At CaymanBot, we take your privacy seriously. This Privacy Policy describes how we collect, use, store, and protect your information when you use our trading analytics platform.
1. Information We Collect
1.1 Information You Provide
When you create an account and use CaymanBot, we collect:
- Account Information: Username, user ID, email address, and avatar from your chosen OAuth provider (Discord, X, TikTok, or Google)
- Account Preferences: Watchlists, alert settings, and notification preferences
- Payment Information: Processed securely through Stripe (we do not store credit card details)
- Communications: Support tickets, feedback, and messages to our support channels
1.2 Information Collected Automatically
When you use our Service, we automatically collect:
- Usage Data: Features accessed, queries made, alerts triggered
- Technical Data: IP address, browser type, device information
- Performance Data: Response times, error rates, service availability
- Session Information: Login times, session duration, activity patterns
1.3 OAuth Provider Data
When you sign in using one of our supported OAuth providers (Discord, X, TikTok, or Google), we access:
- Basic profile information (username, avatar, user ID)
- Email address (if verified with your provider)
- Provider-specific data where applicable (e.g., Discord server membership for verification purposes)
1.4 Linked Brokerage Account Information
You can choose to link your own existing brokerage account. You do this on your broker's own OAuth authorization page, so we never receive your broker password, and we do not ask you for identity documents, your Social Security Number, or bank account details. When you link an account, we store:
- Access token: The token your broker issues so CaymanBot can reach your account at your direction (and a refresh token, if your broker issues one). Both are encrypted with AES-256-GCM before they are stored.
- Account ID and status: Your brokerage account ID, whether it is a paper or live account (only paper accounts can be linked at launch), and the trading permissions your broker reports for it.
- Orders you place: A log of each order you place through CaymanBot (symbol, side, order type, quantity, limit price, status, the broker's order ID, and timestamps).
Your balances, positions and order history are fetched from your broker when you view them, to show them to you.
1.5 Discord Bot Data
If you interact with the CaymanBot Discord bot, we collect:
- Discord User ID: Used for alert delivery and notification routing
- Command Inputs: Commands you send to the bot for processing
- Server and Channel IDs: Used for routing notifications to the correct destination
Command inputs are not persisted beyond the lifetime of the command execution. Your Discord user ID is stored only for alert preference delivery.
1.6 Polymarket Wallet (Optional)
If you connect your own Polymarket wallet, we store:
- Wallet addresses: The public address of your own crypto wallet, and of the Polymarket deposit wallet (or older Safe wallet) it controls
- Trading credentials: The Polymarket order book (CLOB) API credentials used to send the orders you sign, and any trading session key you authorize. Both are encrypted with AES-256-GCM
- Wallet settings and records: Your wallet preferences, your deposit and withdrawal totals, and records of the consents you give while setting up the wallet (such as authorizing or revoking a session key), including the IP address each consent came from
We never receive your wallet's private key or seed phrase. Your balances, positions and orders are held by Polymarket and on the blockchain, and we fetch them when you view them.
CaymanBot no longer offers copy-trading. The copy-trading settings and history we stored for it have been deleted.
Data We DO NOT Collect
Unless you choose to link a brokerage account or connect a Polymarket wallet, we do not collect personal financial information.
