Privacy policy

Last updated: 15 October 2026

This policy explains what personal data Vatic collects, why, where it goes and how long we keep it. Vatic is a social app for prediction markets, for people aged 18 and over.

1. Who we are

Vatic is operated by [legal entity name], [registered address], [company number] (“we”). We are the controller of the personal data described here. Contact: founder@vatic.app.

2. What we collect and why

Your account

• Your email address, used to sign you in with an emailed link and to send the emails you ask for. If you set a password, our sign-in provider stores it only as a secure hash. Legal basis: contract.
• If you continue with Google: your name, email address and profile picture as Google shares them, used only to create your account and sign you in. We never see your Google password, and we ask Google for nothing else. You can remove Vatic’s access in your Google account settings at any time. Legal basis: contract.
• Your confirmation that you are 18 or over, and when you joined.
• Profile details you choose to add: username, display name, profile picture, and whether your profile is public.

What you do in the app

• Your calls: your Yes or No, how sure you were, when you called and how the question settled.
• The people you follow and who follows you, the questions you star and the alerts you set up.
• What you post or share: share cards, pictures you upload, and any GIF you pick (GIFs come from GIPHY; their analytics pings go through our server, so your browser does not contact GIPHY's tracker).

A linked Polymarket wallet (optional)

• The public wallet address you give us, and a signature that proves you control it. We never ask for, see or store private keys, seed phrases or passwords, and we cannot move funds or place trades.
• Your trades and positions for that wallet, read from Polymarket's public data, so we can show your verified record (privately, or publicly if you choose).

Payments

• If you pay for a plan, Stripe handles the payment. We never see or store your full card number. We keep your Stripe customer id, your plan and subscription status, and, to stop invite abuse, Stripe's card fingerprint (a code that identifies a card without revealing its number).

Invites

• If you join through an invite, we record who invited you and what happened with the invite (joined, subscribed, rewarded). The person who invited you sees only the status and dates, never who you are.
• To stop the same person claiming an invite discount twice, we keep a one-way hash (SHA-256) of your email address, normalised (lower case, without “+” tags, and for Gmail without dots). The hash cannot be turned back into your address. We keep it even after you delete your account, for fraud prevention. Legal basis: legitimate interests (preventing abuse of the invite scheme). [Owner and solicitor to confirm the retention period.]

Reports

• Anyone can report a picture or post without signing in. We store the reason and an optional note, and a salted hash made on our server that lets us limit repeat reports. We do not store the reporter's IP address or a cookie.

Analytics (only if you agree)

• If you turn on “Share usage analytics” in Settings (it is off until you do), we record a small set of product events (for example: signed up, made a call, followed someone) using PostHog, hosted in the EU. We do not record what you type, your email, your wallet, prices or page contents, and we do not record sessions. You are identified only by a random id. Turning the switch off stops it. Legal basis: consent.

Error reports

• When something breaks, a technical error report is sent to Sentry so we can fix it. Reports are stripped of cookies, request contents, headers and query strings, and carry no IP address or email; at most an internal account id. Legal basis: legitimate interests (keeping the service working). [Solicitor to confirm this can run without consent.]

3. Tic and AI processing

Tic is Vatic's AI. He is not live yet and publishes nothing until his new way of working is approved. When he does research, the question, public market data and dated public news are sent to an AI model provider. We choose providers whose terms say they do not train on this data, and we never send your email, wallet, payment details or anything you post to them. Tic's research can be wrong and is not advice.

4. Who we share data with

• Supabase (database and sign-in; hosted in the EU, Frankfurt). Vercel (hosting).
• Stripe (payments). Cloudflare (picture storage). Resend (email). GIPHY (GIF search).
• AI model providers (section 3). PostHog (analytics, only with consent). Sentry (error reports).
• The public, only for what you choose to make public: a public profile, your record from a public wallet, your calls once others can see them, what you post, and share cards.
• If Vatic is sold or merged, your data may pass to the new owner under this policy; we will tell you first.
• Courts, regulators or the police, where the law requires it.

Some providers process data outside the UK (for example in the United States). Where they do, we rely on the UK's approved safeguards such as the International Data Transfer Addendum or adequacy regulations. [Solicitor to confirm per provider.] We do not sell personal data.

5. Links to other sites

Vatic links to Polymarket. We never hold your money, place bets or place trades; if you trade, you do so on Polymarket, under its own terms and privacy policy. We are not responsible for other sites' privacy practices.

6. How long we keep data

• Account data: while your account is open. Deleting your account (Settings, Delete account) deletes your profile, linked wallets and their synced trades, calls, follows, alerts, posts, share cards and uploaded pictures.
• Kept after deletion: the invite email hash (section 2); moderation records about pictures and posts (what was removed or approved and why); and payment records Stripe must keep by law. [Retention periods to be set.]
• Error reports and analytics events: as set in those services. [Owner to set, for example 90 days.]

7. Keeping data safe

Data travels encrypted (HTTPS), access to it is limited and checked in the database itself, and secrets are kept out of the app. No system is perfectly secure, so we cannot promise absolute security; we will tell you and the regulator about a breach where the law requires it.

8. Cookies and similar storage

• Essential: keeping you signed in, and remembering an invite code on your device for up to 7 days.
• Your preferences, on your device only: your recent searches, prompts you closed, and your analytics choice.
• Analytics: PostHog, only after you turn on “Share usage analytics”. There is no cookie banner: nothing optional is stored until you choose it.

9. Your rights

Under UK data protection law (and the EU's, if you live there) you can ask for a copy of your data, ask us to correct or delete it, object to or restrict some uses, and move it elsewhere. You can withdraw consent to analytics at any time. If you live in California you can also ask what we hold and ask us to delete it; we do not sell personal data. Contact founder@vatic.app. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

10. Children

Vatic is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you think a child has signed up, tell us and we will delete the account.

11. Changes

We will post any change here with a new date, and tell account holders by email about important changes.