Privacy Policy

CandleOdds is a brand operated by its founders. Contact: hello@candleodds.com.

The founders are responsible for the personal information described here.

Questions about your data: hello@candleodds.com.

• Account: your email address and the account identifier created when you log in.
• Wallet: your wallet addresses. We never receive or store your private key.
• Trading activity: the orders you place through the app or Auto, their fills and results, your Auto settings, and deposits and withdrawals started in the app. Much of this is also public on the blockchain and on Polymarket.
• Membership: your membership tier, and the membership details Whop sends us (such as your email, membership status and period). We do not receive your card details.
• Technical: your IP address, approximate location derived from it (to apply regional restrictions), device and browser type, and logs of requests to our servers.
• Alerts: if you turn on alerts, the push subscription your browser creates for this device.
• Messages: what you send us when you contact support.

• To provide the service: log you in, show your balance and results, place the trades you approve, run Auto with your settings, and send the alerts you asked for.
• To apply the rules: regional restrictions, membership tiers and limits.
• To keep the service safe: prevent abuse and fraud, investigate faults, and keep an audit trail of sensitive actions.
• To run the business: handle memberships and payments, answer support requests, and meet legal obligations.
• To improve the service: understand how features and signals perform, in aggregate.

We process your data to provide the service you signed up for, to meet legal obligations, and, for alerts, with your consent.

We do not sell your personal information. We share it only with the providers that make the service work, and where the law requires:

• Privy: login and wallets.
• Polymarket: the orders you place and the wallet they come from.
• Whop: memberships and card payments.
• Hosting and database providers (currently Vercel, Supabase and Railway): they run our servers and store our data.
• Blockchain and bridge providers: to read balances and carry deposits and withdrawals.
• Your browser's push service (for example Apple, Google or Mozilla): to deliver alerts you turned on.
• Authorities or advisers, where we are legally required to, or to protect our rights and our members.

Some of these providers are in other countries, including the United States. Our service providers (such as Vercel, Supabase, Railway and Privy) may process data in other countries under their own standard safeguards.

Trades, deposits and withdrawals are recorded on a public blockchain. Anyone can see the transactions of a wallet address, and we cannot change or delete them. We do not publish which address belongs to which person.

We use only what the app needs to work: a login cookie set through Privy, and small items stored on your device to remember your session and settings. We do not use advertising cookies or ad-tracking pixels.

We use cookie-free analytics (Vercel Web Analytics) to count visits and pages.

We keep information for as long as your account exists, unless a shorter period is given below. Nothing in the first three groups is deleted automatically today; it is deleted when you ask us to (see section 8).

• Account and membership details (email, account identifier, wallet addresses, tier, membership records from Whop): for as long as your account exists.
• Trading records (orders, fills, results, deposits and withdrawals started in the app, tips, your Auto settings and your bot's reports): for as long as your account exists. They are needed to show your results and to resolve disputes.
• Security and audit records (changes to memberships and Auto access, bot token activity and the IP addresses a bot token was used from, hosted Auto events): for as long as your account exists.
• Short-lived counters, deleted automatically: request rate limits after about 1 hour; per-minute records of which IP address used a bot token after 1 day; the count of orders signed by hosted Auto after 2 days; the count of wallet transactions sent through the app after 30 days.
• Server request logs (which include IP addresses): kept by our hosting providers for the limited period their service retains logs, then deleted by them.
• Push subscriptions: until you turn alerts off on that device, or the subscription stops working.
• Blockchain records: permanent and public. We cannot delete them.

After your account is deleted we keep only what the law requires us to keep, for as long as it requires.

• You can turn alerts and Auto off in the app at any time.
• You can ask for a copy of your information, for it to be corrected, or for it to be deleted, by emailing hello@candleodds.com. We may need to keep some records where the law requires, and we cannot delete blockchain records.
• Depending on where you live, you may have further rights, such as objecting to certain uses or complaining to your data protection authority. You can ask to access, correct or delete your data by emailing hello@candleodds.com.

We protect information with encrypted connections, strict access controls and regular security reviews. See the Security page for more. No system is perfectly secure, so please also protect your email account and never share your private key.

CandleOdds is for adults only. We do not knowingly collect information from anyone under 18.

We may update this policy. When a change matters, we will tell you in the app or by email before it takes effect.

You configure and control the bot; CandleOdds provides software that executes your settings. Trading involves risk of loss. Not financial advice.