Privacy Policy

This Privacy Policy describes how Sygn Labs ("Sygn," "we," "us") collects, uses, shares, and protects information in connection with the Sygn website, application, and related services (collectively, the "Service"). It applies to you whether you visit our landing page, log in, trade, or interact with the Service in any other way.

2.1 Information you provide

• Authentication identifiers. When you log in via Privy, we receive an account identifier and any identifier you used to authenticate (such as an email address, social-account handle, or phone number). The underlying credentials (passwords, OAuth tokens, recovery secrets) are handled by Privy and are not visible to us.
• Wallet addresses. The public address of any wallet you connect or that is provisioned to you (including embedded wallets created via Privy).
• Trading inputs. Orders, positions, slippage settings, market selections, and other inputs you submit through the Service.
• Communications. Information you send to us via support channels or email.
• Invite or referral codes. Codes you enter or share through the Service.

2.2 Information we collect automatically

• Device and connection data. IP address, user-agent string, device type, operating system, browser, language, and approximate location derived from IP.
• Usage data. Pages and features viewed, clicks, scroll depth, session duration, referrers, error events, and similar interaction data.
• Server and security logs. Request timestamps, endpoints accessed, response codes, rate-limit and abuse signals, and similar diagnostic data.
• Aggregate event counts. Our servers record that key product events happened (for example a completed signup, deposit, or trade) as anonymous counters — bucketed amounts only, with no account identifier, wallet address, IP address, or cookie attached.
• Cookies and local storage. Used for authentication, session management, preferences, caching, and basic analytics. See "Cookies" below.

2.3 Information from third parties

• Privy — authentication metadata and embedded-wallet information.
• Polymarket — market data, order-book state, fills, and on-chain trade history associated with your wallet address.
• Public blockchains (Polygon and others) — on-chain transactions, balances, approvals, and other publicly observable activity associated with your wallet.
• News, social, and data providers — public posts and articles surfaced as signals or context within the Service.
• Cloudflare and infrastructure providers — security and abuse signals.

We use the information we collect to:

• Operate, maintain, and provide the Service, including authenticating you, displaying your positions and balances, and submitting orders you initiate.
• Generate AI-derived signals, summaries, and market matches.
• Calculate and collect platform fees.
• Personalize your experience (such as defaults, watchlists, and notifications).
• Monitor, secure, and improve the Service, including troubleshooting, analytics, abuse and fraud prevention, and rate limiting.
• Comply with applicable laws, enforce our Terms of Service, and respond to lawful requests.
• Communicate with you about the Service, including service notices and changes.

Where applicable law requires a legal basis for processing personal data, we rely on:

• Performance of a contract — to provide the Service you request.
• Legitimate interests — to secure, improve, and develop the Service, prevent abuse, and run our business, where those interests are not overridden by your rights.
• Legal obligation — to comply with laws and lawful requests.
• Consent — where we ask for it (for example, certain optional cookies or communications). You may withdraw consent at any time.

We do not sell your personal information. We share information only as follows:

• Service providers and processors who run infrastructure on our behalf, including Privy (authentication and embedded wallets), Cloudflare (edge and security), database and hosting providers, RPC and blockchain-data providers, Anthropic (AI features), email/notification providers, and PostHog (product analytics, hosted in the European Union — see "Cookies" below). They are bound by contractual confidentiality and data-protection obligations.
• Polymarket and the underlying blockchain — when you submit an order or sign a transaction, the relevant data is transmitted to Polymarket and broadcast on-chain. Once on-chain, that data is public, permanent, and outside our control.
• Deposit, on-ramp, and bridging providers (such as Funkit/Swapped and Polymarket's bridge infrastructure) when you initiate a deposit.
• Legal, safety, and compliance — to comply with applicable law, lawful requests from authorities, court orders, or to protect the rights, property, or safety of Sygn, our users, or others, including for fraud prevention and sanctions screening.
• Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards.
• With your direction or consent — for example, when you publicly share content or opt into a feature that requires sharing.

Wallet addresses, balances, approvals, trades, and positions on Polymarket are recorded on public blockchains and on Polymarket's public order books. This data is inherently public, queryable by anyone, and cannot be deleted or made private by Sygn. Anyone who learns of an address you use can view its full on-chain history, including activity that pre-dates or post-dates your use of Sygn.

We and our service providers use cookies, local storage, and similar technologies in two categories:

• Strictly necessary (always active). Authentication and session state (Privy), security and abuse prevention (Cloudflare, including Turnstile challenges), performance caching, and your saved preferences (such as default slippage, layout, and theme). The Service cannot function without these.
• Analytics (only with your consent). Product analytics via PostHog, hosted in the European Union and served through our first-party subdomain (ph.sygn.trade). This measures feature usage and reliability and includes session replay with all inputs masked. These technologies are set only after you accept them via the cookie notice.

You can accept or decline analytics when the cookie notice first appears, and change your choice at any time via cookie settings or your browser settings. Declining analytics does not affect core functionality; disabling strictly necessary cookies will break authentication.

We retain personal information for as long as needed to provide the Service and for the purposes described in this Policy, unless a longer retention period is required or permitted by law. Examples:

• Account, wallet, and trading records are retained while your account is active and afterward as needed for legal, compliance, audit, fraud-prevention, and dispute-resolution purposes.
• Raw webhook and event logs used for ingestion are retained for a short operational window (currently approximately 2 days) before being summarized or discarded.
• Server, security, and analytics logs are retained for a limited period appropriate to their purpose.

On-chain data is permanent and not subject to our retention controls.

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, network protections, access controls, and regular review of our infrastructure. No method of transmission or storage is perfectly secure, and we cannot guarantee the security of your information. You are responsible for safeguarding the credentials, devices, and recovery methods used to access the Service and any wallet associated with your account.

We and our service providers may process your information in countries other than your own, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information, subject to legal and operational exceptions.
• Object to or restrict certain processing.
• Receive a portable copy of certain information.
• Withdraw any consent you have given.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact us at privacy@sygn.trade. We may need to verify your identity before responding. We cannot delete or modify on-chain data, data held by Polymarket, or data held by other independent third parties.

The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

The Service does not respond to browser "Do Not Track" signals, as no consistent industry standard exists. You can manage tracking through cookie controls and browser settings as described above.

The Service may link to or embed third-party sites and services. Their privacy practices are governed by their own policies, not this one. We encourage you to review them.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date and may provide additional notice in-app. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Questions or requests about this Privacy Policy can be sent to privacy@sygn.trade.