LockstepMarkets

Privacy Policy

Version 1.2 · 19 September 2026

This is the full notice that clause 15 of the Terms of Service summarises. It says what we hold about you, why we are allowed to hold it, who else sees it, how long it stays, and what you can make us do about it.

Two things are worth saying at the top, because they are the whole shape of it. We sell software by subscription and we never hold anyone’s money, so there is no financial profile of you here — no card numbers, no bank details, no balances. And the wallet histories the Service analyses are public blockchain records about third parties; they are not a file we have built on you.

1. Who is responsible

The data controller is Daniel Montgomery-Smith, a sole trader, of 15 Treforris Road, Wallasey, Merseyside, CH45 6UP, United Kingdom, trading as Lockstep Markets. For anything in this notice, write to hello@lockstepmarkets.com.

There is no Data Protection Officer. An operation this size is not required to appoint one, and appointing a nominal one would tell you less than the address above.

2. What we hold, and why we are allowed to

Under UK GDPR every use of your data needs a lawful basis. Ours are contract (we cannot run the account you paid for without it), legitimate interests (a purpose of our own that does not override your rights), and legal obligation (tax and accounting law).

To give you an account

• Your email address — identifies the account, and is where password resets, address verification and notice of a prepaid period running out are sent. Basis: contract.
• A hash of your password, never the password itself. Basis: contract.
• Whether your address is verified, when you joined, which version of the Terms you accepted and when, and how many free analyses you have used. Basis: contract.
• A referral code, if you arrived through one or created one. Basis: contract.
• One cookie, cb_session, which keeps you signed in. See section 6.

To do the thing the Service does

• The wallet addresses you enter, any labels you give them, and the per-wallet and account-wide settings you choose — filters, sizing, limits, poll interval. Basis: contract.
• Your simulated trading history: paper positions, fills, equity and backtest results. Basis: contract.
• An encrypted private key, and only if you switch on copying with real money. You supply it; it is encrypted before it is stored, with a key held outside the database; it is used only to sign orders on the wallet it belongs to; and you can delete it at any time from Settings without closing the account. Basis: contract. We strongly prefer you use a wallet funded with only what you intend to trade.

To take payment

• Your subscription state — plan, tier, whether it is active, when the period ends — and the Stripe customer and subscription identifiers that link your account to the payment. Basis: contract.
• Card details: never. Payment happens on Stripe’s own pages. We are not sent the card number, and could not store it if we wanted to.
• The confirmation you give at checkout that your access should start immediately, which is the thing that ends your fourteen-day cancellation right. What is stored is the exact wording you were shown, the time you gave it, the plan it was for, the Stripe session it belongs to, and — so that it stands up if a payment is ever disputed — the IP address and browser user-agent it came from. Basis: legitimate interests (being able to evidence what was agreed) and legal obligation (accounting records). This record is the one thing that outlives the account; section 5 explains why, and section 7 explains what you can do about it.

To keep the service standing up

• Your IP address, while you are signing up, signing in or asking for a password reset. It is counted, not filed: it lives in the server’s memory to rate-limit brute-force attempts and disappears when the process restarts. It is not written to the database. Basis: legitimate interests (preventing abuse of other people’s accounts).
• Server logs. Our own log lines mask email addresses. The hosting platform keeps its own request logs, which include IP addresses, for a short period. Basis: legitimate interests (diagnosing faults and attacks).
• Error reports. When the software throws an exception we receive a report of it. It is configured to send no IP address, no request body and no cookies: what we get is the error, and where in the code it happened. Basis: legitimate interests (fixing our own bugs).

What is not data about you

The Service reads public on-chain activity: wallet addresses, the trades they made, the prices they paid, and how those markets settled. It caches the statistical scores it computes from them. All of that is public record about third parties, stored against a wallet address rather than against your account, and it is not deleted when you close your account — there would be nothing personal to delete. If you analyse your own wallet, you have chosen to point a public-data tool at a public record you control; we do not link the address to your account beyond your own list of tracked wallets.

We do not ask for, and have no use for, your name, your date of birth, your address, your phone number or any identity document.

3. Who else sees it

We use no advertising network, no data broker and no third-party analytics. Nothing here is sold, and nothing is shared for anyone else’s marketing. The only parties who touch your data are the suppliers who make the Service work, each of them acting on our instructions and under contract:

• Vultr (The Constant Company, LLC) — provides the server the application and the database run on.
• Cloudflare, Inc. — answers DNS for the domain, which is how your browser finds us. It is not in the path of the connection itself: your browser reaches our server directly, and Cloudflare does not see your traffic or your IP address.
• Stripe — takes the payment. For your card details Stripe is not our supplier but its own controller, under its own privacy policy. It holds the identity behind a payment; we hold only the reference.
• Resend — delivers the transactional emails listed in section 2, and so is given the address they are sent to.
• Sentry (Functional Software, Inc.) — receives the error reports described above.

