Effective Date: September 10, 2026
This Privacy Policy explains how Golden Whale ("Golden Whale," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Golden Whale mobile application (the "App," together with the App, the "Service").
We collect the following categories of information, based on how you actually use the Service:
When you create an account, we collect your email address and password (email/password sign-up), or, if you use Sign in with Apple, your Apple-provided identity token and, if you choose to share it, your name. We do not receive or store your Apple ID password.
We store your subscription plan, monthly analysis usage count and limit, billing-cycle dates, trial start/end dates, and your Apple original transaction ID and App Store subscription status. Subscriptions are billed entirely through your Apple ID account (App Store in-app purchases) — we do not receive or store your payment card number; payment is handled directly by Apple.
If you enable push notifications, we collect your device's Apple Push Notification service ("APNs") token and store it together with your account and the token's environment (sandbox/production), so we can deliver whale-alert notifications to your device. We remove this token when you disable notifications or sign out.
The App uses Apple's App Attest service to help prevent abuse (e.g., automated or fraudulent use of the analysis feature). This involves a device-generated attestation key ID, public key, and related cryptographic assertions. This mechanism is designed to verify your device's integrity and does not identify you personally beyond linking to your account.
The App requests access to your camera and photo library solely so you can capture or select a screenshot of a Polymarket market to submit for analysis. We do not access your camera or photos for any other purpose, and we do not browse your photo library beyond the image you actively choose to share.
We do not ask for or knowingly collect your date of birth, government ID, precise location, contacts, or any cryptocurrency wallet private keys or seed phrases. The "whale wallet" data shown in the Service concerns third-party public Polymarket traders' on-chain activity, not your own wallet. We also do not use any advertising or analytics tracking (no ad pixels, no analytics SDKs) — the App is the entire Service, with no companion website or checkout flow.
We use the information described above to:
We do not use your data to train third-party general-purpose AI models beyond the ordinary processing described in Section 3.
We do not sell or share your personal information. We disclose information only to service providers who process data on our behalf, each limited to what they need to perform their function:
| Provider | Purpose | Data received |
|---|---|---|
| Supabase | Auth, database hosting, real-time sync, password-reset email | Account, profile, subscription, tracking, alert data |
| Apple (App Store / APNs) | iOS subscription verification, push delivery | Purchase transaction data; device push token |
| Google (Gemini API) | OCR/text extraction from screenshots | Screenshot image; extracted market text |
| Anthropic (Claude API) | Generating the AI market verdict | Market question and public whale/sentiment context |
| DuckDuckGo Search | Retrieving public sentiment sources | Search queries derived from the market question |
| Railway | Backend hosting | Whatever data passes through the backend serving the App |
Polymarket / public blockchain data: the Service reads publicly available Polymarket and blockchain data to generate whale analyses; we do not send your personal account information to Polymarket.
Legal and safety: we may disclose information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of Golden Whale, our users, or the public.
Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.
We retain your account, profile, analysis history, tracked-market, and alert data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, accounting, or fraud-prevention obligations, or to resolve disputes. Device push tokens are removed when you disable notifications, sign out, or when Apple reports the token as no longer valid. You may request earlier deletion as described in Section 6.
You can delete your account at any time directly in the App, from the Profile tab ("Delete Account") — this permanently deletes your account and associated data (subject to any retention we are legally required to keep, such as tax records related to completed payments). Deleting your account does not cancel an active subscription; cancel that separately in your device's Settings app. For access, correction, or export of your personal information instead, email us at the address in Section 9 with the subject line "Privacy Request"; we will verify your request using your account email and respond within the time required by applicable law.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), gives you the right to know, delete, and correct your personal information, and to opt out of the "sale" or "sharing" of your personal information. We do not sell or share personal information, and we do not use any advertising technology that would qualify as "sharing" under the CPRA's broad definition. We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age. To exercise any of these rights, contact us using the details in Section 9. We will not discriminate against you for exercising your CCPA rights.
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Account creation requires only an email address and password (or Apple Sign-In) and does not request age or date of birth, but the Service is intended for users 18 and older per our Terms of Use. If you believe a child under 13 has provided us with personal information, contact us at the address in Section 9 and we will delete it.
If you have questions about this Privacy Policy or wish to exercise any of the rights described above, contact us at: polyscopeai@gmail.com
The Service is operated from the United States, and our service providers (including Railway and Supabase) may process and store data on servers located in the United States or other countries where they operate. By using the Service, you understand that your information may be transferred to and processed in countries other than your country of residence, which may have data protection laws different from those of your country.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated Policy in the App and updating the "Effective Date" above, and, where required by law, through additional notice. Your continued use of the Service after the updated Policy takes effect constitutes acceptance of the changes.