Privacy

This notice describes what crypto.bot stores and does not store, in your browser and on its api. Counsel will complete the sections on retention and on your rights under [applicable data protection law] before launch.

1. Who is responsible

[Operating entity] is responsible for this site. Contact: [Contact email]. Data protection contact, if required: [Data protection contact].

2. What the frontend stores locally

The app keeps a small number of preferences in your browser's local storage. They never leave your device and are not sent to us.

The cookies page lists what is stored right now and has a button that clears all of it. Clearing your browser's site data has the same effect.

3. What the api stores

• Your account: the email address you sign in with, the time of each sign-in, and your sessions with their device name and expiry. Passkeys are held by the wallet provider, not by us.
• Your wallet address, and the orders you confirmed with their fills, fees and transaction signatures. These are also public on the chain they ran on.
• Wallet addresses you track and the settings you save to your account.
• If you joined the waiting list on the coming-soon page: the address you gave and the time, used only for one email when the app opens.
• Request logs for rate limiting and fault finding, kept for a short period. [Log retention period: to be set by counsel.]

4. What is not collected

• No password: sign-in is a one-time code to your email, or a passkey. We never see a password.
• No keys: the software never asks for, stores, logs or transmits a private key or seed phrase. The key exists only in the wallet provider's secure environment under your login; an export is shown to you once and not kept.
• No analytics or tracking scripts, no advertising identifiers, no cross-site cookies.

5. Analytics: to be decided

No analytics tool is in use. If one is adopted it will be privacy-first: self-hosted or cookieless, with no wallet addresses sent to any third party, and with an opt-out honoured in Settings. The choice will be recorded in a decision document and this notice will be updated before it takes effect. [Analytics provider, if any: to be decided.]

6. Third parties

The site loads fonts and scripts from itself. Links to block explorers or social pages open third-party sites with their own notices. The site, the api and their databases and logs run on Google Cloud in Frankfurt, and sign-in codes and alerts are sent through Google Workspace's mail relay, which receives your email address and the message. The product depends on a wallet provider (Privy), which receives your email address and holds your passkeys and wallet keys; on RPC and data providers (Helius on Solana; on the EVM chains our own nodes first, then keyed and public endpoints and Alchemy when they cannot answer), which receive the addresses and transactions you look up or send; on routing providers (Jupiter on Solana, 0x on the EVM chains), which receive the quotes you request; on risk data providers (RugCheck on Solana, GoPlus on the EVM chains), which receive the token addresses you open; and, where it is switched on, on a sanctions screen (Chainalysis), which receives the wallet address an order or a transfer moves funds for. The social feed reads public posts from CryptoPanic, Farcaster (through Neynar), Reddit, X, publisher RSS feeds and GMGN; those sources are asked about tokens, never about you. Each has its own notice. [Third-party processors and their terms: to be completed by counsel.]

7. Linked X account

Linking an X account is optional, and nothing is linked until you do it. The link starts only after you tick a consent sentence on the Connections tab, and we store your X handle, display name, the address of your profile picture, the time of the link, the date of the consent wording you ticked, the read-only scopes the link holds, and the result and time of the last bio check. The link asks X for read access to your public profile, and reads your bio only when you press the referral check; the bio text itself is never stored. We never post, reply, like, follow or message as you, and never read direct messages, bookmarks, lists, who you follow or anything not already public. Your handle is matched to a wallet only when you prove that wallet by signature; the on-chain line and the caller record come from those wallets' trades and from nothing else. You can revoke the link at any time from the Connections tab: we tell X to revoke it, delete the handle, picture address, consent and check result, and remove the on-chain line and caller record from cached posts within the hour. [Legal basis and retention after revocation: to be set by counsel.]

8. Cached third-party posts

Tracer, where it is switched on, shows public posts from X that name a token we list. They are written by their authors, shown with attribution and a link back under X's display rules, and are not ours. Posts from protected accounts are not kept. We keep a post's text, its author's public profile and the post's public counts for up to 30 days, only to display it, to compute the social facts and to place the chart markers; a deletion job runs every six hours and removes what is older, and an author with no post left is removed with the last one. A post deleted, protected or suspended on X is not yet checked for once it is kept. [Re-checking every cached post and profile against X, and the time within which such a post is removed: to be built and set before launch.] A removal request from a post's author, sent to the address on this page, is applied by hand. [Time to apply a removal request: to be set.] We do not store posts against your account, linking X does not change what is cached, and no post from Tracer is used in marketing or shown on the public site. [Processor and data-source terms: to be completed.]

9. Retention

Local preferences stay until you clear them. Account, session and order records are kept while your account exists. [Retention periods after account closure: to be set by counsel.] Logs never contain keys, and never contain IP addresses beyond what rate limiting needs.

10. Your rights

[Rights of access, correction, deletion, portability and objection, and the supervisory authority, to be set out by counsel under the applicable law.] Your preferences are on your device and under your control; you can export your wallet key at any time and end every session with Revoke.

11. Changes and contact

Changes to this notice are announced in the Software and dated at the top of this page. Questions: [Contact email].