Privacy Policy

This Privacy Policy applies to:

• The Miramarket website (www.miramarket.org)
• The Miramarket strategy builder app
• The Miramarket command-line interface (“CLI”), distributed as @miramarket/cli
• AI agents you connect to Miramarket through our Model Context Protocol (“MCP”) server
• Our APIs and related hosted services
• Communications with us, including our mailing list, support, and feedback

This Privacy Policy does not apply to the trading venues, protocols, wallets, or other third-party services that Miramarket connects to, such as Polymarket and Hyperliquid. Those services are governed by their own terms and privacy policies.

We collect the following categories of information.

2.1 Account and Sign-In Information

We use Privy to handle sign-in. When you create an account or sign in, we receive:

• Your Privy user ID, which we use as your account identifier across Miramarket
• Your email address, if you sign in with email
• Basic Google or Discord account details passed to us through Privy, such as your email address and account identifier, if you sign in with Google or Discord
• The addresses of the embedded wallets Privy creates for your account
• Sign-in and session information, such as authentication tokens

We never receive your Google or Discord password. Privy may collect additional information to secure sign-in, as described in its own privacy policy.

2.2 Strategies and Trading Activity

We store the strategies you create, and the activity they generate, in our application database. This includes:

• Strategy names, descriptions, budgets, and status
• Strategy logic: conditions, triggers, actions, selected markets and outcomes, price and time thresholds, order amounts, leverage, and settlement preferences
• How a strategy was created: in the visual builder, from a plain-English description, through the CLI, or by an AI agent connected through MCP
• Strategy runs, both simulated (demo) and live: trigger events, orders, fills, prices, fees, positions, profit and loss, settlement results, and errors
• Capital reserved for strategies, withdrawals, cross-chain transfers, and leftover positions
• Fee approvals you grant on trading venues, such as a Hyperliquid builder-fee approval

2.3 Wallet and Blockchain Information

• Your wallet addresses, including your owner and deposit wallets, and a record linking each address to your account
• Token approval status for your deposit wallet
• Transaction hashes, transaction status, and network identifiers
• Balances, positions, and other public blockchain data associated with your addresses

Public blockchains are transparent by design. Anyone can view the transactions your wallet makes on a public blockchain.

2.4 Product Usage Records

We keep our own records of key actions in the product, linked to your account ID, so we can understand how Miramarket is used and whether it works reliably. These include:

• When we first saw your account, and which client you used first (the web app, the CLI, or an MCP-connected agent)
• Milestones such as your first strategy, first funded strategy, and first filled order, plus running totals of each
• Strategy events, such as when a strategy is created, funded, started, triggered, or completed
• Order events, such as attempts, fills, and failures, with the venue, side, amount, estimated fee, timing, and failure reason
• Plain-English strategy generation events, such as when a description is submitted, a strategy is generated, edited, or regenerated, and how long generation took

These records are stored in our own database and are not sent to an analytics vendor. Because they are part of operating the service, your analytics cookie choice (Section 06) does not affect them.

2.5 Acquisition and Referral Information

If you arrive through a link that carries campaign parameters (utm_source, utm_medium, or utm_campaign) or a referral code, we store them in your browser and attach them to your account once, when you first sign in. We use them to understand which channels bring people to Miramarket.

If you take part in our referral program, we also keep:

• Your referral code
• The account that referred you, if any
• For referrers: the fees earned on orders placed by the people you referred, including order IDs, fee amounts, and timestamps
• Referral payouts, including the amount, destination wallet address, transaction hash, and status

2.6 Location and Eligibility Information

Our content delivery network (Amazon CloudFront) derives your country and state or region from your IP address. We record:

• Your country and region at the time you accept our Terms of Service, Privacy Policy, and Risk Disclosure
• Your most recently observed country and region, which is updated when you load the app and before a live strategy run starts
• Any confirmations you give us about your eligibility and jurisdiction

We use this information to apply trading-venue rules and legal restrictions, as described in Section 08. We do not collect your precise GPS location.

2.7 Policy Acceptance Records

Before you can use the app, we ask you to accept our Terms of Service, Privacy Policy, and Risk Disclosure. For each acceptance we record the policy versions you accepted, the date and time, where you accepted (for example, in the app or through the API), and your country and region at that time, including whether our servers observed that location or you reported it yourself.

