This policy covers the polymarket.layback.trade site: the public pages, the in-browser trading app and the desktop app download links. Last updated: 2026-10-13.
What we collect on public pages
Public pages use first-party cookies only: lbx-locale remembers the language you chose (Portuguese, English or Spanish) for up to one year; lbx_aid is a random identifier for this browser, kept for up to 400 days, which lets us count visitors and measure the funnel; lbx_attr keeps for 90 days the origin of your visit (the campaign or link that brought you here); and lbx_consent stores for one year your answer to the cookie notice, where it is shown. lbx_aid and the desktop app's installation identifier are randomly generated: they contain nothing and derive from nothing personal, not your wallet and not your key. The campaign recipient code is different: if you arrived through one of our campaign links with a per-recipient code (such as those in our emails), lbx_attr keeps that code. It does not carry your name or your email, but it is pseudonymised personal data, because we can relate it to the recipient of that campaign and, through it, know that this recipient visited the site.
Audience measurement and marketing
We record product usage events (page views, app opens, downloads, sign-ins with success or error, orders submitted and filled) in our own service, on the same domain, tied to the random identifiers above. In both the web app and the desktop app, a successful sign-in and every order submitted also carry the public address of the trading wallet you use on Polymarket, so we can measure usage per account; never the private key. That address stays in our own database only and is never sent to Meta or Google. We do not store your IP address in those records: only the country. The desktop app sends the same usage events with a random installation identifier created on first run, plus the trading wallet's public address on a successful sign-in and on orders, as the web app does. When you open a link from the app to this site, the link carries that identifier; we record the tie between it and this browser's random identifier (lbx_aid) once per installation and browser pair, together with the origin kept in lbx_attr, and remove it from the page address. On a new installation's first run, the app opens this site's connection guide in your default browser by itself, once, carrying that identifier; that is why the tie is made even if you never click a link in the app. If this browser's visit came from one of our campaign links, including an email with a per-recipient code, the tie lets us associate the desktop app's usage with that campaign and that recipient. Those random identifiers do not come from your sign-in: not your wallet, not your key. To measure ad campaigns we use Google tags (Google Analytics 4 and Google Ads) and Meta's Pixel in the browser and, for the funnel conversions (download, login and first bet), we also send the same event from our server to Meta's Conversions API and GA4's Measurement Protocol. That server send includes the random identifier (hashed for Meta, as-is for GA4), never the wallet address, campaign click ids when present (gclid/fbclid), and the request's IP and browser, neither of which is written to our database. In the European Union, the European Economic Area, the United Kingdom and Switzerland both the tags and those server sends run only after you accept the cookie notice; declining keeps marketing off and the site works normally.
Hosting and access logs
The site is hosted on Vercel. As with any web service, each request produces access logs with IP address, browser, URL and timestamp, used for security and operations. The host also derives an approximate country and city from the IP, which we use for language detection and regional availability. The public /api/geo endpoint shows exactly what the site sees about your own request.
Signing in with your wallet
Sign-in uses your wallet. The private key stays in your browser and is never sent to our servers. The server receives only your public wallet address and a signed challenge; with that it creates a session identified by an httpOnly cookie. Session records (address and expiry) stay on the server until they expire or you sign out.
Trading
Orders are built and signed in your browser and sent to Polymarket's public APIs. We are non-custodial: we hold no funds and no keys. Orders may carry Layback's builder attribution, signed by our server, which never sees your key or your funds.
Regional availability
The trading surface follows Polymarket's regional restrictions. To apply them, we check the country the host derives from your IP at sign-in.
Your choices and rights
- Clearing your browser cookies removes the language preference, resets the random identifier and the campaign origin, and ends the session.
- Where the cookie notice is shown, declining keeps the marketing tags and the server-side conversion sends off; the choice lives in the
lbx_consentcookie and can be remade by clearing cookies. - Signing out of the app ends the session on the server.
- For questions or data requests, including requests under laws such as GDPR and LGPD, write to contato@layback.trade.
Changes to this policy
When our practices change, this page changes with them, with the updated date at the top. We do not sell personal data.