Privacy Policy

Arbitix is a prediction markets data aggregator operated by Jhonatan Junio. Our platform aggregates publicly available market data from third-party prediction market platforms — including Polymarket, Kalshi, Metaculus, Manifold, and PredictIt — and presents it in a unified, comparable dashboard.

For all privacy-related matters, including data subject requests, you can reach us at:

• Email: founder@arbitix.io
• Website: arbitix.io

We are committed to complying with the General Data Protection Regulation (GDPR) for users in the European Economic Area and the California Consumer Privacy Act (CCPA) for California residents.

We collect only the information necessary to provide and improve the Service. Below is a breakdown by category.

Account Data

When you register or sign in via Google OAuth, we receive and store:

• Email address
• Full name (as provided by your Google account)
• Profile picture URL (as provided by your Google account)
• Account creation timestamp and last sign-in timestamp

Usage Data

As you interact with the Service, we automatically collect information about your activity, including:

• Pages and features visited within the platform
• Search queries entered in the market search interface
• Markets viewed and time spent on each market detail page
• Filter and category selections applied to the dashboard
• Actions such as adding markets to your watchlist or creating price alerts

Device Data

We collect technical information about the device and connection used to access the Service:

• Browser type and version
• Operating system
• IP address (used for fraud prevention and approximate geolocation)
• Device identifiers (for push notification delivery via OneSignal)
• Referring URL

Alert and Watchlist Data

If you use our alert or watchlist features, we store:

• Markets you have added to your watchlist
• Alert configurations (market ID, probability threshold, direction, delivery channel)
• Alert trigger history (timestamps and values at time of trigger)

Payment Data

Subscription payments are processed by Stripe. We do not store your card number, CVV, or full payment card details on our servers. We receive and store from Stripe only:

• Stripe Customer ID
• Subscription plan and status
• Billing period and renewal date

Communication Data

If you contact us via email or submit feedback through the Service, we retain:

• Your email address and message content
• Timestamps of correspondence
• Any attachments or context you provide

Directly from You

We collect account data when you register for the Service, sign in via Google OAuth, configure alerts or watchlists, or communicate with our support team.

Automatically

When you use the Service, certain data is collected automatically through:

• Cookies and local storage — session authentication tokens, user preferences, and consent choices
• Server logs — IP address, request timestamps, and HTTP response codes recorded by our hosting infrastructure (Vercel)
• Analytics instrumentation — page views and feature usage events collected through Vercel Analytics
• Push notification tokens — device registration tokens collected by OneSignal when you opt in to browser push notifications

From Third Parties

When you choose to sign in with Google, we receive profile data (name, email, profile picture) from Google's OAuth service. We do not receive your Google password or access to your other Google account data. No other third parties supply us with personal data about you.

Market Data

The prediction market data displayed on the platform (questions, probabilities, volume, and metadata) is publicly available data aggregated from third-party prediction market platforms. This data is not personal data and is not associated with individual users on our platform.

For users in the European Economic Area (EEA), we rely on the following legal bases under Article 6 of the GDPR:

Contract Performance (Art. 6(1)(b))

Processing your account data, alert configurations, and watchlist data is necessary to provide the Service you have signed up for. Without this processing, we cannot create your account, deliver alerts, or maintain your saved preferences.

Legitimate Interests (Art. 6(1)(f))

We process device data and usage data on the basis of our legitimate interest in:

• Maintaining the security and integrity of the platform
• Understanding how users interact with the Service to improve it
• Detecting and preventing fraud or abuse
• Sending transactional communications (e.g., alert notifications, account emails)

We have conducted a balancing test and believe these interests do not override your fundamental rights and freedoms.

Consent (Art. 6(1)(a))

We rely on your consent for:

• Browser push notifications (you explicitly opt in via the browser permission prompt)
• Non-essential analytics cookies (where applicable under local law)
• Marketing communications beyond transactional messages

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Legal Obligation (Art. 6(1)(c))

Payment records and certain transaction data are retained to comply with applicable financial and tax regulations.