Polymarket’s public APIs and a Polygon blockchain node are also queried, but with wallet addresses and market identifiers only. Those requests carry nothing about you and come from our server, not your browser.

We would also disclose data if the law required it — a court order, a regulator with the power to demand it — and if the Service were ever sold, to the buyer, who would be bound by this notice until they gave you a new one.

4. Where it goes

Your data is processed in Mexico, and it is worth being specific about which part is where. The application and the database holding your account run on a server in Querétaro, and your browser connects to it directly. Payment, email delivery and error reporting are United States services, although Stripe also contracts and operates through UK and Irish companies.

Mexico is not a country the UK has found to offer adequate protection, so that transfer is made under the UK International Data Transfer Addendum to the EU standard contractual clauses, which binds the supplier to standards equivalent to the ones you have here. Transfers to the United States services above rely on the UK Extension to the EU–US Data Privacy Framework where the supplier is certified under it, and on the same Addendum otherwise. Ask us which applies to a particular supplier and we will tell you.

5. How long it stays

• Everything in your account — email, password hash, stored key, tracked wallets, settings, simulated history — until you delete the account. Settings has a delete option; it is immediate, it cancels any subscription first so you cannot keep being billed, and it is irreversible. We keep no copy and cannot restore it.
• Backups are overwritten on a rolling basis, so a residual copy of deleted data disappears with the backup that held it rather than at the moment you press the button.
• Rate-limiting IP counts — minutes, and gone on restart.
• Checkout confirmations and payment records — six years from the end of the tax year they fall in, which is what UK accounting law requires and also comfortably outlasts the window in which a card payment can be disputed. This is why the confirmation survives account deletion: a dispute usually arrives after somebody has stopped using a service, often after they have closed the account, and throwing the evidence away at precisely that moment would be the same as never taking it. The record carries no name and no email.
• Error reports — for as long as our error-reporting plan retains them, after which they are deleted automatically.

6. Cookies

One cookie: cb_session. It holds a random session token, is marked HttpOnly and Secure so that page scripts cannot read it and it is never sent over plain HTTP, and is restricted to this site. It exists only to keep you signed in, which is why there is no cookie banner — a cookie strictly necessary to provide something you asked for does not need consent, and we set no others. We use no advertising or analytics cookies, and no tracking pixels in our emails. Logging out or deleting the cookie ends the session.

7. Your rights

Over the data described here you have the right to:

• See it — a copy of what we hold, free, normally within one month.
• Correct it if it is wrong.
• Have it erased. Mostly you can do this yourself and instantly, in Settings. Ask us instead if you prefer.
• Restrict or object to what we do with it where we rely on legitimate interests. That includes the checkout confirmation: tell us you object and we will weigh your objection against our need to defend a payment dispute, and give you a reasoned answer rather than a form reply.
• Take it with you — the data you gave us, in a machine-readable file.
• Withdraw consent, where consent is what we relied on. Note that the checkout confirmation is not held on the basis of consent; it is the record of a consent, which is a different thing, and withdrawing it now would not un-write what you agreed to then.

Write to hello@lockstepmarkets.com. We may ask you to confirm you control the account’s email address, because handing someone’s data to whoever asks for it is its own breach.

If you think we have got this wrong, you can complain to the Information Commissioner’s Office — ico.org.uk, or 0303 123 1113. We would rather you told us first, but you do not have to.

8. Automated decisions

The Service is built on an automated judgement, so it is worth being precise about what it judges. It scores wallets — whether a public trading record beats the prices that record paid — and it will refuse to place real orders behind a wallet that has not cleared that bar unless you override it. That is a decision about a wallet, not about you. Nothing here profiles you, and no automated decision is made about you that has legal or similarly significant effects. Whether real money is committed is settled by limits you set and can switch off.

9. Keeping it safe

Passwords are hashed, never stored. A stored trading key is encrypted with a key held outside the database, and the application refuses to start if that key cannot encrypt and decrypt a test value — better to fail at boot than to discover it at the moment a customer’s key is needed. The site is served over HTTPS only, with a content security policy that forbids third-party scripts, and the session cookie cannot be read by page scripts. Access to the production database is limited to the operator named in section 1.

No one can honestly promise this is impregnable. If a breach ever affects your rights and freedoms we will tell the ICO within 72 hours and tell you without undue delay, and we will say what actually happened rather than that we take your privacy seriously.

10. Children

The Service is not for under-18s and the Terms require you to be 18. We do not knowingly hold data about children. If you believe we do, write to us and it will be deleted.

11. Do you have to give us this?

An email address and a password, yes — there is no account without them. A wallet address is needed for the thing you came to do. A private key is entirely optional, and everything except copying with real money works without one. Nothing here is collected on the strength of you not reading this page.

12. Changes

If this notice changes materially we will email you, as clause 16 of the Terms requires. The version and date at the top are the record of when it last did.

← Back to Lockstep Markets