2.8 CLI and MCP Information

When you use the Miramarket CLI or connect an AI agent through our MCP server:

• The CLI or agent sends requests to our API under your account, and we process them like requests from the web app
• Strategies posted through the CLI or MCP are labeled with the client that posted them
• The CLI caches your login token on your device

The CLI does not upload unrelated files from your device, and we do not currently collect separate usage telemetry from the CLI.

2.9 Analytics and Session Recording Data (With Your Consent)

If you accept analytics, Google Analytics, Microsoft Clarity, and Vercel collect information about how you use our website and app. Section 06 describes each tool and what it collects.

2.10 Device, Log, and Technical Information

Our servers and hosting providers automatically log technical information when you use Miramarket, including:

• IP address
• Browser type, device type, and operating system
• Referring URL
• Pages and API endpoints requested, timestamps, and response codes
• Error and diagnostic information

We try to keep personal information out of routine logs. For example, we mask wallet addresses and email addresses.

2.11 Mailing List and Communications

• If you subscribe to product updates on our website, we collect your email address and send you a confirmation email
• If you contact us, we collect your email address, the content of your message, and anything else you choose to send, such as feedback or survey responses

2.12 Information From Third Parties

• Privy: the sign-in details described in Section 2.1
• Trading venues and blockchains: order status, fills, positions, balances, and market data related to your activity
• Google Search Console: aggregated reports about how our website appears in Google Search, such as search queries, impressions, clicks, pages, countries, and device types. Google aggregates these reports, and they do not identify individual visitors

Miramarket is not designed to collect:

• Private keys or seed phrases. Privy manages the keys for embedded wallets, and we never see them
• Passwords for Google, Discord, or other sign-in providers
• Full payment card numbers
• Government identification documents
• Your precise GPS location
• Unrelated files from your device through the CLI

If you accidentally send us sensitive information, contact us so we can delete it.

We use information to:

• Provide, operate, and maintain Miramarket across the website, app, CLI, MCP, and APIs
• Authenticate you and keep you signed in
• Save and sync your strategies
• Run the strategies you enable, and send orders and transactions to trading venues on your instruction
• Generate strategies from your plain-English descriptions
• Apply location-based restrictions required by trading venues and applicable law
• Record your acceptance of our policies
• Calculate referral earnings and send payouts
• Measure how the product is used, including sign-ups, activation, retention, and where users come from
• Find and fix bugs, usability problems, and reliability issues, including through session recordings if you consent
• Detect and prevent abuse, fraud, and unauthorized access
• Provide customer support
• Send service-related messages and, where permitted, product updates
• Comply with legal obligations and enforce our Terms of Service

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Performance of a contract: to create your account, store and run your strategies, send orders, and process referral payouts
• Legitimate interests: to keep the service secure, prevent fraud, keep product usage records, measure where users come from, understand search performance, and improve Miramarket. We balance these interests against your rights
• Consent: for Google Analytics, Microsoft Clarity, Vercel Web Analytics and Speed Insights, and marketing emails. You can withdraw consent at any time
• Legal obligation: to apply jurisdiction-based restrictions and keep records the law requires

6.1 Your Analytics Choice

When you first visit our website or app, we ask whether you accept analytics. The tools described in Section 6.2 load only after you accept. If you reject, they do not load. We store your choice in your browser under the key mira:analytics-consent, separately for the website and the app.

To change your choice, clear the site's stored data in your browser settings. The consent banner will appear again on your next visit. You can also contact us.

6.2 Analytics Tools (Only With Your Consent)

Google Analytics (website and app): Collects pages and screens viewed, interactions, session duration, referring site, device and browser details, and approximate location derived from your IP address. It uses cookies such as _ga. Google processes this data under its privacy policy (https://policies.google.com/privacy).

Microsoft Clarity (app): We partner with Microsoft Clarity to capture how you use and interact with the Miramarket app through behavioral metrics, heatmaps, and session replay. Clarity records clicks, taps, scrolling, mouse movement, and the pages and content displayed during your session, along with device and browser details. This data is captured using first- and third-party cookies, such as _clck and _clsk, and other tracking technologies. Clarity masks sensitive input fields by default. We use this information to find usability problems, fix bugs, and improve the product. Microsoft processes this data under the Microsoft Privacy Statement (https://privacy.microsoft.com/privacystatement), which may include using it to improve its own products and services, such as Microsoft Advertising.

