Privacy Policy

Last updated 2026-04-28.

What we collect

Telegram identifiers, your numeric Telegram user ID and chat ID, captured when you run /start. Used to route alerts and store per-user state.
Telegram username (if set), stored alongside your user ID for display/support purposes.
Trading state, wallets you watch, copy targets, snipes, paper-mode positions, fee ledger entries, referral attribution, and tracked referral credits. All linked to your Telegram user ID.
Live-mode credentials, when you go live, the bot stores the per-user smart wallet signer and Polymarket L2 API credentials encrypted at rest (Fernet) so it can submit the copy, withdrawal, auto-redeem, and fee-sweep actions you enable.
Audit log, timestamp, your user ID, the command you invoked. We do not log the content of your messages or the parameters of your commands beyond the command name.

What we don't collect

We do not request your external wallet seed phrase or private key.
We do not pool user funds in a shared operator wallet.
We do not collect your Telegram phone number, contacts, or messages outside the bot.
No third-party analytics or trackers on this site.

Where it's stored

All data lives on a single VPS in Dublin, Ireland (EU). No third-party storage providers. No data leaves the server except for outbound API calls to Polymarket and on-chain WebSocket subscriptions to Polygon.

Sharing

We do not share, sell, or rent your data to anyone. We may disclose data only if compelled by lawful court order in our jurisdiction.

Retention

Per-user state is retained while your account is active. The audit log keeps the most recent ~100,000 entries, then rolls. You can request deletion of your account by contacting @PolyTortoise_bot.

Security

Live-mode credentials are encrypted at rest with Fernet (AES-128 CBC + HMAC-SHA256). The master key lives only on the operator's VPS environment, never in source control. SSH access to the host is key-based only.

Questions? Reach out via @PolyTortoise_bot.