Privacy Policy

• Account details. Your email address, account identifier, sign-in information and profile details. When you use Google sign-in, these can include your Google account identifier, name, email address and profile picture. We never receive your Google password.
• Beliefs and research. The thesis you submit, a report you choose to use to create a belief, generated research, baskets and build history. We also receive information you send when contacting support.
• Wallet and transaction details. Wallet addresses, balances, orders, positions, deposits, withdrawals, transaction identifiers and fees associated with your use of ArbWick.
• Usage and technical information. Pages visited, actions taken, device and browser information, IP addresses, approximate location derived from IP addresses, diagnostic logs and error reports. When enabled, analytics can include session recordings as described below.

• To create and authenticate your account, maintain your session and help protect against misuse.
• To research your thesis, build and display beliefs, and provide the features you request.
• To connect your wallet, submit authorized transactions, show balances and positions, and record and collect agreed fees.
• To answer support requests, diagnose problems and understand and improve how the service works.
• To comply with applicable legal obligations, resolve disputes and enforce our Terms of Service.

Where applicable data protection law requires a legal basis, we process information to provide the services you request under our agreement, to meet legal obligations, and for legitimate interests such as securing the service, preventing fraud and improving reliability, subject to your rights. Where processing requires consent, that consent must be obtained separately; reading this policy does not provide it. You can withdraw consent for processing based on consent by contacting us.

Google sign-in is handled through Supabase. It lets us identify you and create or access your ArbWick account. Our sign-in flow does not request access to your Gmail messages, Google Drive files, contacts or calendar. Account details may also be used for support, security and the account-linked diagnostics and analytics described in this policy.

We do not sell Google account information, use it for targeted advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its applicable Limited Use requirements.

You can review or revoke Google sign-in access in your Google Account connections. Revoking access does not by itself delete your ArbWick account or information already held by us; contact [email protected] to request deletion.

A completed belief can be published for anyone to view, including visitors who are not signed in. Its thesis, generated research, basket and index can appear on public pages and in search engines. Do not submit confidential or personal information you do not want included in a public belief.

Wallet addresses and blockchain transactions are public. Other people may connect this activity with information available elsewhere. Deleting an account cannot remove blockchain records or copies of public content held by other people or search engines.

We do not sell personal information. We disclose information to the providers needed to operate the features you use:

• Supabase provides authentication and stores account, application and transaction records.
• Privy provides the embedded wallet. Card purchases of USDC use its payment partner, Stripe. These providers may collect payment and identity-verification information directly under their own policies. ArbWick does not receive or store your full card details.
• OpenAI and Google process submitted theses, selected reports and research context to research and build beliefs. Research can use their web-search tools, which receive queries derived from your request. We do not use submissions to train our own general-purpose AI models; provider processing and retention are governed by the terms and settings applicable to their services.
• Hyperliquid and Polymarket receive wallet information, signed orders and other requests needed for trading, funding and position information. Their services have separate terms and privacy policies.
• Cloudflare and Railway host and deliver the website and server. Resend delivers service emails.
• Sentry and PostHog, when enabled, receive diagnostic or usage information. This can be associated with your account identifier, email address and account attributes.
• Blockchain node and bridge providers process balance lookups and transfers. Direct browser requests can disclose your IP address and wallet address to those providers.

We may disclose information when required by law, to protect rights and security, or to investigate fraud or misuse. Providers may process information in countries other than yours. Contact us for information about processing locations and applicable safeguards.

ArbWick and its providers use cookies and browser storage to maintain sign-in sessions, remember preferences, operate wallet features and, when enabled, measure usage. Trading credentials and trade-only session keys may be stored on your device to support transactions you authorize.

PostHog can record page interactions and visible page content. We configure input masking and block wallet and payment dialogs from PostHog recording. This does not mean every piece of displayed content is hidden. Sentry can also record sessions around errors when its replay feature is enabled, with input masking.

You can manage cookies and site storage through your browser. Blocking or clearing them can sign you out or require wallet permissions to be set up again.

Privy provides your embedded wallet. Its private key is not sent to Arbwick’s servers; signing happens through the wallet. Device-held trading credentials are separate from your main wallet key. Keep your email, Google account and devices secure, because access to your account can enable access to your wallet.

We use authentication, access controls and encrypted connections to protect information. No internet service can guarantee complete security.

We retain account and service records for as long as needed to provide ArbWick, maintain transaction history, support users, protect against misuse and meet legal, accounting and dispute-related obligations. Retention depends on the type of record, its purpose and applicable requirements; closing an account does not instantly erase all records or backups.

When information is no longer needed, we delete it or remove identifying details. Public blockchain records cannot be erased by Arbwick. Public beliefs and copies retained by third parties may remain available after an account is closed.

Write to [email protected] to request access to, a copy of, correction of, or deletion of your personal information or account. We may need to verify your identity and explain any information we must retain. Never send us your password, wallet private key or recovery phrase.

Before requesting account closure, arrange access to your wallet and address any remaining funds or open positions. Deletion does not withdraw funds, close trades or reverse transactions for you.

Depending on where you live, you may also have rights to object to processing, restrict it, receive portable data or withdraw consent where processing relies on consent. You can complain to your local data protection authority. We assess requests under the laws that apply to you.

ArbWick is for people aged 18 and over. We do not knowingly collect personal information from children under 18. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

We update the date above when this policy changes and provide notice of material changes where required. Arbwick Inc. is responsible for the personal information described in this policy. Questions and privacy requests: [email protected].