Privacy policy

Who we are

15minutemarkets.com (“15 Minute Markets”, “we”, “us”) is run by PromptReports LLC, 210 Molly Court, O’Fallon, IL 62269, in the United States. We publish research on prediction markets, sell the Research and Institutional plans, and offer the Ask desk, the Rulebook journal and a data API. We do not trade for customers. 15 Minute Markets is independent and is not affiliated with, endorsed by, or sponsored by Kalshi or Polymarket.

Questions and requests about your data go to support@15minutemarkets.com.

What we collect

Your account

• Your email address and, if you give one, your name.
• A one-way hash of your password (argon2id). We never store or log the password itself.
• If you sign in with Google: your Google account identifier, name, email and profile picture address.
• If you turn on two-factor sign-in: the authenticator secret, encrypted with AES-256-GCM, and one-way hashes of your recovery codes.
• Sessions: one database row per sign-in, holding a random token, when it was made and when it expires.
• One-way hashes of the links we email you, such as confirmation and reset links.
• Which version of the terms you accepted, when, on which form, and that you confirmed you are 18 or older. Your invite request keeps your name, email, note and the time you confirmed your age.
• A message sent from the Contact us page keeps the name, company, email, website and message you typed, and whether our email about it went out. It is emailed to our team and kept so we can answer it.
• Failed sign-in, reset and two-factor attempts, keyed by your email address, your account id or the network (IP) address they came from, used only to limit password guessing.

Billing

Stripe handles payments. We store your Stripe customer and subscription identifiers, your plan, the subscription’s status and, on the Institutional and Data plans, the firm the licence names. Your card number never reaches our servers; Stripe collects it on its own pages and keeps its own records under its own privacy policy.

On the Team plan, the buyer owns an organisation and invites people to it. We store the organisation’s name, its members and their roles (owner, admin or member), and each invitation: the email address invited, the role, who sent it, when it expires and whether it was accepted or withdrawn. A member who joins holds a seat, which we record on their own account as the Team plan with the status “seat”, for as long as the buyer’s subscription runs. When it ends, we take every seat back.

The Ask desk and your model keys

• The model key you save for the desk (Anthropic, OpenAI or OpenRouter), sealed in our key vault: encrypted with AES-256-GCM under a key made for you alone, which is itself encrypted under a master key held only in our host’s server settings. We show only its last four characters, open it only to send your question, and never log it.
• Your chosen provider and models, your daily spending cap, and whether the key last worked.
• Each conversation: your questions, the answers, which tools each answer used and what they returned (in short form), the cost, the figure check, and any change the desk drafted and whether you confirmed it.

To write an answer, the desk sends your question and what our tools return, which can include your own account’s settings and records, to the model provider whose key you saved. That provider handles it under your own agreement with it.

Exchange keys

• A Kalshi or Polymarket US key you connect, for the Rulebook journal or for the trading pages admins keep: the key id, and the private or secret key in sealed form only. It is encrypted on our server the moment you submit it with a public key whose private half only our research service can use (held in Google Cloud Key Management Service for keys sealed since we switched that on). The website itself cannot decrypt it.
• The connection’s status, errors, and when it was checked or removed.

The Rulebook journal

• Every version of the rules you write, and when you saved it.
• Each pre-trade check you run: the order you described, the answer, which rules it failed, and if you went ahead anyway, your reason and when.
• With a journal key connected: your fills and settlements as the exchange reports them, the fees we work out beside the exchange’s, your reports, weekly reviews and weekly commitments, and the journal job’s progress and last error.
• Your Rulebook email choices and when each was last sent.

API keys and usage

• For each data API key: its name, the series and scopes it may use, its limits, and when it was made, last used or revoked. We keep only a one-way hash of the key itself.
• For each API request (the api_usage log): the key, your account, the time, the route, the series, the status code and the size of the reply.
• Signed download links for the daily Parquet files are not stored. Each download is checked against the key that asked for the link and counted as one request against that key’s limits.

Webhooks

• For each webhook endpoint you register: its web address (URL), its signing secret in encrypted form, the event kinds, series and families you chose, when it was made, removed or switched off, and its run of failed deliveries.
• For each delivery: the event we sent, the number of attempts, the next retry, and the status code or error your endpoint answered with. This is the delivery log on your webhooks page.

A removed endpoint stays in your records, marked removed, until you delete your account. We send your endpoint our own research events only, never data about you or anyone else.

AI agents and the MCP server

• When you authorise an AI agent: the OAuth grant (which client, which scopes, when made, last used or revoked), single-use codes and access and refresh tokens, each stored only as a one-way hash.
• For each call an agent makes: the time, the client, the tool, its arguments, the data families and gates it touched, and a keyed hash of the network address.
• If you belong to an organisation: its name, its members and their roles, invitations, and its rules for agents (the scopes members may grant and its daily limit).