Vercel Web Analytics and Speed Insights (website): Collect page views, referrer, country, browser, operating system, device type, and page performance measurements such as load times. Vercel Web Analytics does not use cookies.

We do not link Google Analytics or Clarity data to your Miramarket account.

6.3 Search Performance Data

We use Google Search Console to see how our website performs in Google Search. It does not place cookies or run code on our website, and the reports we receive are aggregated (Section 2.12).

6.4 Necessary and Functional Storage

Some browser storage is needed for Miramarket to work, so it is used whatever your analytics choice:

• Sign-in: Privy stores session tokens in your browser to keep you signed in, and may run a Cloudflare Turnstile check during sign-in to block bots
• Website theme preference (theme)
• Strategy drafts and builder preferences, such as view and run mode (strategy-builder:state:v1, strategy-builder:viewMode, strategy-builder:selectedRunMode)
• The strategy you are viewing and any shared strategy you opened, kept for the current browser tab only
• Wallet setup markers keyed by wallet address, which record that signing permissions and token approvals are already in place (privy_signer_ensured:*, pm_approvals_*)
• Whether you dismissed a location-restriction notice (trading_geo_blocked)
• Campaign and referral information, kept only until you sign in (miramarket:acquisition, miramarket:pendingReferralCode)
• Your analytics choice (mira:analytics-consent)

These items stay on your device until you clear them. Blocking them may prevent sign-in or the strategy builder from working.

6.5 No Sale or Targeted Advertising

We do not sell your personal information, and we do not use it for targeted advertising. Miramarket does not show ads.

When you describe a strategy in plain English, in the app or with the CLI's strategies generate command, we send the following to our AI model provider, DeepSeek, to generate the strategy:

• Your description
• The strategy you are editing, if any
• Relevant market data and platform constraints

Do not include personal or sensitive information in your descriptions. DeepSeek may process this data on servers outside your country, including in the People's Republic of China.

AI-generated strategies may be inaccurate, incomplete, or unsuitable for your goals. You are responsible for reviewing any generated strategy before you use it.

When you start a live strategy, you authorize Miramarket to place orders and sign transactions for your embedded wallet according to the rules you set. We do this through a Privy session signer that you attach to your wallet. It lets our servers sign within the permissions you grant, without exposing your private key to us.

Trading venues such as Polymarket and Hyperliquid, and issuers of tokenized assets, restrict access in some jurisdictions. We apply these restrictions automatically, using the location information described in Section 2.6. As a result:

• Some markets, venues, or features may be hidden or unavailable based on your location
• We may block live runs, orders, or transactions when your location is restricted or cannot be determined
• Circumventing location restrictions, for example with a VPN or proxy, is prohibited

If you believe a restriction was applied to you in error, contact us and we will review it.

We share information with the following categories of recipients.

9.1 Service Providers

We use the following providers to operate Miramarket. They may process information only as needed to provide their services to us:

• Convex: application database and backend. Stores account IDs, strategies, runs, wallet addresses, product usage records, referral records, policy acceptances, and location records
• Privy: sign-in, embedded wallets, and transaction signing. Processes your email address, Google or Discord sign-in details, wallet addresses, and session information. Privy uses Cloudflare to protect sign-in from bots
• Amazon Web Services: API hosting, content delivery, IP-based location, server logs, and secrets storage
• Vercel: hosting for our website and app, plus Web Analytics and Speed Insights on our website if you consent
• Google: Google Analytics if you consent, Google Search Console (aggregated reports only), and Google sign-in if you choose it
• Microsoft: Clarity session replay and heatmaps in the app if you consent
• DeepSeek: the AI model for plain-English strategy generation. Receives your descriptions along with strategy and market context
• Resend: email delivery. Processes your email address and the messages we send you
• Discord: sign-in, if you choose it
• Blockchain RPC and infrastructure providers: reading blockchain data and submitting transactions. Processes wallet addresses and transaction data

9.2 Trading Venues, Protocols, and Bridges

When you trade, or a strategy you enabled trades for you, we send the instructions needed to complete the trade to the venue or protocol involved. These may include Polymarket, Hyperliquid, Limitless, tokenized-stock contracts on Base, and bridge or transfer services such as Relay and Circle's Cross-Chain Transfer Protocol. The information sent can include your wallet addresses, orders, amounts, and signed transactions. Orders may carry a Miramarket builder code, which tells the venue that the order came through Miramarket. These parties process data under their own terms and privacy policies.

