Privacy Policy

Last updated: October 28, 2026

This policy explains what personal data PredictionScan (operated by PM Data Services, Inc.) ("PredictionScan", "we", "us") collects when you use the PredictionScan app in ChatGPT, connect another AI assistant or MCP client to our server at https://mcp.predictionscan.org/mcp, use the PredictionScan app for iPhone and iPad, or visit predictionscan.org. It explains why we use the data, who receives it, how long we keep it and the choices you have. PredictionScan is independent: it is not affiliated with or endorsed by Polymarket.

The short version:

• PredictionScan needs no account, sign-in or API key, and it sets no cookies.
• We receive tool requests and their arguments (for example a search phrase). An assistant may derive those arguments from relevant conversation context.
• For each connection and tool call we keep a minimal usage record: the tool name, the time, the type of client, its user agent and a keyed one-way hash of the IP address. We do not store the IP address itself, the tool inputs or the results.
• The iPhone and iPad app has no account either: it keeps an anonymous device ID so it can send the alerts you set, and you can erase everything with Delete My Data in its Settings.
• We do not sell your personal data.

1. Who we are and what this policy covers

PM Data Services, Inc. operates PredictionScan and is responsible for the personal data described here. You can reach us at support@predictionscan.org or through our support page.

This policy also covers the read-only market and trader analytics pages on predictionscan.org. They use the same public-data server as the PredictionScan app and do not provide trading, account access or wallet connections.

This policy does not cover services you use alongside PredictionScan, such as OpenAI (ChatGPT), Anthropic (Claude), xAI (Grok), Polymarket or the news publishers whose articles we link to. Their own privacy policies apply to the data they collect.

2. What we receive

When an assistant decides to use PredictionScan to answer you, it sends our server a tool call: the tool's name (for example, search_markets) and the inputs the assistant chose, such as a search phrase, a market link or name, a time range, a category, or a public wallet address or Polymarket username. We use those inputs only to look up public data and answer that call. The assistant may derive these inputs from relevant conversation context. Connecting to PredictionScan does not give us direct access to your full conversation history, other messages or files, or your account with the AI provider; we receive the inputs the assistant includes in its tool request. Some assistants attach extra metadata to tool calls (ChatGPT, for example, may include an anonymized user or conversation ID, your locale and a coarse location); our server does not read or store it.

3. What we log

We log only two kinds of request: a client connecting (the MCP "initialize" message) and a tool being used ("tools/call"). Listing the tools and other protocol messages are not logged. Each logged request creates one usage record with: the action (a connection, or the name of the tool used), the type of client worked out from its user agent (for example ChatGPT, Claude, Grok or Cursor), the user agent text (first 300 characters), a keyed hash of the connecting IP address and the time.

The hash is an HMAC-SHA-256 keyed with a secret held only on our server and shortened to 16 hexadecimal characters, so the IP address cannot be recovered by hashing every possible address; we do not store the IP address itself. We do not store tool inputs, results or any conversation content. For assistants such as ChatGPT, Claude and Grok, the connecting IP address normally belongs to the AI provider's servers, not your device; for tools that run on your computer, such as Cursor or Claude Code, it may be your own network's IP address.

4. Why we use it

To count how each tool is used, plan capacity, detect and prevent abuse, and fix errors. Where the EU or UK GDPR applies, we rely on our legitimate interests in running, securing and improving the service. You can object to this processing (section 11).

5. Who else is involved

• Cloudflare (network, DNS, security and the predictionscan.org addresses) and Supabase (database and server functions). Requests reach us through Cloudflare and run on Supabase; both process the connecting IP address and request headers to deliver the request and may keep short-lived operational logs.
• AI and location providers (iPhone and iPad app). Co-pilot questions are processed by our AI model provider (currently Venice.ai) to write the answer, and ipapi.co receives the IP address of a co-pilot request to give us an approximate location (section 9).
• Apple. For the iPhone and iPad app, Apple's Push Notification service receives each alert's push token and text in order to deliver it to your device, under Apple's privacy policy.
• Polymarket's public APIs. To answer, our server queries Polymarket's public APIs and our own database, so inputs such as a search phrase or wallet address are sent to Polymarket, with nothing about you.
• Error logs. If a tool fails, a short technical error message may be written to our hosting provider's logs.
• Legal and business transfers. Authorities, courts or advisers when the law requires it or to protect our rights and users, and a successor if PredictionScan is merged, acquired or sold, under this policy.

6. What the tools return

Only public market data and public on-chain trading data, such as market-implied probabilities, prices and volumes, and the public wallet addresses and Polymarket display names of traders, plus news headlines with links to the publishers. The tools cannot place trades or access any account. Market and trader result links open predictionscan.org pages and may carry the referral marker ?ref=mcp; the tag is the same for everyone and contains nothing about you. Our analytics pages ignore this marker and do not use it to identify or track visitors.