Every agent grant needs two-factor sign-in, and if you turn two-factor off, your grants are revoked and your agents stop. The MCP server is open only to our own admins, for testing, until we open it to customers. Until then these records exist only for admin accounts.

Emails you choose

Your settings for account alerts, price alerts (the series and levels you watch), outage notices, the morning and weekly summaries and the Rulebook emails, and a record of each one sent so nobody is emailed twice. Every email you can turn off carries a one-click unsubscribe link.

The newsletter

You can subscribe to the weekly research newsletter with an email address alone, without an account. We store the address, whether it is waiting for confirmation, confirmed or unsubscribed, when each of those happened, the page you signed up on, and which version of the sign-up wording you saw. We send a confirmation link first and mail nothing else until you open it. Every newsletter has a one-click unsubscribe link; after you use it we keep the address marked as unsubscribed so it is not mailed again, and we delete it on request. Links in the newsletter pass through our own click counter, which records the issue and the article, not who clicked.

The same list carries the morning and evening daily briefs. We store which of the three emails you chose (the weekly newsletter, the morning brief, the evening brief), and you can change that from a link in any of them. If you turn a brief on from your account, we add your account's verified address to the list with that choice, without a second confirmation. Links in a brief pass through the same click counter, which records the edition and the page, not who clicked.

Page counts

We count page views on our own servers, with no cookies, no browser storage and no third-party scripts. We keep only daily totals: views per page, unique visitors per day, reads by known AI agents, and newsletter sign-ups, confirmations, unsubscribes, sends and clicks. To count a visitor once a day we make a one-way hash of your network address and browser type with a random value that changes every day; the hash and that day’s value are deleted when the day ends, and the address itself is never stored. If your browser sends Do Not Track or Global Privacy Control, we count the page view but make no hash.

Ask the lab

“Ask the lab” on the research lab page answers research questions, with or without an account. For each conversation we store your questions and the answers, which of our tools each answer used, what the answer cost us, and the study request the desk drafted, if it drafted one. If you then send that request with the form, the request is linked to the conversation. If you are not signed in, we set one cookie holding a random id (not tied to your name or email) so a conversation can continue and our daily limits apply to you. For rate limits we keep a one-way, keyed hash of your network address (for IPv6, of its first half), never the address itself.

When you are signed in and ask about your own account, the desk reads your plan, its status, your newsletter setting, whether your email is confirmed and two-factor is on, your firm, and your own study requests, quotes and commissions, and passes what it read to Anthropic, our model provider for this desk, to write the answer. It changes nothing on your account. Please do not include personal details in a question.

Study requests and client accounts

When you ask us for a study we keep your name, firm, email, the question, your timeline and the size you chose, and, once we take it on, the commission’s status, its scope, the quote, progress, interim figures, the files we deliver and a log of every change. We email you when its status changes; those emails are about your request, not marketing. Your data download includes them; deleting your account unlinks them from it, and we keep the request itself for our records of the work.

Older trading records

Automated trading is not offered to customers. An account that used the trading pages before they closed may still hold its strategy settings, the orders our service recorded for it, balance snapshots and an event log. They show in your data download and are deleted with your account.

Logs

Our hosts keep request logs (time, path, network address, browser type) and our own error messages for running and securing the service. We write no passwords, keys or card data to logs.

How we use it

• To run your account, sign you in securely, and send the emails you asked for.
• To bill your subscription and apply the plan you pay for.
• To answer your questions on the Ask desk, run your Rulebook checks and keep your journal.
• To serve the data API and the MCP server, apply their limits, and show you your own usage.
• To keep a record of the terms you accepted.
• To protect the service, look into abuse, and meet legal obligations.

We do not sell your personal information, share it for cross-context behavioural advertising, or run advertising trackers. We do not use your journal, your questions or your records to trade for ourselves.

Who processes it for us

• Vercel hosts the website and its logs.
• Neon hosts the Postgres database that holds the records above.
• Stripe takes payments and runs subscriptions.
• Resend sends our emails.
• Google provides Google sign-in, if you use it, and Cloud Key Management Service, which holds the key that unseals exchange keys and records each use of it.
• Anthropic runs the model behind Ask the lab, and the Ask desk when you save an Anthropic key.
• OpenAI runs the model behind the Ask desk when you save an OpenAI key.
• Railway hosts our research service, which reads your journal key to fetch your fills and settlements, computes figures for the desk, and serves the derived data behind the API.
• Sentry receives a report of each error our servers catch, and of each error a browser reports from our error pages: the error’s name and message, where in the code it happened, the page path with its query string removed, and the release. We send no user, no network address, no cookies and no sign-in headers. Only while we have Sentry switched on.
• Evidence Rooms (rooms.aisourceoftruth.com) holds the evidence for a market integrity case when one of our admins sends it there. It receives the files the admin chooses (trade exports, chat logs, screenshots and logs, which may hold personal information), the case as our queue holds it, and with each file the trade ids, market tickers, exchange account handles and capture time. We refuse an account handle with a space or an “@” in it, so no name or email address goes in that field. It also receives the email address of each person an admin invites to the case, such as outside counsel or a regulator, and of the admin when they invite themselves. Only while it is switched on.
• ContextFile (contextfile.ai) publishes some of our guides and reports. While that is switched on, our server reads our own published items back from its public feed to show them on the site. We send it nothing about you.

