Privacy Policy
Effective date: 11 November 2026, for the public site at cryptoinsidor.com and its waitlist. The sections about the dashboard describe it as it will run when it opens.
Controller: Crypto Insidor Team. Contact for privacy matters: [email protected]. We have not appointed a Data Protection Officer; we are not required to.
This policy explains what Crypto Insidor (the "Service") processes, why, on what legal basis under Regulation (EU) 2016/679 (GDPR), and what your rights are. It is written for the Service as it exists today. Sections marked [SUBSCRIPTION] describe processing that will begin only if and when accounts and paid plans are introduced; until then it does not take place.
1. The short version
- The Service requires sign-in with an e-mail address and a password. It has no tracking cookies and no advertising; the only cookie is the one that keeps you signed in (section 8).
- What we process about you is small: the addresses you type into a check, the Telegram chat you subscribe to alerts from, and the technical logs any web server keeps. If you ask to be told when a paid plan opens, your account's e-mail address goes on that list, and on it only.
- The public site at cryptoinsidor.com sets no cookies and asks for one thing only: an e-mail address for the waitlist, if you join it and tick the box. We use it to write to you once, when the dashboard opens.
- What we process about other people is larger: public blockchain addresses — of token deployers, holders, funders, launch cohorts — read from public ledgers and labelled by our rules. A public address can be personal data. Section 4 is about that.
- We cannot alter a blockchain. Deletion rights apply to our copies and labels, not to the ledger.
2. What we process about you, why, and on what basis
| What | Why | Legal basis | How long |
|---|---|---|---|
| Token and wallet addresses you type into a lookup, a wallet watch, or a holder scan | To run the check you asked for | Art. 6(1)(b) GDPR — performing the service you requested | A lookup is not stored against you, except that the daily plan limit counts, per account, how many fresh lookups you ran and which tokens you gave a full read that day; that count is reset at 00:00 UTC each day. A wallet watch you create is stored (chain, token, wallet, optional label) until you remove it [SUBSCRIPTION: or your account is deleted]. Analysis snapshots ("diligence") are stored per token, not per user. |
Telegram chat ID (and the username Telegram attaches to a message, which we do not store) when you send /start to the alert bot | To deliver the alerts you subscribed to and honour /stop | Art. 6(1)(b) GDPR | Until you send /stop or block the bot; then removed from the subscriber list. |
| Preferences in your browser — watchlist, recent lookups, dismissed alerts, display settings, a short-lived cache of results | So the dashboard remembers your choices | Not sent to us. Stored in your browser's localStorage only, under keys prefixed crypto-trench:; cleared by clearing site data. These are strictly necessary to provide the function you turned on, so no consent banner is required (Art. 5(3) ePrivacy Directive / Art. 173 Polish Telecommunications Law as applicable). | Until you clear it. |
| Technical logs — IP address, user agent, requested URL, timestamp, status | Security, abuse and rate-limit enforcement, debugging outages | Art. 6(1)(f) GDPR — our legitimate interest in keeping the Service up and unabused. The application itself does not write request logs; whatever logs exist are kept by the hosting / CDN provider named in section 5. | [HOSTING PROVIDER's retention, e.g. 7–30 days]. |
| E-mails you send us | To answer you; to handle a correction or a rights request | Art. 6(1)(b) or (f) GDPR; Art. 6(1)(c) where the law obliges us to keep a record of a rights request | Up to [3] years after the last exchange, or as long as a legal obligation requires. |
| Account — your e-mail address and a password, which is stored only as a one-way hash by our authentication processor (Supabase) and never reaches us in readable form | To identify your account, decide whether it has access [SUBSCRIPTION: and attach your plan to it] | Art. 6(1)(b) GDPR | For the life of the account, plus [30] days after deletion. |
| "Notify me when Pro opens" — only if you press it: your account ID, your account's e-mail address, the plan you asked about, and when | To write to you once when that paid plan opens | Art. 6(1)(a) GDPR — your consent, given by pressing the button. You may withdraw it at any time by writing to [email protected]; withdrawal does not affect anything done before it | Until we have written to you about that plan, you withdraw consent, or your account is deleted, whichever comes first. The list is not shared with anyone and not used for any other message. |
