Privacy Policy

Data controller

The controller of your personal data is TokenRadar, contactable at [email protected]. The Service is operated from Poland.

What we collect

• Account data: email, display name, password hash (bcrypt), optional Telegram chat ID, subscription plan, subscription expiry, optional 2FA secret.
• Configuration: the alert profiles you create — filter values, minimum scores, delivery channel selections, optional webhook URL.
• Activity: alerts delivered to your account and labels you apply to them (bought / skipped / scam).
• Technical: request logs, error stack traces, IP address (retained 30 days for abuse prevention and rate limiting).
• Billing: NOWPayments invoice ID, on-chain transaction hash, paid amount, currency, period dates. We never see card details — we don't accept cards.
• Cookies and analytics: a session cookie (required to keep you logged in) and, with your consent, Google Analytics 4 cookies for aggregate usage statistics.

What we never collect

• Wallet private keys, seed phrases, or signing data of any kind.
• Your wallet's portfolio balance or trade history.
• Browser fingerprints or behavioural ad-tech data.
• Content of pages outside the panel domain.

Legal bases (GDPR Art. 6)

• Contract performance — running the Service for you (Art. 6(1)(b)).
• Legal obligation — invoicing, tax records (Art. 6(1)(c)).
• Legitimate interest — abuse prevention, rate limiting, security telemetry (Art. 6(1)(f)).
• Consent — Google Analytics, optional Telegram delivery (Art. 6(1)(a)). You can withdraw consent at any time.

Cookies

We use the minimum cookies needed to operate the panel, plus optional analytics cookies you can opt into:

• Strictly necessary — tokenradar_session, XSRF-TOKEN. Required for login and CSRF protection. No consent needed.
• Analytics (optional) — Google Analytics 4 sets _ga and _ga_* cookies for visitor counting. IP addresses are anonymised. These only load after you accept on the cookie banner.

Third parties (sub-processors)

We share the minimum data needed with infrastructure providers strictly to operate the Service. None of them sell your data.

• Hosting — VPS provider in the EU (server, database, Redis).
• Helius — Solana RPC provider. Sees public on-chain queries we make; sees no user data.
• NOWPayments — crypto payment processor. Sees your email when you pay (used for invoice receipts) and the payment metadata.
• Email delivery — Resend (or equivalent SMTP). Sees recipient email, sender, and message body for delivery.
• Google Analytics 4 — Google LLC. Sees anonymised IP, page URL, referrer. Only with consent.
• Telegram — only if you connect a Telegram chat ID for alert delivery. Telegram sees the alert content.

Retention

• Account data — for the lifetime of your account, plus up to 30 days after deletion to honour outstanding invoices and abuse-prevention windows.
• Payment records — kept for the period required by tax law (6 years in Poland).
• Request logs — 30 days, then deleted.
• Aggregate usage analytics — anonymised, retained indefinitely.

Your rights (GDPR)

You have the right to: access your data, correct it, request deletion, restrict processing, object to processing, and receive your data in a portable format. To exercise any of these, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO) at uodo.gov.pl.

Self-service: you can delete your account directly from Settings → Account. Deletion is irreversible — alert history, profiles, and labels are permanently removed.

Security

Passwords are hashed with bcrypt before storage. The session cookie is HTTPS-only with the Secure and HttpOnly flags. Two-factor authentication is available in Settings → Security. Backups are encrypted at rest. We log security-relevant events for incident response.

Changes

We may update this policy. Material changes will be communicated by email and a panel banner at least seven days before they take effect. The current version always lives at tokenradar.app/legal/privacy.