Privacy Policy

1. Scope

This Policy applies to personal information collected through the Coinslator website, account system, subscription services, analytics tools, alarm/notification features, and any related interfaces. It does not apply to third-party websites or services linked from the Service.

2. Information We Collect

We collect the following categories of personal and technical information:

2a. Information You Provide Directly

• Account information: Email address, display name/nickname, authentication method (email/password or Google OAuth), and email verification status.
• Subscription and billing metadata: Subscription plan type, billing status, Stripe customer ID, subscription ID, and payment method metadata (card brand, last 4 digits, expiry). We do not store full card numbers — these are handled exclusively by Stripe.
• User-generated content and settings: Watchlist/favorites, position records, filter preferences, alarm configurations, Telegram username, and Telegram link status.
• Communications: Any messages or inquiries you send to us via email or support channels.

2b. Information Collected Automatically

• Consent-based analytics: After an explicit opt-in only, pseudonymous page and allowlisted feature names, approximate activity/visibility time, focus/idle state, and only coarse device class, operating-system family, and browser family. We do not collect device make/model, hardware architecture, operating-system/browser versions, or raw User-Agent, and do not use these categories for fingerprinting. Analytics does not contain IP addresses, account identifiers, full URLs/referrers, query/hash values, search/filter values, form or key content, tokens, stack traces, or free-form messages.
• Security logs: Login attempts, authentication events, and security-related activity logs.
• Cookies and browser storage: See Section 4 for full details.

2c. Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name and email address from Google as permitted by your Google account settings.
• Stripe: We receive subscription status and payment confirmation events from Stripe via webhooks.
• Telegram: If you link your Telegram account, we receive and store your Telegram user ID and username to enable notification delivery.
• Web push notifications: If you subscribe to browser push notifications, we collect and store a browser-issued push subscription token (endpoint URL and encryption keys) to deliver alerts to your device.

3. How We Use Your Information

We use collected information for the following purposes:

• To create, manage, and authenticate your account.
• To process subscription payments and manage billing through Stripe.
• To deliver the core features of the Service, including data displays, alarms, and notifications.
• To send account-related communications such as verification emails, billing receipts, and service notices.
• To provide customer support and respond to your inquiries. Bug reports, feature requests and priority votes are stored with your account identifier in our support database, independently of optional analytics consent. Moderators review submissions before publication. Published titles, descriptions, statuses, vote totals and team responses are publicly readable; account identifiers and individual voter identities are not displayed. Pending, rejected and hidden submissions remain visible only to their author and our team. Do not include confidential information in a submission.
• To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms.
• With your consent, to analyze pseudonymous usage patterns and improve reliability and the Service.
• To comply with applicable legal obligations and enforce our Terms.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects without your consent.

4. Cookies and Browser Storage

4a. What We Use

Coinslator uses the following types of browser-based storage:

• Strictly Necessary Cookies: Session authentication tokens and CSRF protection cookies required for the Service to function. These cannot be disabled without breaking core functionality.
• Consent record: A signed first-party cookie remembers analytics or essential-only choice and its version for 12 months. A random analytics identifier is created only after acceptance.
• Functional / Preference Storage (localStorage): User interface preferences such as theme (dark/light mode), timezone, display settings, and in-product filters. These are stored locally in your browser and are not transmitted to our servers.
• Push Notification Tokens: Browser-issued push subscription tokens stored server-side to deliver alerts, only if you have opted in to push notifications.

4b. What We Do NOT Use

• We do not use advertising cookies or tracking pixels.
• We do not use third-party behavioral tracking technologies or third-party analytics SDKs.
• We do not share cookie data with advertisers or data brokers.

4c. Cookie Consent

When you first visit Coinslator, a cookie consent notice will be presented. You may accept or decline non-essential cookies. Strictly necessary cookies are always active as they are required for the Service to operate. Your preference will be stored and respected on future visits. You may update your cookie preferences at any time via the cookie settings option in the footer.

4d. Managing Cookies

You can also control and delete cookies through your browser settings. For more information on how to manage cookies, please visit your browser's help documentation. Please note that disabling certain cookies may impair Service functionality.

5. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

• Service Providers: We share information with trusted third-party processors that assist us in operating the Service, including:
  • Stripe (payment processing)
  • Google (OAuth authentication)
  • Telegram (notification delivery)
  • Hosting and infrastructure providers
  These parties are contractually bound to use data only for the services they provide to us.
• Legal Requirements: We may disclose information if required by law, court order, regulatory authority, or to protect the rights, property, or safety of Coinslator, our users, or the public.
• Business Transfers: If Coinslator is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for other purposes with your explicit consent.

6. No Sale or Cross-Context Behavioral Advertising

We do not sell personal information to third parties. We do not share personal information for cross-context behavioral advertising purposes. This applies to all users, including California residents under CCPA/CPRA and Virginia residents under VCDPA.

