Privacy Policy

Effective: July 21, 2026 · MarketMaster v7.0

1. Who we are

MarketMaster is run by an individual developer (referred to as "we," "us," or "the developer"). For privacy questions, contact support@marketmaster.live or use our contact form.

2. What the Chrome extension stores on your device

MarketMaster uses two Chrome storage areas, split by sensitivity and size:

2.1 Device-local only (chrome.storage.local)

• Your API keys (PredictionHunt, optional Kalshi Access Key ID and RSA private key) — stored in plaintext locally, never sent anywhere except to the service they belong to. The Kalshi private key is used in-browser to sign requests to Kalshi's authenticated endpoints; the key itself is never transmitted. These are used only to show you your own positions — never to place a trade.
• A lightweight local analysis journal — every analysis you run in the extension is auto-logged there with a market title and your selected side, capped at 200 entries, for your own quick reference. This is separate from the website's /journal Pro feature, which is stored on our backend (Section 3).
• A rolling history of prices you've viewed, for sparkline charts.
• Cached news headlines and cross-platform title matches (weekly / daily refresh).
• Your MarketMaster license key, once issued, so the extension can verify Pro entitlement.

2.2 Synced across your Chrome profiles (chrome.storage.sync)

• The extension's own watchlist of subscribed market tickers (the "My Markets" tab) and its on-device alert threshold/toggle, used for browser (OS-level) notifications. This is separate from the website's /watchlists feature, which drives email alerts and is stored on our backend (Section 3).
• Your auto-fill preference and bankroll setting (used to translate Kelly % into a contract count).
• Your scanner SHOW filter selection (Arbs only, Movers, etc.).
• UI state — collapsed sections, dismissed hints.
• Your Polymarket wallet address (a public on-chain identifier — no private key), used only to display your own positions.

The developer cannot read either of these two Chrome storage areas. chrome.storage.sync is encrypted in transit and at rest by Google as part of your Chrome account. To stop syncing, sign out of Chrome or disable extension sync in chrome://settings/syncSetup. Separately, if you're signed into a MarketMaster account, related data you enter on the website — watchlists and alert thresholds, journal entries, your username, and (only if you opt in) your analyzer picks — is stored on our backend as described in Section 3. That backend data is visible to us as the service operator, the same as any other account data, and is never sold.

3. What our backend stores

If you create a MarketMaster account at marketmaster.live, we store the following so that sign-in, billing, and the signed-in features of the site can work:

• Email address — required for account creation, email verification, password reset, and billing receipts.
• Hashed password — only if you sign up with email/password; we never store passwords in plain text. Hashing is handled by Supabase Auth using industry-standard bcrypt. If you sign in with Google instead, Supabase handles the OAuth exchange and we don't see or store a password at all.
• Username, if you claim one — set from /profile or a claim prompt, with a 30-day cooldown between changes. Used as your identity in the dashboard and, only if you opt into the public leaderboard (Section 8), as your public identity on /leaderboard and your public profile page.
• Subscription state — plan (monthly/annual), status (active, past_due, canceled), current period end, and Stripe customer/subscription IDs. We use this to determine whether to issue a Pro license.
• License keys — randomly generated strings tied to your account, plus their status (active, revoked) and issuance date. Used by the extension to verify Pro entitlement.
• Watchlists and alert thresholds — the markets you track and the price/probability thresholds you set on /watchlists, so we can send you an email alert (via Resend) when one is crossed.
• Trading journal entries — the trades or notes you log on the /journal page (a Pro feature), stored so your journal is available across sessions and devices.
• API keys and usage — if you generate a developer API key from /developers or your dashboard, we store the key and a count of your API usage to enforce rate and plan limits.
• Notification preferences — the toggles you set under /profile → Notifications, including whether you receive alert emails.
• Analyzer picks, only if you opt in — see Section 8.
• Server-side authentication logs — Supabase keeps short-lived audit records of sign-in attempts for security. We don't use these for analytics.

We do not store the specific markets you passively browse or analyze unless you've opted into pick-tracking (Section 8). We don't store your third-party exchange API keys (Kalshi, Polymarket, PredictionHunt) — those stay local to your device, see Section 2. We don't store your trade history or account balances from Kalshi or Polymarket, and we don't store your IP address beyond short-lived rate-limit and abuse-prevention records.

4. Subprocessors we rely on

We use a small number of well-known subprocessors. Each only sees the data it needs:

• Supabase (hosted on AWS, US region) — our database and auth provider. Stores your account, password hash, subscription state, license keys, username, watchlists, alert thresholds, journal entries, notification prefs, API keys/usage, and (if you opt in) your analyzer picks. Supabase privacy policy.
• Stripe — processes payments and stores your billing information (card details, billing address). We never see or store full card numbers. Stripe privacy policy.
• Cloudflare Workers — runs our backend: the scanner, arbitrage detection, smart money feed, watchlists/alerts, journal, leaderboard, developer API, and the Stripe webhook handler. Cloudflare may briefly process request metadata for DDoS protection. Cloudflare privacy policy.
• Resend — sends transactional email (account verification, password reset, billing receipts, and watchlist alert emails). Resend privacy policy.
• Netlify — hosts the website at marketmaster.live. Standard web-server logs (IP, user agent) are retained briefly. Netlify privacy policy.
• Sentry — error monitoring for our website and backend. If something breaks, Sentry may capture technical details of the request (such as the error message, URL, and browser) to help us fix it. Sentry privacy policy.

