Privacy Policy
What CryptoClue stores about you, and what it does not.
What we store
Your account row: email address, role (beta tester, member or admin), status, membership end date if any, when the account was created, when you last signed in, and a short note the operator may attach (for example who invited you). For each signed-in browser: a session identifier, a one-way hash of the network address it signed in from, and the browser’s user-agent string, kept until the session expires after 30 days or you sign out. A sign-in link, stored only as a hash, for 15 minutes. If you turn on alerts: the push subscription your browser hands us (endpoint address, encryption keys, quiet hours, minimum gap between alerts and your timezone offset), tied to your account. If you use My Watch, we also store the records described below.
My Watch records
When My Watch is available and you save a watch, we keep your question, chosen monitoring period, an unchanged copy of the market evidence shown at save time, and subsequent monitoring checks and events. These records are linked to your account and kept until you delete the watch or your account. Archiving stops monitoring but keeps the record. With the shared beta invite code, watches belong only to that signed-in browser session and are deleted when you sign out. When that session expires, its watches become inaccessible and are removed during hourly cleanup or the next sign-in. Another browser using the shared code cannot read your watches. An individual email sign-in keeps its watches across sessions. Do not put sensitive personal information in a saved question.
Your timeframe, return comparison and clue alerts
We store the clue timeframe you selected (15 minutes or 1 hour); the completed reading last displayed to you for your return comparison (its timeframe, rule version, candle close time and when it was shown); and your clue-alert records: each subscription (timeframe, the original range boundaries, start, renewal and expiry times, state), each alert event, the device endpoints an alert can be sent to, and the status of each delivery attempt (state, attempt time, the push service’s response code and, if your browser reports it, when the notification arrived). Individual accounts keep these across sign-ins. With the shared beta invite code they belong only to that signed-in browser session and are removed when that session is signed out or its expired row is cleaned up (at the next sign-in or the next scheduled clue-alert pass). We set no retention period of our own for them: turning an alert off removes the subscription and any delivery not yet attempted, while past events and delivery records stay until the account or session is deleted. Current clue alerts do not apply quiet hours or a minimum gap between alerts, even if an older stored push subscription still holds those fields.
What we do not do
We do not run third-party ad trackers or advertising pixels, we do not sell your data, and we do not build an advertising profile of you. We use Cloudflare’s built-in web analytics for aggregate traffic counts; it does not use cookies or fingerprinting and cannot identify you personally.
Cookies and sessions
A single session cookie keeps you signed in. It is not used for tracking or advertising, and it is removed when you log out or it expires.
Who can see it
[BUSINESS NAME], [BUSINESS ADDRESS], operates CryptoClue. The data lives in Cloudflare (hosting and database, which also keeps point-in-time copies of the database for its recovery window). If sign-in by email is enabled, Resend receives your email address and the sign-in link to deliver it. If you turn on alerts, your browser’s push service (run by Apple, Google or Mozilla) carries the encrypted alert. The operator may also keep exported database copies on an operator-controlled computer for recovery. Nobody else receives this data, and it is never sold.
How to delete your data
You can delete an individual My Watch record, including its saved evidence and events, from My Watch. To delete your account, email [SUPPORT EMAIL] from the address on the account and ask us to delete it. The operator runs one deletion command that removes the account row, every session, any pending sign-in link, every push subscription and every saved watch with its checks and events tied to the account, and, because the database links them to the account row, your saved timeframe, viewing record and clue-alert records, and confirms by reply. Copies inside the database host’s recovery window and any operator recovery export age out on their own schedule; nothing is restored from them for a deleted account. We keep only what the law or an active billing dispute requires.
Children
CryptoClue is not directed at children, and we do not knowingly collect data from anyone under 18.
Draft legal text, not yet reviewed by counsel. Bracketed placeholders must be filled in before this page is used to sell a membership.