7. Public data about traders

PredictionScan reports public data about Polymarket wallets: trades, positions, profit and loss, and the profile information traders publish on Polymarket (such as a username). This data is pseudonymous, and we do not try to identify the people behind wallets. If you control a wallet and believe a name or link we show for it is wrong, contact us. We can correct or remove our own labels and links; we cannot change on-chain data or data Polymarket publishes.

8. The predictionscan.org website

These pages are delivered through Cloudflare, which processes your IP address and request headers to serve them. A market or trader page may make a read-only lookup through our data server using the public market slug or wallet address in the page URL; the minimal server usage record described in section 3 also applies to that lookup. Public page responses may be cached briefly. We add no cookies, client-side analytics or advertising tags to predictionscan.org.

9. The PredictionScan app for iPhone and iPad

The app is read-only: it shows public market and trader data and sends the alerts you choose. It has no sign-in, wallet, trading or payments, and it contains no advertising, analytics or tracking SDKs.

• Anonymous device ID. On first launch the app creates a random device ID and secret and keeps them in your device's Keychain. Our server stores the ID and a one-way hash of the secret (never the secret itself), plus the app version, your time zone and language setting so alerts arrive at sensible local times, and the alert settings you choose (daily limit and quiet hours).
• Push notifications. If you allow notifications, Apple gives the app a push token, which we store with your device ID so Apple's Push Notification service can deliver your alerts. Notifications are optional: the app works without them. You can turn them off in iOS Settings at any time.
• Your alerts, watchlist and follows. The alerts you create (a market, a price level or move, a closing reminder, a minimum trade size, or a public wallet you follow) are stored on our server so we can check them. Your watchlist, followed traders and recent searches stay on your device.
• Live Activities. If you pin a market to your Lock Screen, we store that market and the Live Activity push token Apple provides until the activity ends.
• Push log. For each alert we send, we record which alert fired, when, and whether Apple accepted it, so we never send the same alert twice and can respect your daily limit. Entries are deleted after 30 days.
• Public data requests. To show prices, charts, searches and trader pages, the app requests public data from our server and directly from Polymarket's public APIs. Those requests carry your device's IP address, as any internet request does, but no device ID or personal details. Polymarket's own privacy policy applies to the requests it receives.
• Co-pilot (Ask). The app asks for your OK before your first question, and you can withdraw it in Settings. When you ask, your question and the earlier turns of that conversation are sent to our server and to our AI model provider (currently Venice.ai) to write the answer, and the co-pilot may look up public market data to answer it. Please don't include personal information. We do not store your questions or the answers. For each question we keep a usage record: the time, your device ID (to count your allowance), whether the answer completed and its length, the app's user agent, a conversation ID, and an approximate location (country, region and city) looked up from your IP address through ipapi.co. We do not store the IP address itself.
• Links to Polymarket. "View on Polymarket" opens polymarket.com in Safari with a referral tag (?via=PMS) that is the same for everyone and identifies the app, not you. PM Data Services, Inc. may earn a fee from Polymarket when people it refers trade there.
• Delete My Data. In the app, Settings → Delete My Data immediately erases your device record, alerts, push log and Live Activities from our server and clears the ID, watchlist and history on your device. Deleting the app alone removes the on-device data; device records that have not been used for 12 months are deleted from our server automatically.

10. How long we keep information

Usage records are kept for up to 24 months, then deleted or aggregated into counts. For the iPhone and iPad app, the device record and alerts are kept until you use Delete My Data or until the device has gone 12 months without use, and the push log for 30 days (section 9). Deleted data can remain in backups for a limited time before it is overwritten. Our providers keep the operational logs they collect under their own retention settings.

11. Your choices and rights

• Connecting. You decide whether to use PredictionScan, and you can disconnect it in your assistant's settings at any time. Your conversation itself is handled by the AI provider under its own privacy policy (OpenAI, Anthropic or xAI).
• In the app. Settings → Delete My Data erases everything our server holds for your device, at once and without contacting us.
• Usage records. They hold no name, account, conversation content or raw IP address. If you want records from a particular IP address removed, send us the address and the approximate time and we will find and delete the matching records.
• Your rights. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to withdraw consent. We will not treat you differently for using these rights. You can also complain to your local data protection authority.
• How to ask. Email support@predictionscan.org. We respond within 30 days.
• We cannot delete or change data recorded on a public blockchain or published by Polymarket.

12. Children and age requirements

PredictionScan is not directed to children under 13, and we do not knowingly collect personal data from them. PredictionScan offers no trading. Trading on prediction markets is only for people who are at least 18 (or the age of majority where they live). If we learn that we have collected personal data from a child under 13, we will delete it.

13. Security

We use HTTPS for our server and website, restrict database access with row-level security, store IP addresses in usage logs only as keyed hashes, and never ask for a private key, recovery phrase or password. No system is perfectly secure; if you think data has been exposed, contact us right away.

14. International transfers

We and our providers store and process data in the United States and other countries, which may have different data protection laws from yours. Where EU or UK law applies, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision covering the provider.

15. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your personal data, we will also post a notice on predictionscan.org before it takes effect.

16. Contact us

Questions or requests about this policy or your personal data: email support@predictionscan.org or use our support page.