Privacy Policy
Last updated 1 October 2026
PMWallets (“PMWallets”, “we”, “us”), run by an independent developer, provides wallet- and entity-level trading data for Polymarket, with a leaderboard, real-time fill delivery for the entities you subscribe to, trade-history exports and wallet address unlocks at pmwallets.com (the “Service”). This policy explains what we collect, why, and the choices you have.
1. Data we collect
Account. You sign in with Google. From the Google ID token we keep Google’s stable account identifier, your email address, display name and avatar URL, and we record when you were last active. We do not receive your Google password and we do not request access to Gmail, Drive or any other Google data.
Billing. Card top-ups are processed by Stripe. Stripe receives your card details; we never receive or store your full card number or security code. We send Stripe your internal account id with each checkout, and store the checkout session id, payment id, amount, currency and status, together with the payment, refund and dispute notices Stripe sends us, which can include limited payment details such as card brand and country. Monthly plans (which include the browser extension) are also billed by Stripe: we create a Stripe customer for your account (with your email address and internal account id) and store its customer id, subscription id, status, plan, price and the current billing period. To allow one Base free trial per card, we store the card fingerprint Stripe provides for a card used to start a trial — a code that identifies the same card across accounts, not the card number — together with your account id and the subscription id. We keep it after your account is deleted, because its only purpose is to stop a second trial on the same card. Crypto top-ups are matched against deposits received at our exchange deposit address: we store the order amount, network, transaction id and the exchange deposit record, including deposits we could not match to an order.
Usage. Our web server logs the IP address, user agent, request path and timing of each request, and our application logs server errors, for abuse prevention and debugging. If you configure a webhook we store its URL, its signing secret and a record of each delivery (status, timing, retries, errors).
Activity. What you do with your account: your balance and its transactions, subscriptions, wallet addresses you have unlocked, trade-history exports you have ordered, daily usage counts that enforce limits, invitations, and the API keys you create (we store a hash of each key and its name, prefix and usage times, never the full key).
Public blockchain data. Wallet addresses, fills, positions and PnL shown on the Service are derived from public Polygon blockchain data. It is not something you provide to us. Depending on the law that applies and whether an address can be linked to a person, public data of this kind can still be personal data.
2. Google sign-in and Google user data
Signing in uses the OAuth 2.0 authorization-code flow. You are taken to Google’s own consent page, which names PMWallets and links this policy, and you choose whether to continue. We never see your Google password.
We request exactly three scopes and nothing else:
openid— the stable identifier Google uses for your account. We store it so that returning to PMWallets finds the same account even if you change your email address.email— your email address and whether Google has verified it. We store it to identify your account, to write to you about billing or a material change, and to answer a request about your data from the address that owns the account. We refuse a sign-in whose email Google has not verified.profile— your display name and avatar URL, shown to you in the account menu so you can tell which account you are signed in as.
That is the whole of it. We do not request, receive or store access to Gmail, Drive, Calendar, Contacts, Photos or any other Google service, and we ask for no offline access, so we hold no Google refresh token and cannot act on your behalf when you are not here.
How this data is used. Only to operate your account: to sign you in, to show you which account you are in, to bill the balance that account owns, and to contact you about it. We do not sell it, we do not use it for advertising or to build a profile, we do not share it with anyone for their own purposes, and we do not use it to train models. It is transferred only to the service providers listed in section 6 that operate the Service on our behalf and on our instructions (hosting, email delivery, internal notifications).
Deletion. Write to [email protected] from the address on your account and we delete the account, including the identifier, email, name and avatar URL that came from Google. Billing records that tax and accounting rules require us to keep are retained without a link to an active account. You can also revoke our access from your Google account permissions. That withdraws the Google grant but does not by itself sign you out of PMWallets (a session lasts up to 30 days) or delete your account; to do that, sign out and write to us.
PMWallets’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. The browser extension
The PMWallets browser extension runs only on polymarket.com. When you open a Polymarket profile page it reads the wallet address from the page address and sends that address to api.pmwallets.com, together with your extension key, to fetch the wallet’s labels and profile. When the page address is a username (polymarket.com/@name) instead of a wallet address, the extension first asks Polymarket’s public search service (gamma-api.polymarket.com) which wallet that username belongs to; that request goes to Polymarket, not to us, and contains only the username.