5. What the extension transmits to third parties

The MarketMaster extension makes direct HTTPS requests from your browser to these services so you can see live data. The marketmaster.live website and its backend make equivalent server-side requests to Kalshi's and Polymarket's public APIs to power the scanner, arbitrage detection, smart money feed, and leaderboard when you're using the site instead of (or in addition to) the extension.

• Kalshi public API (api.elections.kalshi.com) — to fetch market prices and details.
• Polymarket public API (gamma-api.polymarket.com) — to fetch market prices and details.
• PredictionHunt API (www.predictionhunt.com) — only if you provide an API key.
• Kalshi authenticated endpoints — only if you provide an Access Key ID and private key. Each request is signed locally; the private key never leaves your browser.
• Google News RSS (news.google.com) — for the "Market Context" feature when you click it.
• MarketMaster license API (marketmaster.live) — only if you've signed into a Pro account inside the extension. The request sends your license key to confirm it's still valid.

6. Cookies and similar technologies

The marketing site at marketmaster.live uses a small number of essential cookies and browser-storage entries only for keeping you signed in (Supabase session tokens) and remembering your filter / sort choices on the dashboard. We do not use advertising cookies, third-party analytics, or cross-site trackers.

7. Chrome permissions, explained

• activeTab — to read the URL and title of the market you're viewing, so MarketMaster can analyze it.
• storage — to save your settings locally.
• tabs — to open market pages in a new tab when you click "Open."
• alarms — to schedule the background price check for subscribed markets.
• notifications — to show OS-level alerts when a subscribed market crosses your threshold.
• host_permissions (Kalshi, Polymarket, PredictionHunt, Google News, marketmaster.live) — to fetch live market data and verify your Pro license.

8. Analyzer pick-tracking and the public leaderboard (opt-in)

Pick-tracking is off by default. If you turn it on — via the extension's consent prompt or Settings → Privacy on your dashboard — MarketMaster records each analyzer "pick" you make: the market, the side you picked, the price/probability at the time, and a timestamp. This is tied to your account and stored on our servers.

We use this to calculate your personal pick-accuracy statistics on /analytics and, if you've claimed a username, your rank (MMR) on the public /leaderboard. Opting in makes your username, your rank/tier, and your win-loss pick record publicly visible on /leaderboard and on a public profile page at marketmaster.live/u/<your-username>. Bet amounts, account balances, and wallet contents are never recorded or shown. We do not sell or share this data, and we don't aggregate it across users beyond the accuracy and leaderboard calculations described here.

This is opt-in and reversible. You can turn pick-tracking off and delete your pick history at any time from the extension Settings or your dashboard — doing so removes you from the public leaderboard and stops new picks from being recorded.

9. Your rights and choices

• Access & correct your data: sign into your dashboard or visit /profile.
• Change your notification preferences: Profile → Notifications.
• Manage watchlists and alerts: /watchlists.
• Manage your journal entries: /journal.
• Manage your developer API key: /developers or your dashboard.
• Turn off pick-tracking, leave the leaderboard, or delete your pick history: extension Settings or your dashboard (see Section 8).
• Delete your account: email support@marketmaster.live or use /contact. We handle deletion requests manually; Stripe will retain billing records as legally required. We don't publish a fixed timeline — contact us and we'll confirm once it's done.
• Cancel your subscription: use the Manage subscription / billing button on your dashboard (opens the Stripe customer portal).
• Stop using the extension: uninstall from chrome://extensions — that removes all local data on that device.

10. California residents (CCPA/CPRA)

We don't sell or share personal information as defined by California law, and we don't use personal information for cross-context behavioral advertising. California residents have the right to know, correct, delete, and limit use of sensitive personal information — all of which can be exercised via the methods in section 9.

11. European / UK residents (GDPR / UK GDPR)

For data we hold (account, subscription, license, watchlists, journal, and — if you opt in — analyzer picks), the developer acts as the data controller. Lawful basis is contractual necessity (to provide the service you signed up for), consent (for opt-in pick-tracking), and, for security and fraud-prevention logs, legitimate interest. You may exercise your rights of access, rectification, erasure, restriction, and portability via the methods in section 9 or by emailing support@marketmaster.live.

12. International data transfers

Our subprocessors (Supabase, Stripe, Cloudflare, Resend, Netlify, Sentry) operate globally. Data may be transferred to and processed in the United States and other countries. Each subprocessor maintains appropriate safeguards (Standard Contractual Clauses, etc.) for such transfers.

13. Children

MarketMaster isn't directed at children under 18 and isn't intended for anyone under the age of majority in their jurisdiction. We don't knowingly collect data from minors.

14. Security

All requests use HTTPS. Passwords are hashed by Supabase Auth using bcrypt — we never see or store plain-text passwords. Card data is handled directly by Stripe; we never see or store full card numbers. License keys are stored hashed where practical. We can't promise the service is unbreakable — no service can — but we take reasonable, standard precautions. If you suspect your account is compromised, change your password immediately and contact support@marketmaster.live.

15. Changes to this policy

We may update this policy. Material changes will be flagged on the dashboard and via email (if your notification preferences allow). The "Effective" date at the top reflects the most recent revision.

16. Contact

Privacy questions, deletion requests, or data-rights requests: email support@marketmaster.live or use our contact form.