9.3 Legal and Compliance Purposes

We may disclose information if we believe it is necessary to:

• Comply with law, regulation, legal process, or a government request
• Enforce our Terms of Service
• Detect or prevent fraud, abuse, or security incidents
• Protect the rights, property, or safety of Miramarket, our users, or others
• Investigate potential violations of trading-venue rules

9.4 Business Transfers

If Miramarket is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction.

9.5 Aggregated or De-Identified Information

We may share aggregated or de-identified information that does not reasonably identify you, such as overall usage statistics.

We keep information only as long as we need it:

• Account, strategy, run, and wallet records: while your account is active. When you ask us to delete your account, we delete or de-identify them, except for the records described below
• Product usage records: while your account is active, to measure long-term trends. We delete or de-identify them when you delete your account
• Trading, fee, referral, and payout records: as long as we need them for accounting, dispute resolution, and legal obligations. Where possible, we keep them in de-identified form
• Policy acceptance records: kept as evidence of acceptance, and de-identified when you delete your account
• Your most recently observed location: overwritten on each update, and deleted when you delete your account
• Server logs: a short period, generally 14 days
• Analytics and session recording data: kept by Google, Microsoft, and Vercel under their own retention periods. This data is not linked to your Miramarket account
• Mailing-list email address: until you unsubscribe or ask us to delete it
• Browser storage: on your device until you clear it

Transactions recorded on a public blockchain are permanent. Neither we nor anyone else can delete them.

We use reasonable administrative, technical, and organizational safeguards to protect information from unauthorized access, loss, misuse, or alteration. These include encrypted connections, access controls, secrets management, and masking personal information in logs.

However, no system is completely secure. You are responsible for keeping your sign-in methods, devices, and CLI environment secure. Miramarket will never ask for your wallet seed phrase or private key.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your personal information
• Receive a copy of your information in a portable format
• Object to or restrict certain processing, including processing based on our legitimate interests
• Withdraw consent where processing is based on consent, including analytics and marketing emails
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects
• Lodge a complaint with your local data protection authority

To make a request, email hello@miramarket.org from the address linked to your account, or tell us your wallet address. We may need to verify your identity before we fulfill a request, and we aim to respond within 30 days.

You can also manage your analytics choice as described in Section 6.1, unsubscribe from emails as described in Section 13, and remove the CLI's cached login from your device.

If you receive product update emails from us, you can opt out at any time with the unsubscribe link in the email or by emailing hello@miramarket.org.

Even if you opt out, we may still send service-related messages, such as security alerts, account notices, and policy changes.

We and our service providers process information in several countries, including the United States, Ireland (where our API is hosted), and, for AI strategy generation, the People's Republic of China. These countries may have data protection laws that differ from those where you live.

Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses.

Miramarket is not intended for anyone under 18 or under the age of majority where they live. You must also meet the age requirements of the trading venues you use.

We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Miramarket links to and integrates with third-party services, including trading venues, wallet providers, blockchain networks, and analytics tools.

We are not responsible for the privacy practices, content, or terms of third-party services. Review their policies before using them.

Miramarket provides tools for market discovery, strategy construction, automation, and analysis. Miramarket does not provide legal, financial, tax, investment, or trading advice.

Strategies created through Miramarket, including AI-generated strategies, involve risk. You are solely responsible for deciding whether to use any strategy or interact with any market. See our Risk Disclosure for details.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email, in-product notice, or other reasonable means, and we may ask you to accept the updated policy before you continue using the app.

The updated Privacy Policy takes effect when posted unless otherwise stated.

For questions, requests, or concerns about this Privacy Policy, contact us at:

Miramarket Email: hello@miramarket.org