| Waitlist — only if you join it on cryptoinsidor.com: the e-mail address you type, the version of the consent wording you agreed to, and when | To write to you once when the dashboard opens to sign-ups | Art. 6(1)(a) GDPR — your consent, given by ticking the box. You may withdraw it at any time by writing to [email protected]; withdrawal does not affect anything done before it | Until we have written to you that the dashboard opened, or you withdraw consent, whichever comes first. The list is not shared with anyone and not used for any other message. |
| [SUBSCRIPTION] Payment and billing data — plan, period, amount, payment status, invoice details; card data is handled by the processor and never reaches us | To charge you, issue invoices, and handle refunds and disputes | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for tax and accounting records | Accounting records: [5] years from the end of the tax year, as Polish tax law requires. |
We do not collect names, postal addresses, phone numbers, or identity documents, and we do not build profiles of users or make automated decisions with legal or similar effects about you. We do not sell data.
3. What we send to third parties — and what they can see
The Service is built on data from providers we do not control. When you run a check, our backend queries them; the queries carry the address you typed and never your IP address or identity. Nothing on the page loads from a third party in your browser: the typefaces are served from our own server, and the price chart is drawn by the page itself. The one exception is the waitlist form on cryptoinsidor.com: when you join, your browser sends the address you typed straight to Supabase (below), which therefore sees your IP address at that moment.
The providers our backend queries with the addresses you type, on the legal basis in section 2 (they process addresses, not your identity):
- Blockchain nodes: Alchemy, Helius (Solana), and public RPC endpoints of Ethereum, Base, Arbitrum, BSC and Robinhood Chain.
- Security and market data: GoPlus Security, honeypot.is, DexScreener (API), GeckoTerminal (price candles), Blockscout instances, Robinscan.
- Website and code check: for a token's project website (a URL taken from the token's public metadata, never from you) the backend fetches that page and its GitHub repository metadata and sends the text to Google Gemini to assess it. Nothing about you is included in that prompt.
- Telegram (Telegram Messenger Inc.) — receives the alert messages we send to your chat and, necessarily, your chat ID.
- [SUBSCRIPTION] [PAYMENT PROCESSOR] — receives what is needed to charge you; we receive a customer reference and payment status.
- Supabase (Supabase Inc., data stored in Frankfurt, Germany) — our authentication processor under Art. 28 GDPR: it holds your e-mail address and password hash and issues the session that signs you in. It receives your IP address when you sign in, as any login server does. It also stores the waitlist.
- Cloudflare (Cloudflare, Inc.) — serves the public site at cryptoinsidor.com (Cloudflare Pages) and, as any web host does, sees the IP address and user agent of each visit; it is our processor under Art. 28 GDPR.
- [HOSTING PROVIDER] — runs the servers; it is our processor under Art. 28 GDPR.
Some of these are outside the EEA (for example in the United States, Singapore, or the United Arab Emirates). Where personal data is transferred, we rely on an adequacy decision where one exists (e.g. the EU–US Data Privacy Framework for certified US providers), on the European Commission's standard contractual clauses, or — for Telegram, which you choose to use — on the fact that the transfer is necessary to perform the service you asked for (Art. 49(1)(b) GDPR). You may ask us at [email protected] which mechanism applies to a given provider.
4. Public blockchain addresses — data about other people
Most of what the Service shows is not about you. It is about other addresses: the deployer of a token, its top holders, the wallets that bought first, the wallets that funded them, wallets we rank as "smart money" because they were early in tokens that later rose. A public address is a pseudonym, and under EU guidance a pseudonym that can be linked to a person is personal data. We treat every address as if it might be.
