Privacy Policy
Draft — not yet in effect. Operator details and an effective date will be added before ThinBlimp opens paid plans.
1. Who we are
ThinBlimp ("we") operates ThinBlimp, an information and analytics service for prediction markets and sports betting lines. ThinBlimp does not accept wagers. We hold no customer funds and execute no trades. Contact: the contact address published when these terms take effect, address to be published when these terms take effect.
2. What we collect
| Category | What | Why |
|---|---|---|
| Account | Email address; a password, which our authentication provider stores in hashed form (we never see it) | To create and secure your account |
| Connected exchange accounts | The credential you give us — an exchange-issued API key, or a public wallet address | To show your own positions and balances back to you (§4) |
| Your account data | Positions, fills, profit and loss, cash and portfolio balances, bet history | Read from the venue; used to render your portfolio and analytics |
| Things you create | Watchlist, alerts, exit targets, "scoops" and reactions, and a display name / X handle / avatar if you add one | To run the features you use; scoops and their display name are visible to other users |
| Subscription (when payments begin) | Plan, status, billing period, amount paid | To decide what your account may access. Card details go to our payment processor; we never see them. |
| Waitlist | Email; optionally which sportsbook you use and whether you want sportsbook accounts connected; how you found us — campaign tags in the link you arrived on (UTM source, medium, campaign), the domain of the site that referred you (never the full address), and which page you signed up on | To contact you about launch, and to know which channels bring people |
| Technical | IP address, browser and device information, request metadata, error reports | Security, rate limiting, measuring page visits (§6), diagnosing faults |
We do not collect: your legal name, postal address, date of birth, government identifiers, card numbers, precise location, biometric data, or contacts.
3. How we use it
To operate the Service: sign you in; show your own data back to you; compute analytics on it; write summaries you ask for (§5); deliver alerts you create; enforce your plan's limits; send the emails described in §7; protect against abuse; measure which pages are used; and diagnose errors.
We do not sell personal information, share it for cross-context behavioural advertising, or use it to train AI models.
4. Connected accounts
4.1 Exchange accounts (API keys)
- You create the key at the exchange, and you choose its permissions there. Some exchanges let you create a key that can only read — where that option exists, use it; our connect screen tells you how. Some exchanges' keys can trade and offer no read-only option; our connect screen says so, and suggests connecting from an account without funds.
- ThinBlimp only ever reads. We never use a connected key to place, change or cancel an order, or to move funds.
- A key that has trading permission could be misused by anyone who obtained it, including through a security incident affecting us. That is why we recommend read-only keys and store secrets encrypted.
- Stored encrypted in our database provider's dedicated secret store; the key's identifier (not the secret) is kept in plain text so we can show you which key is connected.
- Disconnecting in Settings deletes the stored secret. You can also revoke the key at the exchange at any time, which ends our access immediately.
4.2 Wallet addresses
Connecting a public blockchain wallet address lets us read public on-chain positions. It is a public identifier, not a secret, and gives no ability to transact. We never ask for or hold a private key or seed phrase.
4.3 Access control
Database row-level security scopes every read of personal data to the account that owns it. No user can read another user's positions, balances, connections or credentials.
5. AI features
Some features use AI models provided by third parties. None of them receives your personal data or your positions.
- Market, game and news summaries — the model receives public information only (headlines, market titles, prices).
- Market similarity — public market titles only.
6. Page-visit measurement
We use Vercel Web Analytics to count page visits and see which pages people use. It sets no cookies. Per Vercel's documentation, it distinguishes visits using a hash of request information that is not stored and that changes daily, so it cannot follow you across days or across other websites.
7. Email
- Account email — sign-in and security messages.
- Waitlist — a confirmation when you join, and news about launch, plans, and sportsbook account linking. Every such email has a one-click unsubscribe.
- We send email through a transactional email provider.
8. Service providers
| Provider | Role | What reaches them |
|---|---|---|
| Supabase | Database, authentication, encrypted secret storage | All account data |
| Vercel | Hosting, edge network, page-visit measurement | Request metadata, IP addresses, page views |
| Fly.io | Hosts our live-price service | Market data only — no user data |
| Sentry | Error monitoring | Error reports; collection of personal information is off by configuration, and session replay is off |
| Upstash | Rate limiting | Counters keyed by IP address (or, when signed in, a session reference), expiring within about a minute |
| Resend | Email delivery | Email address and message content |
| Cloudflare (AI Gateway) | Routes requests to our AI provider | The content of AI requests (§5) |
| Groq | AI summaries and news classification | Public information only — headlines, market titles and prices; no user data |
| OpenAI | Text embeddings | Public market titles only |
Data providers we read from (exchanges, sportsbook-odds vendors, sports and news sources) receive no personal information from us. When payments begin, a payment processor will collect billing details directly, and this table will be updated before that happens.
9. Retention
- Account, connections and subscription: while your account exists; deleted when you close it in Settings (Your data → Delete account) or ask us to.
- Positions and performance history: while your account exists — the product's value is a record over time.
- Waitlist entries: until launch communications end or you unsubscribe or ask for deletion.
- Rate-limit counters: about a minute.
- Error reports and provider logs: on each provider's own schedule.
- Market and odds data: not personal information.
10. Your choices and rights
You can at any time: disconnect an exchange in Settings (this deletes its stored secret); download a copy of your data or delete your account yourself in Settings (Your data); revoke a key at the exchange; unsubscribe from email; clear your browser's storage (see the Cookie notice); or ask us — at the contact address published when these terms take effect — for a copy of your data, a correction, or deletion of your account and its data. We will respond within 30 days.
11. Security
Secrets encrypted at rest in a dedicated store; row-level security on every table holding personal data; we never use connected credentials to trade; no custody of funds or private keys; rate limiting on every API route; error monitoring with personal-information collection off. No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will tell you as the law requires.
12. Children
The Service is for adults of legal age to trade event contracts or bet where they live. It is not directed to anyone under 18 and we do not knowingly collect their data.
13. Changes
We will post changes here and update the date above. We will email you about material changes.