Service Delivery

• Authenticating your identity and maintaining your session
• Storing and displaying your watchlist and alert configurations
• Triggering and delivering price alerts via email, push notification, and in-app notification
• Processing and managing your subscription through Stripe

Personalization

• Remembering your dashboard filter preferences and settings
• Surfacing markets relevant to your watchlist and alert activity

Analytics and Product Improvement

• Understanding which features are most used to prioritize development
• Identifying and fixing bugs, errors, and performance bottlenecks
• Producing aggregated, anonymized usage statistics (these statistics do not identify you)

Security

• Detecting and preventing unauthorized access, fraud, and abuse
• Monitoring for anomalous activity patterns
• Maintaining audit logs for incident investigation

Communications

• Sending transactional emails (welcome email, alert triggered, account changes)
• Responding to support requests and feedback
• Notifying you of material changes to this policy or the Terms of Service

Legal Compliance

• Complying with applicable laws, regulations, and court orders
• Exercising or defending our legal rights

We share data only with the following service providers who process it strictly on our behalf and under data processing agreements:

Other Disclosures

We may also disclose your information in the following limited circumstances:

• Legal requirements: When required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights or the safety of others
• Business transfers: In connection with a merger, acquisition, asset sale, or similar transaction, provided the successor entity agrees to honor this policy
• With your consent: For any purpose you explicitly authorize at the time of disclosure

We retain your data only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, and resolve disputes.

When a retention period expires, data is securely deleted or irreversibly anonymized. You may request earlier deletion; see Section 8 for how to exercise that right.

GDPR Rights (EEA Users)

If you are located in the European Economic Area, you have the following rights under the GDPR:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to certain legal exceptions
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another controller
• Right to restriction of processing: Ask us to limit the ways in which we use your data while a dispute is resolved
• Right to object: Object to processing based on legitimate interests, including for direct marketing
• Rights related to automated decision-making: We do not currently make solely automated decisions with legal or significant effects on you

CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the CCPA:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell or share your personal data for cross-context behavioral advertising; this right does not currently apply, but we respect it unconditionally
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights

How to Exercise Your Rights

To submit a request, email us at founder@arbitix.io with the subject line "Privacy Request" and a description of your request. We may need to verify your identity before processing the request.

• GDPR response time: We will respond within 30 days. In complex cases we may extend by an additional 60 days and will notify you.
• CCPA response time: We will respond within 45 days, with one 45-day extension available if reasonably necessary.

Right to Lodge a Complaint

EEA users have the right to lodge a complaint with their local data protection authority if they believe we have violated their rights. We encourage you to contact us first so we can address your concerns directly.

Arbitix is operated from Brazil and our service providers are primarily located in the United States. If you are accessing the Service from the EEA, United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

For transfers of personal data from the EEA to the United States, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): Where our service providers are not covered by an adequacy decision, we enter into the European Commission's approved Standard Contractual Clauses to ensure an adequate level of protection
• Adequacy decisions: Where available, we transfer data to countries recognized by the European Commission as providing an adequate level of data protection

By using the Service, you acknowledge that your data may be transferred to, stored in, and processed in the United States. We take all steps reasonably necessary to ensure your data is treated securely in accordance with this policy.

We use cookies and similar technologies (such as localStorage) to operate and improve the Service. Below is a description of the cookies we use.

Essential Cookies

These cookies are required for the Service to function. They cannot be disabled without breaking core features.

• Authentication session cookie: Set by Supabase Auth to keep you signed in across pages. Expires when your session ends or after an inactivity period.
• CSRF protection token: Used to prevent cross-site request forgery attacks.

Analytics Cookies

These cookies help us understand how users interact with the Service so we can improve it. They collect data in an aggregated form that does not directly identify you.

• Vercel Analytics: Tracks page views and Web Vitals performance metrics. No personally identifiable information is sent to Vercel Analytics.

Preference Cookies

These cookies remember choices you have made to personalize your experience.

• Dashboard filter preferences (selected platform, category, and sort order)
• Notification preference toggles

Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and be notified when a new cookie is set. Note that disabling essential cookies will prevent you from signing in and using authenticated features. For instructions specific to your browser, consult your browser's help documentation.

The Service is not directed to individuals under the age of 16 years old. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at founder@arbitix.io. Upon verification, we will delete the information as promptly as possible.

If we learn that we have inadvertently collected personal information from a child under 16 without parental consent, we will take immediate steps to delete that information from our records and, where applicable, notify the relevant authorities.

Updates to This Policy

We reserve the right to update this Privacy Policy at any time. When we make changes, we will revise the "Last updated" date at the top of this page.

• Material changes (such as changes to data categories collected, new sharing arrangements, or changes to your rights) will be communicated with at least 30 days' notice via a prominent notice on the Service and/or an email to your registered address.
• Minor changes (such as clarifications, grammar corrections, or updated provider names) will be posted without advance notice.

Your continued use of the Service after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should stop using the Service and may request deletion of your account.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

• Email: founder@arbitix.io
• Website: arbitix.io

We aim to acknowledge all inquiries within 2 business days and resolve them as quickly as practicable.