What we do with them. We read transfers, balances and transactions from public ledgers and explorers; we compute derived facts (holding share, entry block, profit and loss, funding origin, membership of a launch cohort, whether a position was sold and re-bought); and we attach rule names to them — "sniper", "operator", "infrastructure", "undetermined", "relayed", "whale", "smart", "locker", "contract". Some of these are stored: the radar archive, the winner-wallet index, the wallet-behaviour index (a wallet's typical sell multiple), and diligence snapshots.
Why, and on what basis. Art. 6(1)(f) GDPR — our legitimate interest, and that of the people using the Service, in detecting scams in newly launched tokens before buyers are harmed, which cannot be done without reading who is doing what on the chain. Our balancing test, in short: the data is already public and pseudonymous; we add nothing that identifies a person; the labels are names of numeric rules and say so; the processing is what anyone with a block explorer could do by hand, made faster; and the interest served is the protection of third parties from financial harm. We do not attempt to identify address holders and we prohibit our users from using the Service to do so (Terms, section 8).
What "deletion" can mean here. We cannot remove or alter anything on a blockchain, and we cannot make a public explorer forget an address. What we can do, on a justified request, is delete our stored derived data and labels about an address (from the indices above) and exclude it from future labelling. We will not remove a factually correct reading of public data merely because it is unwelcome; we will correct a reading that is shown to be wrong.
Your right to object. If you control an address the Service labels, you may object under Art. 21 GDPR by writing to [email protected] with the address and a signed message proving control (we will tell you what to sign; it costs no gas and authorises nothing). We will stop the processing unless we demonstrate compelling legitimate grounds — which, for an address that the on-chain record shows drained a pool or pre-positioned a launch, we generally will.
5. Processors and hosting
Hosting: [HOSTING PROVIDER, LOCATION] for the dashboard; Cloudflare Pages for the public site at cryptoinsidor.com. E-mail: [PROVIDER]. [SUBSCRIPTION] Payments: [PAYMENT PROCESSOR]. Each acts on our documented instructions under Art. 28 GDPR. No other party processes personal data on our behalf.
6. Security
Traffic is encrypted in transit (TLS). Secrets are held in environment variables and redacted from logs. The Service never asks for private keys or seed phrases; a login signature [SUBSCRIPTION] is a message signature, never a transaction. Data is stored on servers with access limited to the operator. No system is perfectly secure; if a breach affects your data and is likely to result in a high risk to you, we will tell you as Art. 34 GDPR requires.
7. Your rights
Under Arts. 15–22 GDPR you may ask us for access to your data, its rectification or erasure, restriction of processing, its portability (for data processed under Art. 6(1)(b)), and you may object to processing based on Art. 6(1)(f). Write to [email protected]. We answer within one month (extendable by two where a request is complex, and we will say so).
You may lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) — or with the authority of your country of residence.
For Telegram alerts, the simplest way to exercise erasure is to send /stop to the bot. For wallet watches, remove them in the dashboard. To leave the list for a paid plan, or the waitlist, write to [email protected]; your address is removed within one month at the latest.
8. Cookies
The Service sets one strictly necessary cookie, sb-<project>-auth-token, when you sign in: it holds your session so that the dashboard and our backend know it is you. It is removed when you sign out and cannot be refused without losing access, so it needs no consent (Art. 5(3) of the ePrivacy Directive; Art. 399 of the Polish Electronic Communications Law). The Service embeds no third-party widget. The price chart is drawn by the Service itself from candle data our backend fetches (GeckoTerminal), so it contacts no third party from your browser. Browser localStorage is used only for the preferences listed in section 2.
9. Children
The Service is not directed at persons under 18 and we do not knowingly process their data.
10. Changes
We will post changes here with a new effective date. Material changes will be announced in the Service at least [14] days in advance [SUBSCRIPTION: and e-mailed to account holders].
11. Contact
Crypto Insidor Team, [email protected].
Version 1.0, 11 November 2026.