Privacy Policy

This Privacy Policy explains what information Shadower ("we", "us", "our") collects, how we use it, and what rights you have. By using the Shadower application or website, you agree to this policy.

1. Who We Are

Shadower is a desktop application for copy-trading on Polymarket. We operate at shadower.trade. For questions, contact us at support@shadower.trade.

2. What Data We Collect

Data stored on our servers (Supabase):

• Email address — when you register or sign in with email
• Account ID — a randomly generated identifier
• Subscription status — plan type, expiry date, trial usage
• Session metadata — session ID, machine ID (hashed), last active timestamp. Used to enforce one-device-per-account.

Data stored only on your device (never sent to us):

• Private Key — stored locally in an encrypted .env file using AES-256-GCM. We have no access to it.
• Wallet address — stored locally in your app data folder
• Alchemy API key — stored locally
• Trader wallet addresses — stored locally in wallets.json
• Trade history and logs — stored in memory only, cleared on app restart

3. How We Use Your Data

• To authenticate you and manage your account
• To verify and manage your subscription
• To enforce the one-device-per-account session policy
• To send transactional emails (account confirmation, subscription receipts)
• To provide customer support when you contact us

We do not use your data for advertising, profiling, or sale to third parties.

4. Third-Party Services

We use the following third-party services to operate Shadower:

• Supabase — authentication and database. Stores your email, account ID, and subscription status. Supabase Privacy Policy →
• LemonSqueezy — payment processing for subscriptions. Handles card and PayPal payments. LemonSqueezy Privacy Policy →
• NOWPayments — cryptocurrency payment processing. Used when you pay with crypto. NOWPayments Privacy Policy →
• Alchemy — blockchain data provider. You use your own personal Alchemy API key; we do not have access to it.

5. OAuth Sign-In (Google & Discord)

If you sign in with Google or Discord, we receive only your email address and a unique identifier from that provider. We do not receive your Google password, Discord messages, or any other account content.

6. Data Retention

• Account data is retained as long as your account is active
• If you request account deletion, we remove your email and subscription records from Supabase within 30 days
• Local data (private key, wallet addresses) is deleted when you uninstall the application

7. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you
• Deletion — request that we delete your account and associated data
• Correction — request that we correct inaccurate data
• Portability — receive your data in a machine-readable format

To exercise any of these rights, contact us at support@shadower.trade.

8. Security

We take security seriously:

• All communication with our servers uses HTTPS/TLS encryption
• Your private key is encrypted locally with AES-256-GCM and never transmitted
• Authentication tokens are stored locally and expire after 30 days
• We use Supabase's security infrastructure, which complies with SOC 2 Type II

9. Children's Privacy

Shadower is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of Shadower after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, contact us at:
support@shadower.trade