Privacy statement
Last updated 30 October 2026
What we store, why we store it, how long we keep it, and how to get it deleted. Short version: an email address and a password hash, nothing else — your positions live on the blockchain, not in our database.
Who is responsible
[Operator name], [address], the Netherlands — controller for the personal data described below. Contact: [email protected].
What we store
- Account data — email address, a password hash (Argon2id, never the password), a verification timestamp, and a generated avatar seed.
- Session data — a session identifier, creation time, last-seen time, IP address and browser user-agent, so you can see and revoke your own logins.
- Security logs — failed login attempts and rate-limit events, retained to stop credential stuffing.
- Public blockchain data — wallet addresses, orders and trades are public by design. We do not control them, and they cannot be deleted by us or by anyone else.
We do not collect analytics profiles, we do not use advertising cookies, and we never ask for a seed phrase or private key — because we never hold one.
Why we process it (legal bases)
- Account and session data: performance of a contract, Art. 6(1)(b) GDPR.
- Security logs: legitimate interest in preventing fraud and abuse, Art. 6(1)(f) GDPR.
- Service email (verification, password reset): contract and legal obligation.
Who else sees it
Our email delivery provider processes your email address solely to send verification and password-reset messages, under a data processing agreement. Our hosting provider stores the encrypted database in the EU (Finland). We do not sell data and we do not share it for marketing.
How long we keep it
Account data is deleted when you delete your account, and inactive accounts are removed after 24 months. Security logs are kept for 90 days. Blockchain records are permanent and outside our control.
Your rights
You can access, correct, export or delete your data from the account page, or by emailing the address above. You may also object to processing or lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Security
Passwords are hashed with Argon2id, sessions are httpOnly and rotate, the database is not reachable from the internet, and access is limited to the minimum necessary. If a breach affects your data, we will notify you and the Autoriteit Persoonsgegevens within 72 hours where the law requires it.
Cookies
We set one essential cookie for your login session. No tracking, no advertising, no consent banner needed. See the cookie statement.