Whalemap Privacy Policy

Effective date: 20 October 2026.

4F TECH LLC, trading as Whalemap (we, us, our), provides Bitcoin analytics and charting at https://whalemap.io (the Service). This policy explains how we process personal information through the Service, authentication, the waitlist and support. Where applicable, the US-state and European notices below provide additional information.

1. Personal information we collect

Information you provide

• Contact and account data: email address, account identifier, and any name or profile image supplied through your account. Email authentication uses one-time codes; we do not require a Whalemap password.
• Waitlist data: your email address, when you joined, and invitation/access status.
• Communications: information you send when requesting support or exercising privacy rights.
• Workspace inputs: chart settings and annotations you enter. Workspaces and drawings are currently saved in your browser's local storage, not synchronised to a cloud workspace. Requests needed to display charts are sent to the server, and operational metadata or page content may be processed by the diagnostics described below.

The current product does not ask for payment cards, bank account details, identity documents, income, contacts, family relationships or precise device location. Do not put sensitive personal information into free-text inputs or support messages unless necessary.

Information from third parties

Google sign-in. If you choose Google sign-in, Google provides your identifier, email address and basic profile information, such as name and profile image, through Clerk. The configured permissions are identity, email and profile only. They do not give Whalemap access to Gmail messages, Drive files, contacts or calendars.

Service providers. Authentication, hosting and security providers supply information necessary to operate and protect the Service, such as authentication outcomes and request logs.

Public blockchain data. The analytics engine processes publicly available Bitcoin blockchain information. That information is separate from the private account information you provide to sign in. Public blockchain records cannot be deleted by Whalemap.

Automatically collected information

We and our providers may process IP addresses, browser/device information, identifiers, visited pages, navigation and feature interactions, access times, errors and request metadata. PostHog has been used for product analytics and session replay. New optional PostHog collection is currently paused. Previously collected signed-in analytics are associated with your Clerk user ID, email and name, including when obtained through Google sign-in.

Session replay can capture page content and interactions such as clicks, scrolling and pointer movement. Input fields are configured to be masked; this does not mean every piece of page text is masked. The current code does not intentionally include free-text chat messages or board names in custom analytics event properties.

2. Tracking and other technologies

Authentication uses cookies and similar technologies to maintain and secure sessions. Browser local storage keeps workspaces and preferences. PostHog may use cookies or local storage to recognise visits and measure usage. See our Cookie Notice.

Optional PostHog analytics and session replay are currently disabled. Before enabling them, we will provide consent and withdrawal controls where required. Essential authentication and proportionate hosting/security logging continue.

3. How we use personal information

Service delivery and operations: authenticate eligible users, maintain accounts, process waitlist requests, send confirmations/invitations, display charts and answer support requests. Joining the waitlist is an explicit action and does not guarantee access.

Preferences: remember locally stored chart configurations and interface choices.

Improvement and analytics: understand feature usage and diagnose errors. Previously collected PostHog events, diagnostics and replay may be linked to account identifiers, name and email. New PostHog collection is paused.

Compliance and protection: prevent abuse, investigate security incidents, enforce service terms, comply with applicable law and establish or defend legal claims.

Aggregated information: we may use statistics to understand product usage. Removing a name alone does not make information anonymous; information still capable of identifying a person remains covered by this policy.

Other uses: we will explain materially different uses and obtain consent where required before using information for those purposes.

We do not sell personal information, share it for cross-context behavioural advertising, display advertising, or use personal information to train AI models. We do not authorise our processors to use it for those purposes. Our use of information received from Google APIs will comply with the Google API Services User Data Policy, including Limited Use requirements where applicable. Joining the waitlist does not by itself opt you into unrelated marketing.

4. Retention

We retain information for the purposes for which it was collected, taking account of its sensitivity, the need to provide the service, security risks, legal obligations and the establishment or defence of claims. When no longer needed, it should be deleted, anonymised or isolated from further use pending deletion.

Our normal retention schedule is:

Following a verified deletion request or scheduled expiry, we aim to remove information from active systems within 30 days, subject to any shorter legal deadline. Restricted backup copies may remain until overwritten under the relevant provider's backup cycle; they are not used for ordinary operations. If restored, deletion instructions are reapplied. We can explain applicable backup arrangements on request.

We retain limited records longer only where necessary to meet a specific legal obligation, resolve an ongoing dispute or investigate an incident, with access restricted to that purpose. Irreversibly anonymised statistics may be retained longer.

Local workspaces remain in your browser until you remove them or browser storage is cleared. Clearing browser data does not delete account, waitlist or analytics records held by providers.

5. How we share personal information

Service providers:

Providers may use subprocessors, including SendGrid for Clerk email delivery. These disclosures do not imply that every provider receives every data category.

People acting for us: authorised personnel and professional advisers may access information as needed for support, operation, security and legal advice.