When you save your own model key, the provider handles your questions under your agreement with it as well. Kalshi and Polymarket US are not our processors: your relationship with each exchange is under its own terms and privacy policy. Each processor handles data only to provide its service to us. We may also disclose information when the law requires it, to protect rights and safety, or as part of a sale or reorganisation of the business, in which case this policy continues to apply to it.

How long we keep it

• Account, settings, terms acceptances, model keys, exchange keys, Rulebook records, API keys, webhook endpoints and their delivery logs, organisation memberships and Ask desk conversations: while your account exists, unless you delete them sooner.
• Sessions: until you sign out, or 7 days after they expire. Sessions last seven days. Emailed links: until used or expired.
• API request log (api_usage): 90 days.
• Agent call records: 13 months, then rolled into daily counts that hold nothing about any person; the network address hash in each is removed after 30 days. Spent codes and expired tokens are deleted as they lapse.
• Failed-attempt records: removed as newer attempts replace them.
• Newsletter subscriptions: until you ask us to delete the address.
• Daily page and newsletter counts: kept as totals, with nothing about any person.
• Ask the lab conversations, their drafted briefs and per-visitor spend: deleted 180 days after the last question, or sooner on request.
• Host logs: for the retention period of each host, typically days to weeks.
• Error reports at Sentry: for Sentry’s retention period for our account.
• Evidence sent to Evidence Rooms: Rooms keeps each file amend-only and logs every read, and this site cannot delete a file once it is sent.
• Payment records at Stripe: as long as Stripe and tax law require, which is usually several years, even after you delete your account.

Deleting and downloading your data

From your data page you can download a JSON file of every record we hold about you, and delete your account. Secrets (password hash, two-factor secret, tokens, sealed keys) are listed only as present or absent. Deletion cancels your subscription at once, deletes your sealed keys, revokes your API keys, agent grants and webhook endpoints, and deletes your account with every record attached to it. We keep one line saying that an account was deleted on that date, with nothing that points to you, so we can show that deletion requests are honoured. You can also email us to make any request.

Security

Passwords are hashed with argon2id, two-factor secrets are encrypted, and two-factor sign-in is required before you can connect an exchange key or approve an agent. Exchange keys are sealed before storage and can be opened only by our research service; model keys are sealed in a vault the database’s customer role cannot read. The database enforces row-level security so each customer’s records are readable only in that customer’s own session. All traffic is encrypted in transit. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Cookies

We set only the cookies sign-in needs: a session cookie, and short-lived cookies Auth.js uses for security (CSRF protection and the Google sign-in round trip). If you continue with Google from an invite, a cookie holds the terms version you accepted for up to 15 minutes. Your theme choice is kept in your browser’s local storage. Stripe sets its own cookies on its checkout and billing pages. We use no advertising or analytics cookies. If you use Ask the lab without signing in, we set one more cookie, lab_visitor, holding a random signed id, sent only to the desk itself and kept for up to a year so your conversation and its limits carry over.

Children

The service is for adults. You confirm you are 18 or older when you request an invite and when you create an account, and we do not knowingly collect information from anyone under 18. If you believe a minor has an account, tell us and we will delete it.

Your rights under US state privacy laws

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with consumer privacy laws), you may have the right to know what personal information we collect and how we use it, to get a copy of it, to correct it, to delete it, and to opt out of its sale, targeted advertising or profiling. We do not sell or share personal information for advertising and do not profile you for decisions with legal effects. You may use these rights through your account pages or by emailing us, and you may use an authorised agent. We will verify your request by confirming control of your account, and we will not treat you differently for using your rights. If we refuse a request, you may appeal by replying to our answer; if the appeal is refused you may contact your state attorney general.

California residents: in the past 12 months we collected identifiers (email, name, account ids, IP address), commercial information (subscription and payment status), account credentials in sealed form (exchange and model provider keys), and internet activity on our site (logs, API and agent call records). We disclosed them only to the processors listed above, for the purposes listed above.

Changes

We will post changes here with a new date. If a change materially affects how we use information we already hold, we will tell you by email or on the site before it takes effect.

Contact

PromptReports LLC, 210 Molly Court, O’Fallon, IL 62269. Email support@15minutemarkets.com.