Privacy Policy

Effective date: 2026-10-29

Data We Collect

• Account data: email address, display name, password hash
• Service data: alert preferences, signals enabled, channels enabled
• Identity data: linked OAuth/Telegram identifiers, and — for Telegram — the profile Telegram sends with every message: first and last name, @username, the language your Telegram app is set to, and whether the account has Telegram Premium. We do not receive, and cannot request, your country or your phone number.
• Payment metadata: subscription tier, payment dates (financial details handled by our payment processors)
• Technical data: IP address (recorded only at consent and login), user agent
• Usage analytics (website): which pages you open, which buttons you press on them, the address of the page that sent you and the advertising campaign tags in the link (utm_*), browser and device type. How we count depends on your cookie choice:
  • Arriving at one of our advertised landing pages, the page reports the arrival itself — its address and the campaign tags in the link, with no identifier and no location.
  • Without analytics consent (including before you answer the banner) nothing is stored on your device. Our analytics provider turns your IP address and browser into a one-way hash that changes every day, then discards the IP. This counts visits; it cannot follow you from one day to the next.
  • With analytics consent a random device identifier is stored in your browser so that visits over time belong together, and a recording of the page session is kept with every form field masked. If you are signed in, that identifier is linked to your internal account number — never to your email or name.
  • Only with consent, PostHog derives your approximate location (country and city) from your IP address before discarding the IP. Without consent no location is derived.
• Telegram activity and advertising attribution: when a link to our bot or to one of our free channels carries a campaign tag — the advert you came from, or a tag marking our own website's landing page — we record that tag against your Telegram user id, and credit a later purchase to the most recent such tag within 30 days. We report to PostHog, under a pseudonymous identifier derived from your Telegram id with a secret key: opening the bot from a tagged link, joining or leaving any of our channels, each channel purchase (payment method, amount, period, whether it extends an existing one), following or unfollowing a Polymarket wallet (your plan, how many wallets you follow, and whether you used a command or a button — never the wallet address), and adding a wallet to Position Guard (your plan, how many wallets you now guard, and that it was added with a bot command — never the wallet address); each event also says which channel it concerns and whether the account is one of our own staff test accounts. Your Telegram id, name and username are not sent, and no location is derived. Our own records of this are kept with the rest of your Telegram bot data and deleted on request; the pseudonymous events in PostHog are kept up to 12 months.
• Followed wallets: the Polymarket wallet addresses you choose to follow — in our Telegram bot or on your dashboard — and when you added each. To find their trades we query Polymarket's public data with the wallet address alone — nothing that identifies you is sent. The alerts describe that wallet's public trading activity as Polymarket publishes it.
• Guarded wallets: the Polymarket wallet addresses you ask us to guard — in our Telegram bot or on your dashboard — and when you added each, plus our record of which guard alerts we sent you about them. The alert messages themselves are kept in the alert delivery log like every other alert (see Alert logs under Data Retention). We read those wallets' open positions and the markets they hold from Polymarket's public data using the wallet address alone; nothing that identifies you is sent.
• Activity data: alert delivery log
• Support chat: pages you open while signed in include our support chat (it is not shown to signed-out visitors or on our advertised channel landing pages). It receives the address of the page, your browser and IP address, and whatever you write in it, so that we can answer you; we do not pass it your email address or name. Conversations are kept until you ask us to delete them
• Error diagnostics: when the app fails, we keep a technical report of the failure (the page, your browser and your user id) so that we can fix it; it is not shared with third parties
• Telegram bot data: if you talk to one of our Telegram bots without holding an account with us, we keep the same Telegram profile above against your Telegram user id, so we can answer you in your language and identify you if you buy. It is kept for as long as the bot is in use and removed on request — write to us from the Telegram account in question.

Why We Collect

• Service delivery (contract performance): we need your account info to provide alerts
• Billing (contract performance): subscription management requires payment data
• Abuse prevention (legitimate interest): IP and activity logs help identify abuse
• Measuring the website and our advertising — which campaign brought a Telegram reader in, and how readers join, leave and buy, reported pseudonymously (legitimate interest: knowing which adverts lead to readers and purchases); cookieless visit counts (legitimate interest: knowing which pages and campaigns work, without storing anything on your device); device-level analytics and session recordings (consent, withdrawable at any time under Cookie preferences in the site footer)
• Marketing (consent only): we do not use your data for marketing without explicit opt-in

Third Parties

• NOWPayments (cryptocurrency payment processing on the website)
• CryptoBot / Crypto Pay (USDT payments inside our Telegram bots). You pay in Telegram's @CryptoBot with your own Telegram account; we send it the amount, the plan or channel and our internal order reference
• Telegram (Telegram Stars payments and bot delivery)
• Google (sign-in with Google, if you choose it). Google sends us your email address, name, Google account id and the address of your profile picture, and learns that you signed in to Darkmen
• Resend (email delivery)
• Cloudflare (DNS, DDoS protection, cookieless Web Analytics page-load measurement, and Turnstile — the automated bot check on the sign-up form, which sees your IP address and browser signals)
• Hetzner (server hosting, EU data centers)
• PostHog (website analytics, EU data region). See Usage analytics and Telegram activity above for what is sent

Data Retention

• Account data: until you delete your account
• Payment records: 7 years (legal requirement for financial records). PII in payment records is redacted upon account deletion; only aggregate financial data remains.
• Alert logs: until account deletion, then erased
• Followed wallets: until you remove them (/following in the bot, or the Wallets card on your dashboard), or your account or Telegram bot data is deleted
• Guarded wallets and our record of which guard alerts were sent about them: until you remove the wallet (/guard in the bot, or the Position Guard card on your dashboard), or your account or Telegram bot data is deleted. One exception: records of price-move alerts may remain for up to 6 hours after you remove the wallet (plus the few minutes until our next check deletes them), because we send at most one price-move alert per market every 6 hours and re-adding the wallet must not repeat one. The alert messages themselves stay in the alert delivery log like every other alert (see Alert logs above)
• Analytics in PostHog (website and Telegram): events up to 12 months, session recordings 30 days

Your Rights (GDPR / CCPA)

• Access: download your data from Settings → Your data → Export my data (one JSON file; the alert history in it covers your latest 1,000 alerts — write to us for older ones)
• Rectification: edit account details in your profile
• Erasure: delete your account (subject to legal retention of payment records)
• Portability: the JSON export is portable to other services
• Objection: opt-out of analytics under Cookie preferences in the site footer; contact us for objections to legitimate-interest processing
• CCPA "Do Not Sell": we do not sell your personal data

Cookie Use

See Cookie Policy.

Contact

For privacy questions or to exercise your rights: support@darkmen.app