhaleWatch:

• Vercel — hosting (privacy policy)
• Neon — database hosting (privacy policy)
• Resend — sending reminder and signal-alert emails (privacy policy)
• Google or Apple — only when you choose that provider to authenticate; the provider confirms your account identifier, verified email and available profile name.

Market and wallet activity, public profile details, open/closed positions and leaderboard values shown on WhaleWatch come from public Polymarket/blockchain data and may be cached to build historical comparisons. A public wallet address can be pseudonymous data; WhaleWatch does not attempt to identify the person behind it.

International transfers

Some providers may process data outside Croatia or the European Economic Area. Where GDPR requires it, transfers are based on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard. You may ask us for information about the safeguard relevant to your data.

How long we keep it

• Account preferences and saved actions: until you remove them or delete the account.
• First-party product analytics: up to 180 days.
• Verification, password-reset, OAuth and passkey challenges: until their short expiry; expired records are periodically deleted.
• Security/rate-limit records: only for the operational or incident-investigation period for which they are needed.
• Contact and complaint records: general enquiries only as long as needed to answer them; written consumer complaint records are kept for at least one year.
• Public market research: raw large-fill records are normally kept for 30 days, price snapshots for their configured operational period, while immutable signal, evaluation and resolution records may be retained long term to preserve the integrity of the public track record.

If you delete your account, account-linked personal data is deleted unless a legal obligation or overriding lawful ground requires limited retention. Public blockchain records cannot be erased from the blockchain itself.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your data; restriction or objection to processing based on legitimate interests; data portability; and withdrawal of consent at any time. You can also complain to your local supervisory authority (in Croatia: AZOP). To exercise any right, use the privacy contact form and provide your account email. We respond without undue delay and normally within one month; a complex request may lawfully take up to two additional months, in which case we will explain the extension within the first month. Requests are normally free of charge. We may need proportionate information to verify identity before disclosing account data.

Automated analysis

WhaleWatch automatically scores trade-size anomalies and ranks public wallets and markets. These outputs concern public market activity and do not produce legal or similarly significant effects about an account holder. They are research signals, not credit, employment, insurance or eligibility decisions. Methodology and limitations are shown alongside the results, and users remain responsible for their own decisions.

Security

We use measures appropriate to the service, including hashed passwords, verified OAuth identity tokens, phishing-resistant passkeys, signed httpOnly session cookies, access controls, rate limiting and encrypted transport in production. No internet service is risk-free; if a personal-data breach creates a high risk, affected people will be informed as required by law.

Cookies

We use essential session and short-lived authentication cookies, plus one local onboarding preference — see the Cookie Policy.

Changes

If this policy changes materially we will note the new date at the top and, for significant changes, notify you by email.