- Your messages or activity from other platforms
- Your personal trading account information (unless you link a brokerage account)
- Your actual trading positions or portfolio (unless you link a brokerage account)
- Your broker password, your Social Security Number, or your bank account details
- Your crypto wallet private key or seed phrase — never, under any circumstances
2. How We Use Your Information
We use the collected information for the following purposes:
| Purpose | Description |
|---|---|
| Service Delivery | Provide access to options flow data, alerts, and analytics features |
| Account Management | Authenticate users, manage subscriptions, and maintain account security |
| Personalization | Customize alerts, save watchlists, and remember user preferences |
| Communication | Send service updates, alerts, and respond to support requests |
| Improvement | Analyze usage patterns to enhance features and fix issues |
| Security | Detect and prevent fraud, abuse, and unauthorized access |
| Legal Compliance | Meet legal obligations and respond to lawful requests |
3. Data Storage and Security
3.1 Where We Store Data
- Primary Database: A PostgreSQL database on dedicated servers we rent from Hetzner in Germany (EU)
- Session Data: Temporary storage in a Redis-compatible cache on the same servers
- Analytics Data: Processed by PostHog as described in section 7.2
- Service Logs: Application logs and metrics, which can include your user ID and IP address, are sent to Grafana Cloud
3.2 Security Measures
The security measures we use include:
- HTTPS (TLS) encryption for traffic between your browser and our edge
- Application-level AES-256-GCM encryption of the most sensitive values we store: brokerage access tokens, the tokens we receive from your sign-in provider, and the trading credentials and session keys of a connected Polymarket wallet
- OAuth 2.0 sign-in through established providers (Discord, X, TikTok, Google), so we never handle your password
- Access controls and authentication for our internal systems
- Server-side sessions that expire automatically and can be revoked
- Dependency updates and security patches
3.3 Breach Notification
In the event of a data breach that poses a high risk to your rights and freedoms, we commit to:
- Investigating the incident and notifying affected users without undue delay
- Sending notifications via email to your registered email address
- Notifying relevant regulatory authorities as required by applicable law (e.g., within 72 hours under GDPR, as required by state breach notification laws)
- Providing details about the nature of the breach, the data affected, and steps you can take to protect yourself
🔒 Your Security Matters
We recommend enabling two-factor authentication (2FA) on your OAuth provider account to enhance security. We also use secure session management and automatic session expiration to protect your account.
4. Information Sharing and Disclosure
We do not sell, trade, or rent your personal information. We may share your information only in these circumstances:
4.1 Service Providers (Sub-Processors)
| Provider | Purpose | Data Shared |
|---|---|---|
| Your broker (only if you link a brokerage account) | Executes the orders you place and returns your account data when you view it | Orders you place, requests to view your account, and the access token your broker issued |
| Polymarket (only if you connect a Polymarket wallet) | Executes and settles the prediction market orders you place | Your wallet address, the orders you sign, and the API credentials that authenticate them |
| Stripe Inc. | Subscription payment processing | Name, email, billing address |
| Hetzner Online GmbH | Dedicated servers in Germany that host our application and database | All data we store |
| Cloudflare, Inc. | DNS, content delivery and proxying for our websites; approximate country detection for the analytics mode in section 7.2 and as a country-level property on analytics events | All web traffic, including IP address and request details |
| Google Cloud (Secret Manager) | Storage of application secrets such as encryption keys and API keys | Application secrets; no user records |
| Grafana Labs (Grafana Cloud) | Service logs, metrics and alerting | Application logs, which can include user IDs and IP addresses |
| GitHub, Inc. | Source code hosting, build pipelines and container images | Our code and build artifacts; no user records |
| Discord, X, TikTok, Google | OAuth authentication | Profile info (username, email, avatar) |
| Discord | Bot notifications, alert delivery | User ID, server ID, command inputs |
| SendGrid (Twilio) | Email delivery | Email address, notification content |
| PostHog Inc. | Product analytics, feature flags, and a record of your privacy choices | Account records (sign-up, trial, subscription); page measurement, with or without a device identifier depending on your region and your choice — see section 7.2; and a record of each consent decision you make (which consent you accepted or refused, where you were asked, and whether the answer came from you or from a Global Privacy Control signal sent by your browser) |
| Google LLC (Google Ads) | Conversion measurement: telling which of our Google ads led to a sign-up | The ad click identifier from the Google ad link you followed (gclid, gbraid or wbraid) and the time you signed up; never your name, email address or account details. Only for visitors outside the EEA, the UK and Switzerland whose browser sends no Global Privacy Control signal, and not after you turn Analytics off — see section 7.2 |
| Anthropic, PBC | AI classification of public social media posts for market alerts | Public posts only; no user data |
| Market data vendors (Massive, formerly Polygon.io; Finnhub; Alpaca market data; Polymarket and Kalshi public data) | Market, options, earnings and prediction market data | None; we request market data only |
4.2 Legal Requirements
We may disclose information if required by law or in response to:
- Court orders or subpoenas
- Government agency requests
- Legal proceedings
- Protection of our rights and safety
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, user information may be transferred. We will notify you of any such change.