Authorities and legal protection: we may disclose information where required by law or necessary and proportionate to protect rights, security or legal claims.

At your direction: we may disclose information when you instruct us or give appropriate consent.

Business reorganisation: if ownership of the Service changes through a merger, acquisition or similar transaction, relevant records may transfer to a successor that continues the Service under equivalent privacy obligations. We will give notice where required. We do not sell personal information as a standalone asset or permit a successor to disregard this policy or restrictions attached to Google data.

The Service does not publish user profiles or provide public user-to-user posting.

6. Your choices

Account and waitlist requests: contact [email protected] to request access, correction, deletion or waitlist removal. We may need to verify control of the relevant account before fulfilling a request. We acknowledge requests promptly and respond within the period required by applicable law, normally within one month. Where a lawful extension is necessary, we explain the reason and timing.

Email: essential authentication and service messages are used to provide requested access. Ask to leave the waitlist if you no longer want an invitation. We do not send unrelated promotional emails without a separate appropriate permission.

Google connection: you can revoke Whalemap's connection in your Google Account settings. Revocation does not erase information already received or automatically delete your Whalemap account. Email-code sign-in remains available for eligible accounts.

Browser storage: browser settings allow you to block or delete cookies and local storage. This can sign you out or delete locally saved workspaces. Blocking cookies alone is not a guarantee that all network-based analytics collection stops.

Required information: if you decline to provide an email address or necessary authentication information, account access and waitlist participation may not be available.

7. Other sites, security and international processing

Third-party links and services have their own privacy practices. Review them when using those services directly.

We use measures designed to protect information, including authentication and restricted access. No internet service can guarantee absolute security.

We serve adults worldwide, subject to applicable law. Our operator is a Wyoming limited liability company, and our providers may process information in the United States and other countries where they and their subprocessors operate. Information is not guaranteed to remain in your country. See the European notice below for transfer safeguards.

8. Children

The Service is intended for people aged 18 and above. If you believe we have collected a child's information contrary to applicable law, contact us so we can investigate and take appropriate action. We do not knowingly offer accounts to people under 18. If we learn that an account belongs to someone under 18, we will close it and delete associated personal information unless limited retention is legally necessary.

9. Changes and contact

We will update the effective date when this policy changes, provide appropriate notice of material changes, and obtain consent to new uses where required. A policy update is not automatically consent to a new processing purpose.

Operator/controller: 4F TECH LLC. Postal address: 5830 E 2nd St, Ste 7000 #23516, Casper, WY 82609, United States. Privacy contact: [email protected].

10. US-state privacy notice

This section applies only where a state's privacy law applies to Whalemap and the relevant processing. Depending on that law, you may have rights to information, access, correction, deletion, portability, appeal, and to opt out of sale, sharing, targeted advertising or certain profiling. We will not discriminate against you for exercising rights protected by law.

The categories above describe information collected and disclosed for service purposes under this policy. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising.

Submit requests or appeals to [email protected]. An authorised agent may act where permitted; we may reasonably verify their authority and your identity. We do not routinely request government ID for an ordinary account request. You may also write to the mailing address above. We respond to appeals with our decision and information about further rights available under the applicable law.

Because we do not sell or share personal information for advertising, there is no such processing to opt out of. Optional analytics collection is currently paused. The current product does not make decisions about lending, employment, housing or other similarly significant eligibility using personal information.

11. Notice to European users

Where EU or UK data protection law applies, “personal information” includes personal data and 4F TECH LLC is the controller for processing described here.

Legal bases

We rely on the following legal bases where applicable:

We consider the necessity of legitimate-interest processing and its impact on your rights. You may object to it as described below. Acceptance of the Terms is not consent to optional analytics.

Rights

Subject to applicable conditions, you may request access, correction, deletion, portability, restriction, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Send requests to the contact above. We may verify identity and explain any lawful reason a request cannot be fulfilled.

You may complain to the competent data protection authority, including in your habitual place of residence. UK users can contact the ICO; EEA users can find authorities through the EDPB directory.

International transfers

Contact [email protected] for questions about international processing or to request details of safeguards.

For transfers requiring safeguards under EEA or UK law, we use an applicable adequacy decision or appropriate contractual safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum, as relevant to the recipient and transfer. Eligible transfers to certified US recipients may rely on the EU–US Data Privacy Framework and UK Extension. These mechanisms do not imply that every provider or transfer is covered by the same arrangement. You can request information about the safeguards relevant to your data, subject to necessary redactions.

Adapted from General Legal's CC0 GDPR-enhanced Privacy Policy. The original template was prepared and made publicly available by General Legal, PC. It is for general reference and is not legal advice. Use does not create an attorney-client relationship. General Legal has not reviewed or endorsed this Whalemap adaptation.