7. Data Retention

We retain personal information for as long as necessary to provide the Service, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active account data is retained for the duration of your account.
• After account deletion, personal data is deleted or anonymized within 90 days, except where retention is required by law.
• Legal acceptance records (Terms, Privacy Policy acceptance) and billing records may be retained for up to 7 years for legal and compliance purposes.
• Security and fraud logs may be retained for up to 2 years.
• Push notification tokens are deleted upon unsubscribing or account deletion.
• Rejected support submissions are removed after 30 days; completed or closed requests after 365 days. Cleanup runs in small batches. Open requests and published development updates are retained to track ongoing work. Deleted requests lose their development links. Account deletion removes your priority-vote records and daily counters and unlinks your account from retained submissions; published text and aggregate priority totals may remain. Contact [email protected] to request removal of personal information included in text.
• Support uses a strictly necessary, one-day CSRF cookie when you open an account-backed section. Unsubmitted drafts remain only in the current page memory and are lost when you reload or leave the page.
• Raw pseudonymous analytics events are retained for 90 days; consent audit records are retained for 2 years.
• Withdrawal hides matching analytics from reports immediately and triggers physical deletion within 30 days.

8. Security and Data Breach Notification

We implement industry-standard administrative, technical, and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encrypted data transmission (HTTPS/TLS), access controls, authentication requirements, and regular security monitoring.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

In the event of a data breach that is reasonably likely to result in a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by applicable law, within the timeframes mandated by those laws (e.g., within 72 hours under GDPR where applicable).

9. Your Rights (U.S. Users)

Depending on your state of residence, you may have the following rights regarding your personal information:

• Right to Know / Access: Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Deletion: Request deletion of personal information we hold about you, subject to certain exceptions.
• Right to Correction: Request correction of inaccurate personal information.
• Right to Data Portability: Request a copy of your personal information in a portable format.
• Right to Opt-Out of Sale: We do not sell personal information, so this right is not applicable, but it is acknowledged.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Appeal: If we deny a rights request, you may appeal our decision by contacting us.

To submit a rights request, contact us at [email protected]. We will acknowledge receipt within 5 business days. We may ask you to verify your identity (e.g., confirm your registered email address) before processing the request. We will respond within 30 days; for complex or multiple requests, this period may be extended by up to 2 additional months, in which case we will notify you within the initial 30-day period.

10. California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information held by us.
• Right to opt-out of the sale or sharing of personal information (we do not sell or share for advertising).
• Right to correct inaccurate personal information.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising CCPA rights.

To submit a CCPA rights request, contact: [email protected].

11. EU and UK Users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the following applies under the General Data Protection Regulation (GDPR) and UK GDPR:

Legal Bases for Processing

• Contract performance: Processing necessary to provide the Service you subscribed to (account management, subscription delivery).
• Legitimate interests: Security monitoring, fraud prevention, service improvement, and technical operations — where our interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws.
• Consent: For non-essential cookies and push notifications, where we rely on your consent. You may withdraw consent at any time.

Your GDPR Rights

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21)
• Rights related to automated decision-making (Art. 22)
• Right to withdraw consent at any time without affecting prior processing
• Right to lodge a complaint with your national data protection authority (DPA)

International Data Transfers

Your data may be transferred to and processed in the United States and other countries outside the EEA/UK. Where such transfers occur, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical and organizational measures where necessary, or other mechanisms permitted under applicable data protection law. Our third-party service providers (including Stripe, Google, and Telegram) maintain their own Data Processing Agreements and SCCs, to which we are contractually bound as a data controller.

Analytics consent can be withdrawn at any time through Cookie settings without affecting processing performed before withdrawal. Where applicable, you may request access, correction, deletion, restriction, objection, and portability, and lodge a complaint with your supervisory authority.

To exercise any GDPR rights, contact: [email protected]. We will respond within 30 days (extendable by 2 months for complex requests, with notice).

12. International Users

Coinslator is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other jurisdictions where our vendors operate. Data protection laws in these jurisdictions may differ from those in your country. By using the Service, you consent to such transfer and processing.

13. Children's Privacy

The Service is intended for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will promptly delete it. If you believe we may have collected information from a minor, please contact us at [email protected].

14. Third-Party Links and Services

The Service may contain links to or integrations with third-party websites, services, or platforms (e.g., exchange websites, CoinGecko). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you interact with.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date and version at the top of this page, and where appropriate, notify you by email or in-app notice. Continued use of the Service after the updated Policy takes effect constitutes your acceptance of the changes.

16. Contact

Legal Entity: [LEGAL ENTITY NAME]
Registered Address: [WYOMING REGISTERED ADDRESS]
Privacy Inquiries: [email protected]
Legal Inquiries: [email protected]
General Support: [email protected]