5. Data Retention
We retain your information for different periods based on its type:
| Data Type | Retention Period |
|---|---|
| Account Information | Duration of account + 90 days after deletion |
| Transaction Records | 7 years (legal requirement) |
| Usage Analytics | 2 years (anonymized) |
| Session Data (your signed-in session) | 30 days or until logout |
| Security and fraud-prevention records (sign-in and checkout IP address, browser) | 180 days |
| Support Communications | 2 years after resolution |
Session Data is the sign-in session itself: the cookie in your browser and the server-side session it points to, which ends when you log out or after 30 days. Security and fraud-prevention records are separate: when you sign up, sign in, or start a checkout, we record the IP address and browser (user agent) it came from, and the time. We use them only to protect your account and our payments, for example to show a card issuer that a disputed purchase was made from your own sign-in. They are deleted after 180 days.
6. Your Rights and Choices
6.1 Your Rights
You have the right to:
- Access: Request a copy of your personal information
- Correction: Update or correct inaccurate information
- Deletion: Request deletion of your account and associated data
- Portability: Receive your data in a machine-readable format
- Objection: Object to certain uses of your information
- Restriction: Request limited processing of your data
6.2 How to Exercise Your Rights
To exercise any of these rights, contact us through:
- Email: support@caymanbot.com
- Discord: Support channel in our server
6.3 Account & Data Deletion
To request deletion of your account and all associated personal data, email support@caymanbot.com from the email address associated with your account. You can also submit a request through our Discord support channel.
Upon receiving your request:
- We will verify your identity
- Your account will be deactivated immediately
- All personal data will be permanently deleted within 90 days
- You will receive confirmation once deletion is complete
7. Cookies, Local Storage, and Tracking
7.1 Essential Cookies
We use essential cookies for:
- Session management and authentication
- Security features and fraud prevention
- Remembering your preferences
7.2 Analytics
We use PostHog as our product analytics platform to understand usage patterns.
Account records. When something happens to your account — you create it, a trial starts, a subscription changes — we record that on our own servers so we can run the business and support you. These are records of events, not tracking of your device, and they are kept whatever you choose below.
Measurement in your browser. How this works depends on where you are and what you choose. There are two modes.
1. Without storing anything on your device. Nothing is written to your browser: no cookie, no local storage, no identifier. So that a single visit still holds together as one session, PostHog derives a pseudonymous identifier on its own servers instead. It is a hash of your IP address, browser user-agent and the website address you are on, combined with a random salt that is rotated and deleted every day. Because the salt is discarded, the identifier cannot be reversed. Because the website address is part of it, your visit to caymanbot.com cannot be connected to your visit to app.caymanbot.com. And because the salt changes daily, returning tomorrow makes you a new person to us.
2. With a cookie that recognises your browser. A PostHog cookie is set on .caymanbot.com and is shared between our marketing site and the app, so a visit that begins on caymanbot.com and continues in the app is understood as one person rather than two strangers. If you later sign in, that activity is linked to your account.
Which one applies to you:
- If you are in the EEA, the UK or Switzerland, mode 1 applies and nothing is stored on your device unless and until you accept.
- Elsewhere, including the United States, mode 2 applies by default and you can turn it off at any time. Turning it off clears the identifier, it does not merely stop sending.
- If we cannot tell where you are, we use mode 1.
- If your browser sends Global Privacy Control or Do Not Track, mode 1 always applies, everywhere, and overrides any earlier acceptance.
In either mode we record which pages were viewed, which version of a page you were shown when we are comparing two versions, your approximate country (country level only, never your IP address), and any campaign parameters in the link you followed, so we can tell which adverts, pages and page versions actually work. In either mode this data is used solely for service improvement and feature prioritisation, is never sold, and is subject to PostHog's privacy policy at posthog.com/privacy.
Google ad clicks. If you are outside the EEA, the UK and Switzerland, mode 2 applies to you and your browser sends no Global Privacy Control signal, and you arrive from a Google ad, we keep the ad click identifier from that link in the cb_ad_click cookie. If you then sign up, we record that identifier with your sign-up and send Google Ads the identifier and the time of the sign-up, so we can tell which adverts lead to sign-ups. The cookie holds only your most recent ad click, is deleted once you sign in, and expires after 90 days. It is never set in mode 1, and it is not set for visitors in the EEA, the UK or Switzerland even if they accept analytics. Turning Analytics off deletes it.
When analytics cookies are allowed (outside the EEA, UK and Switzerland, or after you accept them there), we may also record how you use the signed-in app and our public pages (page layout, scrolling and clicks) so we can see where they are unclear. Anything you type into a form is masked and never recorded. These recordings are not made in the cookieless mode, are covered by the same opt-out, and are stored by PostHog under its retention settings.
