Privacy Notice

1. Controller

Drivexio OÜ, registry code 17211907, VAT EE102847006, Tiskrevälja tn 59-12, 13516 Tallinn, Estonia. Email: hello@polyquad.app.

2. What we do not collect

PolyQuad is non-custodial. We never receive your private keys, your orders or your funds, and the account service does not receive your balances or positions. Orders are signed on your device and sent directly to Polymarket. We do not install the software for you and never access your computer or server. Nothing is sold, so there is no payment and we hold no card or bank details.

3. Data we process

Launch list (before launch): your email address, the referral code you came with (if any), where your visit came from (the campaign tags utm_source, utm_medium and utm_campaign of the link you opened and the host name of the site that linked to us, never the full address), the features you said you miss (if you picked any), the version of the terms you accepted, the time of the reservation and of the email confirmation, and your number on the list. We use the address to reserve your spot and to send you the launch invitation with your registration link (planned November 2026, possibly earlier); nothing else. Every email carries an unsubscribe link. Your IP address is used only to limit the number of reservations per connection and is not stored by us.

Referral program: your own referral code, the sha256 of your private status link, which code (if any) the addresses and accounts you referred came with, and the counts derived from them. Your status page shows only counts, never who was referred. At launch: the referred accounts' PolyQuad fees and the shares computed from them, in the ledger.

Your account is your trading wallet (sign-in with Ethereum): you sign in in the app by signing a PolyQuad message (EIP-4361) with the key you trade with, on your own computer; the key never leaves it. We store the wallet address(es) of your account, the address of the key that signed and its relation to the wallet (owner or session key), the signed message's one-time number (kept as it is, so a signature cannot be used twice; deleted after a day), a sign-in session for each device (only a hash of it; 30 days, renewed by signing again), and the times of sign-ins. Why: live trading in the app needs a signed-in account (so that the referral program, the launch offer and its rebates reach the right wallet and cannot be claimed for someone else's wallet), and rebates are paid to the wallet the trade came from. Paper trading and PolyQuad Live need no account.

Optional email: if you add an email address in the app, we send it a confirmation link and keep the address once confirmed, for notices and to join your launch-list spot to your wallet account. It is not used to sign in. If the address was on the launch list, your wallet account joins that list entry: your launch spot, your referral code and the referral you came with stay.

Account service, other data: your own referral code (and an old code if you changed it), the referral you came with, and the times of wallet bindings. It does not receive anything about your device or your trading. The account service software does not store your IP address; the hosting provider keeps it in server logs for up to 30 days.

Builder trade data: to calculate the launch-offer rebate, referral rebates and referral or affiliate shares, we read Polymarket's public builder trade data (trades carrying PolyQuad's builder code) and attribute it to the wallet addresses bound to accounts: trade type, size, price, fee and time per wallet. The app does not send us your orders.

Payouts: rebates and shares are paid in pUSD to your Polymarket wallet; we keep the wallet address, the amounts and the transaction references. The referred user's rebate is paid weekly to the wallet the trades came from. For affiliates, also the details in the affiliate agreement.

Referral code in the app: your own code is made when you first sign in and can be changed once; the old code keeps pointing to you. If you type a code in the app, or your browser kept one from a referral link when you open the email confirmation link, it is attached to your new account. To prevent self-referral, the app keeps the codes of the accounts that have signed in on that computer only on that computer; when another account signs in there, it sends those codes to our account service, which marks a referral between them as not earning. We do not keep the codes it sends, and no device identifier is made or sent.

Share cards: a PnL card is drawn on your computer. Your wallet address is never on the card or in its links. For a live trade, when you save or share the card, the app sends our service the trades' transaction hashes and the result the card shows, without your account or wallet address. The service reads those transactions from the public Polygon chain and Polymarket's public data and keeps the card's ID, the hashes, the shown result and the public trade details (market, side, price, size, time), so that anyone with the card's link (polyquad.app/p/ID) can check it. The wallet address is used only to find the trades and is not kept; the IP address is used only for a rate limit and is not stored. Transaction hashes are public, so whoever has the link can look them up on a block explorer.

App counts: when you make or share a card, the app sends our service the event's name and one word (the card's kind, or where it was shared: x, telegram, png, clipboard), without your account or any identifier; the service passes it to our cookieless analytics (Umami). When an account gets a referrer, the service counts it the same way (only how: launch list, sign-in or the app).

Update server: when the app checks for updates, the update server sees an ordinary download request, with no account or device id. Update requests are not logged beyond the hosting provider's server logs (up to 30 days).

