Polypick: what a buyer should know before wiring $22,700
Polypick sells AI "picks" for Polymarket and Kalshi bets through Whop for $39 a month or $49 lifetime. Revenue is real and recent, and that is the whole story: 301 subscriptions in four months, already down a third month over month, on a landing page built from fabricated testimonials and a fake payout counter. The price says the seller knows.
Verdict
| Revenue | red | Four months old, revenue booked through Whop (not Stripe), last 30 days at 68 percent of stated MRR, and a $49 lifetime deal sold next to subscriptions. The MRR figure is not what a buyer normally means by MRR. |
|---|---|---|
| Tech | yellow | Tiny static site, loads fast, mobile clean. No pricing or contact page, apex and www both serve the site without a canonical redirect. |
| Security | yellow | Four security headers missing, DMARC policy set to none. Nothing exposed. |
| Owner | red | The homepage runs a live counter of "$8.4M cashed out this month" and pop-ups of named users "winning $4,182, 31 min ago", with avatars fetched from randomuser.me. That is manufactured social proof, and whoever buys the site buys that liability. |
| Price vs. market | Asking $22,700 is 0.16x the last 12 months of verified revenue, 9 percent of the TrustMRR median multiple. Nobody prices a working subscription business at two months of revenue unless they expect it to stop working. | |
84 checks run · 65 passed · 8 warnings · 2 failed · 9 could not be verified (listed below)
Listing facts
- MRR
- $11,768
- Revenue, last 30 days
- $8,058
- Revenue, all time
- $38,743
- Active subscriptions
- 301
- Asking price
- $22,700
- Stated multiple
- 0.20×
- Computed multiple vs. 1.8× median
- 0.16× (0.09× the median)
- Founded
- 2026-05-01
- Payment provider
- Whop (API key)
- Revenue last synced
- 7.4h ago (2026-09-04)
- Domain Rating
- 1
Findings
What. The hero shows a live counter "$8,412,970 cashed out by Polypick traders this month" and a rotating notification "David L. from Austin won $4,182 on their bet, 31 min ago, verified by Proof". The five reviewer avatars next to "4.9/5" load from randomuser.me, a service that generates random fictional people for UI mockups. The "Proof" badge is a notification widget, not a verification of anything. Reproduce. Open polypick.app on a phone. Watch the payout notification change names. Open the browser network tab and filter by randomuser.me. Evidence. Mobile screenshot at 360 px, September 5, 2026: counter, notification card and avatar row visible above the fold. 
Third-party request map from the same load lists randomuser.me among the hosts the page calls. Meaning for the buyer. Every one of the 301 subscribers signed up on a page whose proof is invented. In the US this is the kind of claim the FTC acts on; on Whop it is a terms violation waiting for a report. A new owner either keeps the page and inherits the exposure, or removes the counters and finds out what conversion looks like without them.
What. The checkout offers a monthly plan and a "$49 one-time lifetime" option with a 20 percent discount code. Whop reports both to TrustMRR. Stated MRR is $11,768 across 301 active subscriptions (average $39.10), while the last 30 days of revenue are $8,058, a 32 percent gap after only four months of history. Reproduce. Read the pricing block on the homepage. Open the TrustMRR card: provider Whop, MRR, revenue last 30 days, active subscriptions. Evidence. TrustMRR markdown card synced 2026-09-04 23:38 UTC: MRR $11,768, revenue 30d $8,058, all-time $38,743, 301 active subscriptions, provider "Whop (API key)". Homepage pricing text: "$49 one-time lifetime, cancel anytime, use code RICH20 for 20 percent off". Meaning for the buyer. Lifetime buyers never pay again but count as active. Monthly buyers of a "beat the market" tool leave as soon as they lose. Both effects push real recurring revenue below the headline number, and the 30-day figure is already showing it. Treat $8k as the current run rate and expect it to keep falling without a new acquisition channel.