How to opt out: Use the 'Your privacy choices' link in the footer of any page (visitors in the EEA, UK and Switzerland also see a banner), or, once signed in, your Profile → Privacy settings by toggling off "Analytics". We also honor Global Privacy Control (GPC) browser signals, which automatically decline all non-essential storage.
Activity while signed in. When you use the app while signed in, our servers record which features you use (not what you type) and send these events to PostHog to help us improve the service. If you have turned Analytics off, we still record these events but do not attribute them to you: they are sent under an identifier that changes every day and cannot be linked back to your account.
7.3 Complete Storage Reference
The following table lists all cookies and local storage keys used by CaymanBot:
| Name | Type | Category | Purpose | Duration |
|---|---|---|---|---|
| cayman_session | Cookie (HttpOnly, encrypted) | Essential | User session authentication | Session |
| oauth_state | Cookie (HttpOnly, Secure) | Essential | OAuth CSRF protection | Single request |
| tradeFilters | Cookie | Essential | Remember trade filter settings | 30 days |
| caymanbot-cookie-consent | localStorage | Essential | Remember cookie consent preferences | Persistent |
| caymanbot-theme-pref | localStorage | Essential | Theme preference (light, dark, or system) | Persistent |
| caymanbot-tour | localStorage | Analytics | Track guided tour completion | Persistent |
| referral_code | localStorage | Marketing | Campaign referral attribution | Until checkout |
| referral_attribution_code | localStorage | Essential (referral program) | Records which referral link you signed up with, so the referrer's reward under Terms 5.6 can be credited. Not used for analytics or advertising. | Until it is sent after sign-in (then deleted) |
| cb_login_hint | Cookie (first-party) | Essential | Carries the Google account you chose in Google's sign-in prompt to our sign-in step, so Google can skip its account chooser. Not used for analytics or advertising. | 2 minutes, deleted on use |
| cb_ad_click | Cookie (first-party) | Marketing | Your most recent Google ad click identifier and when you clicked, so a sign-up can be attributed to the ad (section 7.2). Scoped to .caymanbot.com. Set only outside the EEA, the UK and Switzerland, in mode 2 and without Global Privacy Control. |
90 days, deleted on sign-in or opt-out |
| ph_* | localStorage + Cookie | Analytics | PostHog user identification and session tracking. Scoped to .caymanbot.com, so it is shared between the marketing site and the app. Not set in mode 1 (section 7.2). |
1 year (cleared on opt-out) |
7.4 Email Communications
We send the following types of email communications:
- Transactional Emails: Account alerts, trade confirmations, and security notices. These are required for service operation and cannot be opted out of.
- Marketing Emails: Newsletters, product updates, and promotional content. These are opt-in only, and every marketing email includes an unsubscribe link.
Unsubscribe requests are honored within 10 business days as required by the CAN-SPAM Act. All emails include our physical mailing address. Email delivery is handled by SendGrid (Twilio) — see our sub-processor table in Section 4.1.
8. Children's Privacy
CaymanBot is not intended for users under 18 years of age. We do not knowingly collect information from children. If we discover that a child under 18 has provided us with personal information, we will delete it immediately.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. We ensure appropriate safeguards are in place for such transfers.
10. California Privacy Rights (CCPA)
California residents have additional rights under the California Consumer Privacy Act (CCPA). This section provides the required disclosures.
10.1 Categories of Personal Information Collected (Last 12 Months)
- Identifiers: Username/ID and email address from your OAuth provider, IP address; for users who link a brokerage account: brokerage account ID; for users who connect a Polymarket wallet: wallet addresses
- Financial Information: Subscription payment records (via Stripe); for users who link a brokerage account: account status and the orders you place through CaymanBot; for users who connect a Polymarket wallet: the prediction market orders you place and your deposit and withdrawal totals
- Internet/Network Activity: Usage data, browser type, session information, features accessed
- Sensitive Personal Information: For users who link a brokerage account only: the encrypted access token that lets CaymanBot reach that account at your direction; for users who connect a Polymarket wallet only: the encrypted trading credentials and session key for that wallet
10.2 Sources of Personal Information
- Directly from you (account creation, form submissions, orders you place)
- OAuth providers (profile information from Discord, X, TikTok, or Google)
- Your broker, if you link a brokerage account (account ID, status, and the access token it issues)
- Polymarket and the blockchain, if you connect a Polymarket wallet (your orders, balances and positions)
- Automatically via cookies, local storage, and server logs
10.3 Business Purpose for Collection
We collect personal information to provide our trading analytics service, process subscriptions, let you link your own brokerage account and place orders at your direction, improve our platform, and comply with legal obligations.