Website: our hosting provider processes technical data such as your IP address to deliver the pages, in server logs kept for up to 30 days.

Website analytics (Umami, cookieless): to see how many people visit and which pages and links work, the site counts visits with Umami Cloud. It records the page address (private link tokens are removed before anything is sent), the referring site, the campaign tags, browser, operating system, device type, screen size, language and country, and a few named actions: clicks to the launch-list form, a sent reservation, a confirmed address, copying or sharing a referral link, opening a FAQ question, a video starting and use of the fee calculators. It sets no cookies and stores nothing on your device. Your IP address is used only to derive the country and a visitor count that changes every day, and is not stored. It never receives your email address, your referral code or anything you type into a form. Browsers with Do Not Track on are not counted.

Support requests and affiliate applications: the information you send us.

4. Purposes and legal bases

• Keeping your address on the launch list and emailing you the confirmation link, your number and the launch invitation: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in every email.
• Opening the free account from your wallet's signature, keeping you signed in and checking that a session is valid before live trading: performance of the contract (GDPR art. 6(1)(b)).
• Your optional email address for notices and for joining your launch-list spot: your consent, given by confirming it; you can remove it by writing to us.
• Calculating and paying the launch-offer rebate, referral rebates and referral or affiliate shares from builder trade data: performance of the contract.
• Keeping accounting and tax records of fees, rebates and payouts: legal obligation (art. 6(1)(c)).
• Preventing account abuse and fraud, including self-referral, codes from the same computer and linked wallets: legitimate interest (art. 6(1)(f)).
• Making share cards checkable (polyquad.app/p/ID) from public chain data, so that forged results can be told from real ones: legitimate interest (art. 6(1)(f)); only public data is kept.
• Cookieless website analytics and counting reservations by source, to know which pages and channels work: legitimate interest (art. 6(1)(f)). You can object at any time; turning on Do Not Track in your browser stops the counting.
• Emails about your sign-up and account: performance of the contract. We send no marketing emails; the launch list gets only the emails listed above.

5. Retention

• Launch list: an unconfirmed reservation expires with its link after 48 hours. A confirmed address is kept until the launch invitations have been sent and the 14-day claim period has passed, or until you unsubscribe, whichever comes first; an unsubscribed address is kept only so that we do not email it again.
• Account data: for as long as the account is open, and 12 months after it is closed.
• Unconfirmed email addresses: the confirmation link expires after 48 hours, and the address is not kept.
• Sign-in sessions: 30 days from the last signature. Sign-in one-time numbers: one day.
• Accounting and tax records (fees, rebates, payouts): 7 years, as required by Estonian accounting law.
• Share cards (ID, transaction hashes, the shown result and the public trade details): for as long as the card's check link is meant to work, at most 24 months.
• Support correspondence: 24 months after the last message.

6. Processors

• Fly.io, Inc. (United States; servers in the EU, Stockholm): hosting of the account service.
• Vercel Inc. (United States): hosting of this website.
• Umami Software, Inc. (United States): cookieless website analytics (Umami Cloud); receives the visit data listed above, not your email address.
• Resend (Resend, Inc., United States): email delivery of the launch-list emails (confirmation link, your number, the launch invitation) and, at launch, account emails from noreply@polyquad.app; receives your email address and the message.

7. International transfers

Our processors are based in the United States and may access data from there. Transfers rely on the EU-U.S. Data Privacy Framework where the processor is certified, and otherwise on the European Commission's standard contractual clauses.

Wallet addresses and trades on Polymarket are public on the blockchain. Payouts we send are also public transactions.

8. Cookies and local storage

This website uses no analytics, advertising or tracking cookies. The analytics script (Umami) is cookieless and stores nothing on your device, so there is no cookie banner.

If you open the site with a referral link (/r/CODE or ?ref=CODE), the code is stored in a first-party cookie and in your browser's local storage for 30 days, so that it can be attached to your reservation or sign-up. It is not sent anywhere until you submit the form or finish a sign-in from the link in your email.

Where your visit came from (the campaign tags and the referring site's host name) is kept in your browser's session storage until you close the tab, so that it can go along with your reservation. It is not sent anywhere until you submit the form.

If you pick a dark or light theme at the foot of the page, the choice is kept in your browser's local storage. It is never sent anywhere.

9. Your rights

You have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. To use these rights, email hello@polyquad.app.

You can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), www.aki.ee, or with the supervisory authority of your own country.

10. Changes

Changes to this notice are published on this page with a new date. Signed-up users are notified by email of material changes.