The extension does not read the content of the pages you visit, your browsing history or anything on other websites. It stores your extension key and a short-lived cache of recent answers in your browser’s extension storage; the key is sent only to api.pmwallets.com.
On our side we record, for your account, which wallet addresses the extension looked up on each day (to enforce the daily limit), and for each extension key its name, prefix, a hash of the key and when it was created, last used or revoked. We keep these while your account exists. We do not sell this data or use it for advertising.
4. Cookies and analytics
We set a first-party, httpOnly session cookie when you sign in, lasting up to 30 days, and a few short-lived cookies (up to 10 minutes) that protect the sign-in itself. Your browser’s local storage remembers small interface choices, such as whether you have dismissed the invitation banner. We do not use advertising cookies or tracking pixels.
Google Analytics. We use Google Analytics 4 to count visits and see which pages and features are used. It sets its own first-party cookies (such as _ga) and sends Google the page you are on, the page you came from, your browser and device type, and a small set of product events: starting a sign-in, subscribing, starting a card or crypto top-up (with its amount) and adding a webhook. A wallet address is never part of that. A wallet’s page has its address in the URL, so before anything is sent the address is replaced with a placeholder (/e/[entity]) in your browser, and the query string is dropped entirely — Google is told that an entity page was viewed, never which one. We do not send your name, email address or account id to Google Analytics, and we do not use it for advertising. Google processes your IP address to derive an approximate location. You can block it with a content blocker or the Google Analytics opt-out add-on; the Service works the same without it.
Cloudflare. pmwallets.com is served through Cloudflare, which may set a strictly necessary cookie to tell people from automated traffic, and whose Web Analytics measures page visits and load times without cookies.
Signing in sends you to Google’s own page, which sets its own cookies under Google’s policy.
5. How we use data
- to operate your account, balance, subscriptions and deliveries;
- to process payments, credit deposits and resolve refunds or disputes;
- to keep the Service secure, rate-limit abuse and diagnose faults;
- to contact you about your account, billing or material changes to the Service.
We do not sell personal data and we do not use it for advertising.
6. Who we share data with
- Google for sign-in (Google Privacy Policy applies);
- Stripe for card payments, refunds and dispute handling;
- Binance, whose deposit history we read to match crypto top-ups;
- Google Analytics for the usage statistics described in section 4;
- Brevo, which delivers the emails we send you: for an export, it receives your email address, the order number, date range, row and entity counts, file size and a link to your order history (never the download link itself);
- Cloudflare, which carries traffic to pmwallets.com (the API at api.pmwallets.com is reached directly) and stores export files and database backups for us; the backups are full copies of our database, including accounts, balances and orders;
- Telegram, which carries internal notifications to our own staff; a top-up notification includes the account email, the amount, the resulting balance, the order id and, for crypto, the network and transaction id;
- Hostinger, which hosts our servers, and other infrastructure providers such as the blockchain nodes we query;
- the webhook endpoint you choose, which receives the fills you subscribe to under its operator’s own policy;
- authorities where the law requires it.
7. Links to other sites
The Service links to other websites, including OutcomeTick, a prediction-market data service operated by a partner. When you follow such a link, your browser may tell that site that you came from pmwallets.com, and it sees ordinary request information such as your IP address and browser details. We do not add your account id, email address or any other identifier to the link, your PMWallets account does not carry over, and the other site’s own privacy policy applies there.
8. Retention
Account and billing records are kept while your account exists and for as long as tax, accounting and dispute rules require afterwards. Web server logs are rotated automatically by size, so older entries are overwritten. Webhook delivery records and export files you have bought are kept while your account exists, so you can check deliveries and download files again. Database backups are kept for 10 days, so data deleted from the live database can remain in a backup for up to 10 days. You can ask us to delete your account; billing records that we must keep by law are retained but no longer linked to an active account.
9. Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account. Write to [email protected] from the email address on your account. Depending on where you live you may also have the right to complain to a data protection authority.
10. Security
Traffic to the Service is encrypted with TLS. Session cookies are httpOnly and same-site. Secrets and payment credentials are stored outside the code base with restricted access. No system is perfectly secure; if we learn of a breach affecting your data we will notify you.
11. Children
The Service is not directed at anyone under 18 and we do not knowingly collect data from them.
12. Changes
We will post changes to this policy on this page and update the date above. Material changes will also be announced in the Service.