Privacy Policy

This Privacy Policy explains how OpenMarket ("we", "our", or "us") collects, uses, stores, and protects your information when you access or use openmarket.xyz (the "Platform").

By accessing or using the Platform, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Account Information

We collect the following information when you interact with the Platform:

• Email address (if provided)
• Username or display name
• Connected social accounts (e.g., X)
• Referral information (e.g., referral codes or links, and relationships between referred users)
• Saved user interface preferences, watchlists, layouts, indicators, alerts, and personalized settings

1.2 Wallet and Trading Key

The execution functionality of the Platform works with a wallet you already control. OpenMarket does not create the wallet that holds your funds and never receives its seed phrase or private key. When you connect a wallet, we collect:

• Wallet Address: The public address of the wallet you connect, and any public address you choose to watch.
• Authorization Records: Your acceptance of the wallet and execution terms, and the session metadata required to keep your account secure.
• Venue Activity: Orders, fills, positions and funding that the venue records for the wallet addresses you connect or watch. This data is public on the venue and its blockchain.

Note on Private Keys: The trading key you authorize for order entry is generated and stored in your browser; its private key is never sent to us. We never hold your wallet's private key or seed phrase, or the trading key's private key.

1.3 Brokerage Account Connection

Brokerage Execution works with a securities account you hold at a supported brokerage. You sign in on the brokerage's own website and authorize the Platform there; your brokerage password and API keys are never entered into or received by the Platform. When you connect a brokerage account, we collect:

• Account Identifier: The brokerage's identifier for the connected account, whether it is a live or a paper account, and the connection's status, so the Platform can show which account is linked.
• Authorization Records: Your acknowledgement of the brokerage's disclosure and of the Terms governing the connection, and the session metadata required to keep your account secure.
• Account Activity Displayed to You: Balances, buying power, orders, fills and positions that the brokerage returns to your browser while the account is connected. This data is shown to you in the Platform and is not stored on our servers.

Note on the access token: The token the brokerage issues to the Platform is kept in your browser. It passes through our server once, at the moment it is issued, and is not stored or logged there.

1.4 Trading & Interaction Data

To provide analytics and order entry, we collect:

• Markets viewed
• Charts, indicators, and analytics interacted with
• Search queries
• Orders you place on a supported venue with a connected wallet. Orders and fills in a linked brokerage account are recorded by the brokerage, not by us.
• Linked Polymarket markets and positions
• Performance metrics, error logs and execution diagnostics from the Platform interface

1.5 Technical Information

We automatically collect:

• IP address
• Browser type and version
• Device identifiers
• Operating system
• Approximate geolocation (derived from IP; we store only the country code for compliance and restriction enforcement)
• Session logs (e.g., records of user activity during a visit, such as timestamps, page views, and interactions), error logs, crash reports

1.6 Cookies & Local Storage

We use cookies or browser storage to:

• Maintain user sessions
• Save chart settings and UI preferences
• Store layouts, watchlists, and indicator configurations
• Improve performance and analytics

Cookie Types (EU-Compliant Classification)

We use two categories of cookies:

Session Cookies

• Temporary cookies that expire when you close your browser.
• Used for authentication, routing requests, and ensuring the Platform loads correctly.

Persistent Cookies

• Remain on your device after the session.
• Used to store settings, layouts, user preferences, and analytics necessary for performance and reliability.

Impact of Disabling Cookies

If cookies are disabled, key Platform features—such as chart layouts, analytics tools, indicator settings, watchlists, and login persistence—may not function properly or may fail entirely.

Do Not Track

Your browser may allow you to send a "Do Not Track" (DNT) signal. The Platform does not currently respond to DNT requests due to the absence of industry standards.

Third-Party Analytics & Communications (PostHog)

We use PostHog, a privacy-focused analytics and messaging provider, to understand user behavior, diagnose issues, improve performance, and send product and marketing communications to users who have opted in. For these purposes PostHog acts as our data processor and receives your email address and communication preferences alongside usage data. PostHog may use cookies or local storage but does not receive private keys, identity documents, or financial information. You can opt out of marketing communications at any time via the unsubscribe link in any email.

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Platform
• Authenticate users and manage login sessions
• Connect your wallet and record your acceptance of the wallet and execution terms
• Show the orders, fills and positions of the wallets you connect or watch on supported venues
• Show the balances, orders, fills and positions of a brokerage account you connect
• Display analytics, leaderboards, preferences, and personalized content
• Detect and prevent fraud, abuse, and unauthorized access
• Enforce geo-restriction and compliance requirements
• Ensure platform security and performance
• Communicate with you regarding updates or support, including marketing communications where you have opted in
• Comply with applicable laws and regulatory requirements

We may also create aggregate, anonymized, or de-identified datasets derived from your information. Such information cannot reasonably identify you and may be used for analytics, research, product development, or publications.

3. Legal Bases (GDPR Where Applicable)

If you reside in the EEA, we process your information on the basis of:

• Performance of a contract
• Legitimate interests (security, fraud prevention, analytics)
• Consent (cookies, marketing)
• Compliance with legal obligations

4. How We Share Information

4.1 Execution Venues

Orders are signed on your device and sent by your device directly to Hyperliquid. The venue receives your wallet address, the public address of your trading key and the order itself, and records orders, fills and positions on its own blockchain under its own privacy terms. We do not relay orders to a venue on your behalf.

