Privacy Policy

This policy explains what personal data WhaleWatch ("we", "us") collects, why, and what rights you have. We keep it short and honest — we collect the minimum needed to run the service.

What we collect

• Account data — your email address, optional display name, and a hashed version of your password (we can never see the password itself).
• Subscription data — your plan, and Stripe customer/subscription identifiers. We never see or store your card number; payments are processed entirely by Stripe.
• Product activity — markets you like, follow, or set reminders for, and public blockchain wallet addresses you choose to track.
• Basic usage — when your account was created and last seen.

We do not collect browsing history, we run no advertising trackers, and we never sell personal data to anyone.

Why we process it (legal bases under GDPR)

• To provide the service (contract) — accounts, plan gating, likes/follows/reminders, and saved wallet tracking.
• To bill you (contract / legal obligation) — subscription payments via Stripe.
• To send emails you asked for (consent) — event timing reminders and fresh strict whale-activity alerts for markets where you set a reminder, plus global HIGH signal emails if you enable that separate profile setting. Removing the reminder or disabling the setting stops the corresponding emails.

Who we share data with

Only the processors needed to run WhaleWatch:

• Stripe — payment processing (privacy policy)
• Vercel — hosting (privacy policy)
• Neon — database hosting (privacy policy)
• Resend — sending reminder and signal-alert emails (privacy policy)

Market and wallet activity, public profile details, open/closed positions and leaderboard values shown on WhaleWatch come from public Polymarket/blockchain data and may be cached to build historical comparisons. A public wallet address can be pseudonymous data; WhaleWatch does not attempt to identify the person behind it.

How long we keep it

For as long as you have an account. If you delete your account (or ask us to), we delete your personal data, except records we must keep for tax/accounting purposes related to payments.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your data; restriction or objection to processing; and data portability. You can also complain to your local supervisory authority (in Croatia: AZOP). To exercise any right, email dujam.mario.tudor@gmail.com from your account email — we respond within 30 days.

Cookies

We use a single essential session cookie and nothing else — see the Cookie Policy.

Changes

If this policy changes materially we will note the new date at the top and, for significant changes, notify you by email.