10.4 Third Parties with Whom Data Is Shared
- Stripe: Payment processing
- Your broker (if you link a brokerage account): Orders you place and requests to view your account
- Infrastructure providers (Hetzner, Cloudflare, Grafana Labs): Service hosting, content delivery, and service logs
- PostHog Inc.: Product analytics (account records; page measurement as described in section 7.2; and a record of each consent decision you make, including whether it came from you or from a Global Privacy Control signal sent by your browser)
10.5 Your CCPA Rights
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information held by us
- Right to correct inaccurate personal information
- Right to opt-out of the sale of personal information
- Right to non-discrimination for exercising your privacy rights
- Right to limit use and disclosure of sensitive personal information
10.6 Do Not Sell My Personal Information
CaymanBot does not sell your personal information. We do not sell, rent, or trade any personal data to third parties for monetary or other valuable consideration. If this practice ever changes, we will update this policy and provide a clear opt-out mechanism.
If you have questions about how your data is used, contact us at support@caymanbot.com.
10.7 Sensitive Personal Information
We may collect the following categories of sensitive personal information (SPI), solely for the purposes disclosed:
- Brokerage account access: If you link a brokerage account, the access token your broker issues, stored with AES-256-GCM encryption and used only to reach that account at your direction.
- Polymarket wallet access: If you connect a Polymarket wallet, its order book API credentials and any trading session key you authorize, stored with AES-256-GCM encryption and used only for the orders and actions you ask for.
Use of SPI is limited to what is reasonably necessary for the specific purpose for which it was collected.
10.8 Global Privacy Control
CaymanBot honors Global Privacy Control (GPC) browser signals as valid opt-out requests under the CCPA. When we detect a GPC signal, we automatically decline non-essential cookies and storage (analytics and marketing categories).
11. European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply under the General Data Protection Regulation (GDPR).
11.1 Data Controller
The data controller is CaymanBot, 1111B S Governors Ave #39622, Dover, DE 19904. Contact: support@caymanbot.com
11.2 Lawful Basis for Processing
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and service delivery | Contract performance (Art. 6(1)(b)) |
| Brokerage account linking and orders you place (if you link an account) | Contract performance (Art. 6(1)(b)) |
| Fraud prevention, security monitoring | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Essential cookies and session management | Contract performance (Art. 6(1)(b)) |
| Non-essential storage (analytics, marketing) | Consent (Art. 6(1)(a)) |
11.3 Cross-Border Transfers
Your data is stored on dedicated Hetzner servers in Germany (EU). For transfers to US-based processors (such as Stripe, PostHog, Cloudflare, Grafana Labs and SendGrid, and your broker if you link a brokerage account), we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) to ensure adequate protection.
11.4 Your Additional GDPR Rights
In addition to the rights listed in Section 6, you have the right to:
- Lodge a complaint with your local supervisory authority
- Withdraw consent at any time (without affecting the lawfulness of processing based on consent before withdrawal)
- Request data portability in a structured, commonly used, machine-readable format
11.5 Automated Decision-Making
Subscription tier features are gated by plan level. We do not engage in automated profiling that produces legal or similarly significant effects on you.
12. Changes to This Privacy Policy
We may update this Privacy Policy periodically. We will notify you of material changes by:
- Posting the new policy on our website
- Updating the "Last Updated" date
- Sending notifications through email or Discord
13. Contact Information
For privacy-related questions or concerns:
- Email: support@caymanbot.com
- Mail: CaymanBot, 1111B S Governors Ave #39622, Dover, DE 19904
- Discord: https://discord.gg/srhedBZe7C
- Response Time: We aim to respond within 48 hours
🛡️ Our Commitment
We are committed to protecting your privacy and maintaining the security of your information. We will never sell your data, and we only use it to provide and improve our services.
14. Data Protection Officer
While we are not required to appoint a formal DPO, all privacy concerns are handled by our privacy team and can be directed to support@caymanbot.com.
15. Consent
By using CaymanBot, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use our Service.