What. Domain polypick.app registered 2026-05-01. Founded date on the card matches. All-time revenue $38,743 was earned in roughly 17 weeks, which is a strong launch and no track record at all. Reproduce. RDAP lookup for polypick.app. TrustMRR card, founded date and all-time revenue. Evidence. RDAP: registered 2026-05-01, expires 2027-05-01. TrustMRR: age 4.2 months, all-time $38,743. Meaning for the buyer. There is no seasonality, no churn cohort older than one quarter, and no evidence the acquisition channel survives without the founder. Any multiple applied to this revenue is a bet on a four-month trend.
What. Headline "The #1 AI tool to beat prediction markets", copy about "spotting the winning side", payout counters. Prediction-market betting advice is regulated as gambling or investment advice in several jurisdictions, and Whop and payment processors restrict it. Reproduce. Read the homepage headline and hero copy. Evidence. Homepage text captured September 5, 2026. Meaning for the buyer. The processor (Whop) can close the account on a complaint. Ask whether Whop has ever flagged or held funds, and whether any chargebacks were filed as "misleading".
What. No Content-Security-Policy, X-Frame-Options, X-Content-Type-Options or Referrer-Policy. DMARC exists but with p=none, so spoofed mail from the domain is delivered. Both polypick.app and www.polypick.app return 200 with no redirect between them. Reproduce. curl -sI https://polypick.app/; dig TXT _dmarc.polypick.app @1.1.1.1; open both hosts. Evidence. Header, DNS and HTTP captures, September 5, 2026. Meaning for the buyer. An afternoon of fixes. Listed for completeness and because it confirms the site was assembled quickly.
Red flags
- Fabricated testimonials and payout counter on the landing page (F-01). Legal and platform exposure transfers with the asset.
- Lifetime deals counted inside "MRR"; 30-day revenue already 32 percent below it (F-02).
- Four months of history, no cohort older than a quarter (F-03).
- Gambling-adjacent advertising claims on a processor that can close the account (F-04).
- Asking price of two months of revenue: the seller is pricing in the decline (verdict).
- No pricing page, no contact page, no canonical host, no security headers (F-05).
Ask the seller
- Whop dashboard on a call: revenue by week since launch, split between monthly subscriptions and lifetime purchases, active subscriptions by plan, cancellations by week. closed by: live Whop dashboard.
- How many of the 301 "active subscriptions" are lifetime purchases that will never bill again. closed by: Whop export by product.
- Where did the 301 customers come from: paid ads, an affiliate, a Discord or Telegram community, the founder's own audience. Show the last 90 days of traffic sources. closed by: analytics screenshot with source breakdown.
- Has Whop or any payment provider ever flagged, paused or reviewed the account, and how many chargebacks or refund requests were filed since launch. closed by: Whop account status page and refund log.
- The source of the "$8.4M cashed out" counter and the payout notifications: real data, estimated, or generated. closed by: the code path that renders them, on screen share.
- Does any regulated jurisdiction account for a meaningful share of customers (US states with gambling advertising rules, UK, EU). closed by: Whop customer export by country.
- What the "AI" is: own model, prompt over a third-party API, or rules. Which API key and account it runs on and what it costs per month. closed by: invoices and the code path.
git log --shortstat: first commit, authors, commits in the last 30 days. closed by: screen share of the repository.- What is included: domain, Whop store, Discord or Telegram community if any, social accounts, the AI provider account. closed by: asset list in the term sheet.
- Why sell a four-month-old product at two months of revenue. closed by: nothing, but compare the answer with the weekly revenue curve from question 1.
Checked and clean
What was tested and came back clean, so the scope of the review is visible too.
Could not be verified
Read-only, no login, no purchase attempted: some checks are structurally inconclusive from the outside. Listed honestly instead of silently dropped.
Method
This review is limited to what is observable from outside the product: the public marketing site, DNS and TLS records, HTTP response headers, and the listing card published on TrustMRR. No code, admin panel, database or paid API was accessed at any point, and no account was created or signed into.
Every network check in this report is a GET request; nothing was submitted, purchased or configured. Revenue figures come from the provider connection TrustMRR displays on the listing (Whop (API key)), not from a separate audit of the seller's account. This scan ran on September 5, 2026.
Order a Buyer's Check
For a listing you are considering: independent technical review, $199, delivered in 48 hours.
Order a Buyer's Check →