Ordiax Polymarket Lens Privacy Notice

1. Information the Extension processes

Public page and market context

The Extension reads the current public Polymarket URL and the market or outcome visible on the page so it can display analytics for the correct context. This information is held only as needed by the active Extension process. The Extension does not create a local database of pages you visit.

The Extension requests public market metadata, order-book data, activity, open interest, and public-account aggregates from Polymarket public APIs without Polymarket credentials. Those providers receive ordinary network information needed to answer a request, such as the requested host and path, IP address, user agent, time, and response status. Their own privacy practices apply to that processing.

Optional Ordiax login and History

You may optionally sign in to an existing Ordiax account to view plan-entitled historical CLOB analytics. Your email address and password are sent directly from an Extension-owned page to the configured Supabase Auth project over HTTPS. Passwords are not sent through Extension messages, sent to the Ordiax Lens API, or stored by the Extension. The password field is cleared after each sign-in attempt.

The Supabase session record, including access and refresh tokens and the account information returned by Supabase, is stored in chrome.storage.session. It is available only to Extension-owned code and is removed when you sign out or the browser session ends. A display-safe plan entitlement is stored in the same session storage for the active user.

Authenticated History requests send the current access token in an Authorization header and the selected public outcome-token identifier in the fixed Ordiax Lens API path. Tokens are not placed in query strings or exposed to the Polymarket page or content script.

Local preference and temporary data

The Show Lens shortcut preference is stored in chrome.storage.local and remains until you change it, clear the Extension's data, or uninstall the Extension. Public and historical analytics may be cached briefly in service-worker memory to provide the feature efficiently. These memory caches disappear when the service worker stops, and user-specific cached data is cleared at sign-out.

2. How and why information is used

Ordiax uses the information described above only to:

• synchronize the Lens with the public market and outcome selected on the page;
• provide public market analytics and requested historical analytics;
• authenticate an optional Ordiax account and apply plan entitlements;
• maintain service security and reliability, prevent abuse, and investigate errors; and
• respond to support, privacy, or legal requests.

Ordiax does not sell Extension user data or use it for advertising, creditworthiness, lending, or unrelated profiling.

Where the GDPR or a similar law applies, Ordiax processes account, authentication, and requested analytics data as necessary to provide the Extension and account features you request or to take steps at your request. Ordiax processes limited technical, security, and diagnostic data for its legitimate interests in securing, maintaining, and preventing abuse of the service. Information is also processed where necessary to comply with law or establish, exercise, or defend legal claims.

3. Services that receive information

• Polymarket public APIs: receive public market-data requests and ordinary network metadata.
• Ordiax Supabase project: provides optional account authentication and stores Ordiax account and entitlement records.
• Ordiax Lens API hosted on Railway: receives the access token and selected public outcome-token identifier for authenticated History requests and returns the entitled analytics.
• PolygonScan: receives an ordinary browser request only if you choose to open a validated public-ledger link.

These services receive information only as needed for the purposes described above or as required by law. Ordiax does not transfer Extension user data to advertising networks or data brokers.

These providers may process personal data outside your country, including outside the EEA, UK, or Switzerland. Where required, Ordiax relies on an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact contact@ordiax.com for information about the applicable safeguards.

4. Security, retention, and deletion

Extension connections use HTTPS or secure WebSocket. Authentication tokens remain in Chrome session storage and are sent only to the configured Supabase and Ordiax Lens API origins.

The current page context and temporary response caches are not stored by the Extension as browsing history. Session data is removed at sign-out or when the browser session ends. The shortcut preference remains until you change it, clear Extension storage, or uninstall the Extension.

Ordiax account and entitlement records are retained while the account is active. To request account deletion, use Ordiax account settings or contact contact@ordiax.com. After verifying the request and confirming that any active paid subscription has been cancelled, Ordiax removes the Supabase Auth user and associated Ordiax profile.

Supabase authentication logs and Railway HTTP or security logs may contain a user identifier, IP address or protected IP-derived value, user agent, request path, timestamp, and response status. For authenticated History requests, the public outcome-token identifier is part of the request path and may therefore appear in these logs. Passwords, access tokens, refresh tokens, and Authorization headers are not intentionally written to Ordiax application logs.

Ordinary provider-hosted authentication, HTTP, and security logs are retained under the applicable provider's automatic schedule and for no longer than 90 days. Deleted account data may remain in encrypted database backups for up to 30 days before automatic rotation. A limited record may be retained longer only when reasonably necessary to investigate a concrete security incident, prevent abuse, comply with law, or establish or defend a legal claim; it is deleted when that purpose ends.

5. Your choices and rights

You can use the public Lens features without signing in, turn off the Lens shortcut, sign out to clear session-scoped Extension data, clear the Extension's stored data in Chrome, or uninstall the Extension.

Subject to applicable law and exceptions, you may request access, correction, deletion, restriction, portability, or objection concerning personal data controlled by Ordiax. In particular, you may object to processing based on legitimate interests. Send a request to contact@ordiax.com. Ordiax may request information needed to verify your identity and will respond within the period required by applicable law. You may also lodge a complaint with a competent data-protection authority where you live, work, or believe a data-protection infringement occurred.

Provider logs and backups expire on the schedules described above rather than being removed immediately from every copy. Public market data that is not personal data about you is not deleted through an Ordiax account request.

6. Changes to this notice

Ordiax may update this notice to reflect technical, legal, or operational changes. The current version will remain available at https://ordiax.com/polymarketlens/privacy, with the last-updated date shown above.

7. Contact

Privacy and account requests: contact@ordiax.com
Extension support: support@ordiax.com