What we collect, why, and what you can do about it.
| Data | Why | Kept |
|---|---|---|
| Email address | Account identity, sign-in, service notices | Until you delete the account |
| Password hash | Authentication. Hashed with scrypt — we never store or can read your password | Until you delete the account |
| Watchlists, tracked wallets, alert rules, portfolio entries | They are the product features you asked for | Until you delete them |
| Subscription, balance and payment ledger | Billing, and legal record-keeping | As required for accounting |
| Server logs (IP, request path, timing) | Security, abuse and rate-limit enforcement, debugging | Short-term operational retention |
Two, both strictly functional — no advertising or tracking cookies:
bs_session — your sign-in token. httpOnly (unreadable by scripts),
SameSite=Lax, and Secure over HTTPS.bs_csrf — a cross-site request forgery token. Readable by the page
by design, so it can be echoed back on state-changing requests.Serving a page makes server-side requests to the public data providers listed on
the About page. Those providers see our server's requests, not
your IP address or identity. Fonts and two JavaScript libraries load from
fonts.googleapis.com, cdn.jsdelivr.net and
cdnjs.cloudflare.com, which will see your IP as part of normal browser
requests.
You can access, correct, export or delete your data. Account deletion removes your email, credentials, watchlists, tracked wallets, alert rules and portfolio entries; billing records may be retained where law requires. To exercise any of these, email not published yet.
Depending on where you live (e.g. the EU/EEA under GDPR, or California under CCPA) you may have additional rights, including objecting to processing and lodging a complaint with your data protection authority.
Passwords are scrypt-hashed. Session tokens are signed JWTs delivered in httpOnly cookies. Access to your saved data is scoped to your account. No system is perfectly secure; if you find a vulnerability, please report it to not published yet rather than disclosing it publicly.
Material changes to this policy will be announced in-app before taking effect.