Skip to content
getcoinsight
← Back to home

Privacy Policy

Updated: October 28, 2026

This Policy explains what personal data the getcoinsight service processes, for what purpose, and what rights you have.

1. Who is responsible for your data

The controller responsible for your personal data is the operator of getcoinsight. For any data-protection request — including exercising your rights under section 8 — write to the contacts in section 9.

2. What data we collect

  • Account: email and password hash (we never store the password itself), or your Google/Telegram account identifier if you signed up that way.
  • Usage: technical logs, chart settings, saved screeners and alerts, and API key usage counters. For a signed-in account in a region where trade setups are withheld (mainland China, the United Kingdom), we also keep that two-letter country code (CN or GB) and nothing else about your location, so the bot, direct messages and webhooks follow the same rule.
  • Visitor analytics: only if you accept analytics in the cookie banner, we store page views (which section and when) together with your IP address, approximate location (country/city by IP), browser type and referring site. Without that consent we record the page path (plus your account id if you are signed in), a coarse device type (phone, tablet or computer) and an anonymous visitor code: a one-way hash of your IP address and browser made with a random key that is replaced and destroyed every day, so it can't be turned back into your IP or link your visits across days — we use it to count unique visitors per day and, if you create an account the same day (UTC), to find that day's page views so the campaign tags, first page and referring domain described below are copied to the account (our legitimate interest in knowing how the site is used and which links bring sign-ups). No IP, location or browser is stored. If your browser sends Do Not Track or Global Privacy Control, we record only the page path. IP, browser, location and referrer are erased from page views after 30 days, and page-view rows are deleted after 180 days. This data is visible only to the operator; signed-in page views are also used per account to spot unusual device/location patterns that may indicate account sharing. Campaign tags in the link you arrived by (utm_source and similar) are stored with the page view as well, unless your browser sends Do Not Track or Global Privacy Control. So is the domain of the site that linked to us (for example google.com — never the full address). When you create an account, the campaign tags, the first page you opened and that domain from your page views of the same day are copied to the account, so we know which link brought you.
  • Operator notifications: with analytics consent, a visit may trigger a private Telegram message to the operator containing the page path, approximate city/country, device type (e.g. “Chrome · Android”) and referring site. For signed-in visitors it carries a short internal account id — never your email or name. Separately, and regardless of your cookie choice, account events — a sign-up, a purchase or the start of a checkout — send the operator a Telegram and/or email message with the account's email address and plan; these messages remain in the operator's Telegram and mailbox.
  • Devices and sign-ins: for each signed-in device we keep its IP address, browser and last-seen time so you can review and revoke sessions in your Profile (this is needed to run your account and does not depend on analytics consent). Revoked sessions are deleted after 30 days.
  • Payments: For direct USDT payments we record the network, the transaction hash, the amount received and the invoice; this transaction data is public on the blockchain by nature. We never ask for wallet keys or seed phrases.
  • Telegram: if you connect notifications, we store your Telegram chat ID.
  • Support messages: if you write to us by email or with the Telegram bot's /support command, we receive your message, your email address or Telegram username/id and, when the chat is linked, your account id.
  • Our Telegram channel and social media: if you join, leave or are removed from our public Telegram channel, Telegram informs our bot (an administrator of the channel) of your Telegram user ID, name, @username, the time and, if you used one, the name of the invite link. We record this to see how the channel grows and, if the same Telegram account is connected to the Service, link the record to your account; the operator receives a private Telegram message about each join or leave. Legal basis: our legitimate interest in running and measuring our channel (art. 6(1)(f)); you can object at any time (section 8). For our X and YouTube accounts we also record which accounts follow us — their public ID, @username or channel name, and when they followed or unfollowed (YouTube shows only subscribers whose subscriptions are public); for Facebook, Instagram, Threads and TikTok we store only the daily follower count.
  • Referral programme: which account invited yours (if any), the rewards granted to either side and why a reward was refused; to stop people rewarding themselves we compare the networks and devices of the two accounts' sessions (our legitimate interest in preventing abuse). For partners we also keep the payout wallet address, the amounts owed and every payout with its transaction reference — as payment records, kept even after the account is deleted. An inviting user sees only how many friends joined and paid, never who they are.

3. Purposes and legal bases

We process personal data only for the purposes below, each on its own legal basis (GDPR art. 6(1) and the equivalent provisions of other applicable data-protection laws):

  • Providing the Service you signed up for — your account, sign-in and device sessions, saved screens, alerts and the notifications you configure, paid plans and payments, and answering support requests: performance of our contract with you (art. 6(1)(b)).
  • Keeping payment and accounting records: compliance with legal obligations (art. 6(1)(c)).
  • Keeping the Service secure and preventing abuse (rate limits, the breached-password check, sign-up and account-sharing checks, error logs), counting unique visitors with the daily-rotating anonymous code, showing coin logos, and service emails about your account: our legitimate interests in a secure, working service (art. 6(1)(f)). You can object to this processing at any time.
  • IP-based visit analytics, the attribution cookies, the operator's visit notifications and browser push notifications: your consent (art. 6(1)(a)). You can withdraw it at any time; this does not affect processing that took place before.

We do not take decisions about you that produce legal or similarly significant effects by automated means. Account-sharing checks only flag unusual device or location patterns for the operator to review.