We never share private keys or seed phrases.

Under Brokerage Execution, orders are sent by your device directly to Alpaca Securities LLC, the brokerage that holds your account. The brokerage receives the orders you enter and records them, together with your account activity, under its own privacy policy and customer agreement. We do not relay orders to the brokerage on your behalf and do not receive your brokerage login credentials.

4.2 AI Assistants and MCP

You can connect an AI assistant, such as ChatGPT or Claude, to your account through our MCP (Model Context Protocol) server. When you ask a connected assistant to use one of our tools, we send the result of that tool to the company that provides the assistant. A result can include market data and information from your account. That company handles it under its own terms and privacy policy, not this one.

Some assistants also ask for the email address on your account when you connect them. The connect screen says so, and we share the address only if you approve.

We send nothing to an AI assistant unless you connect it. You can disconnect an assistant or revoke its access at any time in Console > Agents at openmarket.xyz/chart/console/agents. Disconnecting ends the current session, and the assistant can connect again. Revoking ends its access until you connect it again.

4.3 Service Providers

We use trusted third-party service providers for:

• Cloud hosting
• Databases and analytics
• Error monitoring (e.g., Sentry)
• Authentication and session management
• Customer support tools

All service providers are bound by confidentiality obligations.

4.4 Business Transfers

We may transfer your information in connection with mergers, acquisitions, financings, reorganizations, bankruptcy events, asset sales, or similar corporate transactions. We will take reasonable steps to ensure the recipient upholds the commitments of this Privacy Policy.

4.5 Legal & Compliance

We may share information when:

• Required by applicable law
• Necessary to enforce our Terms of Service
• Needed to investigate fraud, security incidents, or abuse

4.6 No Selling of Data

We do not sell personal data, including wallet addresses, trading history, or analytics.

5. Data Security

We implement industry-standard measures:

• Encryption in transit and at rest
• Browser-side generation and encryption of trading keys; no key material reaches our servers
• Access controls and audit logging
• Segregated production and development environments
• Automated vulnerability scanning of container images and dependencies
• Secure internal API communication

No online system is fully secure, but we will notify affected users of any material breach in accordance with applicable law.

6. Data Retention

• Records of orders placed on a venue with a connected wallet: 5–7 years
• Orders and fills in a linked brokerage account: not recorded on our servers
• Device logs and analytics: 30–365 days
• UI preferences: until deleted or account closed
• Wallet addresses and trading-key authorization records: until account closure
• Brokerage account identifiers and connection records: until you disconnect the account or close yours

We will delete or anonymize personal data upon request where legally allowed.

7. International Transfers

Your information may be processed in:

• United States
• European Union
• Singapore
• Other regions where service providers operate

We apply safeguards such as Standard Contractual Clauses where appropriate.

8. Geo-Restrictions & Compliance Enforcement

Wallet Execution is disabled for Restricted Persons as defined in our Terms of Service. The current list of restricted jurisdictions is the one published in the Terms and includes:

• United States
• Malaysia
• Jurisdictions subject to comprehensive economic sanctions, including Cuba, Iran, North Korea and Syria

We use the country of your network connection to enforce these restrictions, and may use device metadata or other indicators to detect circumvention.

Attempts to circumvent geo-blocking may result in suspension or wallet limitations.

Brokerage Execution is not subject to this list. Eligibility to hold a brokerage account, and the countries in which the brokerage accepts customers, are decided by the brokerage under its own agreement and applicable law.

9. User Rights

Depending on jurisdiction, you may have the right to:

• Access your data
• Correct inaccurate data
• Request deletion
• Request data export
• Object to processing
• Withdraw consent (where applicable)

Contact [email protected] to exercise these rights.

10. Wallet Limitations & Security

You use the Platform with a wallet you control. Please acknowledge the following:

• Key Management: Your wallet's private key stays with your wallet provider, and the trading key you authorize is generated and stored in your browser. We hold neither key.
• Account Security: You are responsible for securing your wallet, your device and the browser profile that holds the trading key; anyone with access to your unlocked device during the key's validity can place orders on your account.
• Irreversibility: Blockchain transactions executed via the Platform are irreversible once submitted to the network. We cannot reverse, cancel, or modify on-chain activity.

11. Children's Privacy

The Platform is not intended for users under 18.

We do not knowingly collect data from minors.

12. California Privacy Notice (CCPA/CPRA)

California residents have the right to:

• Request access to categories or specific pieces of personal information
• Request deletion (subject to legal exceptions)
• Request correction of inaccurate information
• Know whether information is disclosed and to whom
• Opt out of the sale or sharing of personal information (we do not sell data)

Submit requests to [email protected].

We may request identity verification before processing.

Under Civil Code §1798.83, California residents may request information regarding disclosures for direct marketing purposes once per calendar year.

13. Changes to This Privacy Policy

We may update this Policy periodically.

The "Last Updated" date will reflect changes.

Material updates may be communicated via email or in-app notification.

14. Contact Us

For privacy-related inquiries, please contact us by e-mail at [email protected].