4. Recipients and processors

Market data comes from CoinGecko, Binance, MEXC, Kraken, OKX, Nasdaq, FMP, the National Bank of Ukraine and DefiLlama: our server requests it and sends them no personal data about you (for the one exception, coin logos, see below). Personal data is processed by: our server hosting provider (it stores the database and its backups), Telegram (notifications, the support bot and operator notifications), Resend (email delivery), your browser's push service (only if you enable browser notifications), Google (only if you sign in with Google), ipwho.is (approximate country/city from an IP address — for analytics with your consent, for regional pricing and at signup) and Have I Been Pwned (only the first 5 characters of a SHA-1 hash of a new password, to reject known-breached passwords). Their own privacy policies apply. Whether trade setups may be shown in your country is checked against a local IP-to-country database (DB-IP) on our server, with ipwho.is only as a fallback (they are unavailable in some regions for regulatory reasons); this check stores nothing.

If you connect a messenger channel for alerts yourself, the alerts you configured go to the service you chose: WeCom, DingTalk, Feishu/Lark, PushPlus or ServerChan, which operate in China.

If you connect an exchange account to your portfolio, we use the read-only API key you gave us to read your balances from that exchange (Binance, Bybit or OKX) about once an hour. The key is stored encrypted, is never shown again, and is deleted when you disconnect the exchange or delete your account.

Coin logos are loaded by your browser directly from CoinGecko's image server (coin-images.coingecko.com) as soon as a page with coins opens, before any cookie choice. As with any image on the web, CoinGecko receives your IP address, browser details and the address of our site (not the full page URL). We send CoinGecko nothing else about you; CoinGecko's privacy policy applies to these requests.

IP Geolocation by DB-IP (CC BY 4.0)

5. International transfers

Some of these recipients process data outside your country and outside the EU/EEA — in particular in the United States (Resend, Google, Have I Been Pwned) and wherever Telegram and the other services run their infrastructure. Where a transfer goes to a country without an EU adequacy decision, it relies on the European Commission's Standard Contractual Clauses offered by the recipient or, for US companies certified under it, the EU–US Data Privacy Framework. Transfers you trigger yourself, such as connecting Telegram or signing in with Google, are also necessary to provide the service you asked for. You can ask us for information about these safeguards. Those messenger services process data in China, which has no EU adequacy decision; such a transfer happens only if you connect one, and it is necessary to deliver the alerts you asked for there.

6. Cookies

Essential first-party cookies are always set: the session cookie (sign-in), a device identifier for per-device sessions, and your language and theme preferences. Everything else is optional: only after you click “Accept analytics” in the cookie banner do we store IP-based page-view analytics and set the attribution cookies gcs_attr and gcs_ref (which campaign or referral link brought you here, kept up to 90 days). Your choice is kept in the gcs_consent cookie for 6 months; Do Not Track and Global Privacy Control are treated as a refusal. There are no third-party advertising trackers. You can change or withdraw your choice at any time with “Cookie settings” at the bottom of every page or the button below.

Independently of that choice, a referral code in a sign-up link you opened is sent with the sign-up form itself (or kept in the short-lived g_oauth_ref cookie while you sign in with Google), so the new account is linked to the person who invited you — this is part of the referral programme you chose to use (contract).

7. How long we keep data

Account data is kept for as long as your account exists. Page-view analytics: IP, browser, location and referrer are erased after 30 days and the rows deleted after 180 days; product-usage events (such as opening a paid feature) are deleted after 180 days. Revoked device sessions are deleted after 30 days; notification and alert-delivery logs and the in-app notification history after 90 days; error logs after 14 days. Internal account-activity records (such as sign-ups and plan changes) are deleted after one year, except records of plan expiry and of administrator actions on accounts, which are kept as the billing and security audit trail. Payment records are kept even after an account is deleted, as accounting and tax law requires. Database backups on our server are rotated after 14 days. Off-site copies of those backups, where we keep them for disaster recovery, stay with the backup storage provider for longer and are used only to restore the Service; if one is ever restored, data of accounts deleted in the meantime is erased again. Occasional manual exports made to investigate abuse (for example, of accounts banned for automated sign-ups) are deleted once the investigation ends. Records of free trials granted to an account are kept with the payment records, so the same trial cannot be claimed again after deleting the account. When you delete your account, its personal data is deleted and its page views are kept only in anonymised form, except the records described above.

Free-trial records keep only a one-way hash of the email address, not the address itself, and are cleared 2 years after the account is deleted. Web-server access logs (IP address, browser, requested address and referring page of every request, whatever your cookie choice) and application logs are kept for 14 days. Besides the daily backups, the five most recent database snapshots taken before software updates are kept until newer ones replace them. When an account is deleted we also remove its email address from our internal account-activity records, the Telegram bot's language setting for its chat and the email address on its unpaid invoices. Records of joins and leaves (Telegram channel, X, YouTube) are deleted after 2 years; the list of current X and YouTube followers is kept while they follow.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time as easily as you gave it: for analytics, use “Cookie settings” at the bottom of any page; for notifications, switch them off in your Profile. You can download a copy of your data yourself (Profile → Security → Export my data) and delete your account in your Profile. For anything else, contact us — we will respond within one month.

You also have the right to lodge a complaint with a data-protection supervisory authority — in particular in the EU/EEA country where you live or work or where you believe the infringement took place, or, in Ukraine, with the Ukrainian Parliament Commissioner for Human Rights. We would appreciate the chance to resolve your concern first.

9. Contacts

For privacy matters: