Privacy Policy

The short version

You can browse coincap.biz without giving us anything. We run no analytics, no advertising networks and no third-party trackers — there is nothing on these pages watching you across the web. If you create an account, we store the little we need to run it, and you can delete it yourself at any time.

1. Who is responsible

The operator of coincap.biz is the data controller for the personal data described below. Contact: support@coincap.biz.

2. What we collect

If you just browse

Nothing that identifies you personally is stored by us. Our server keeps standard technical logs (IP address, requested address, time, browser identification) as part of normal hosting operation and for security — spotting abuse and break-in attempts. They are kept short-term and are not used to build a profile of you.

If you create an account with an email address

• email address and username;
• a password hash (Argon2id) — we never store the password itself and cannot read it;
• account creation date, and the IP address and browser identification recorded with each login session, used to keep sessions secure and to throttle brute-force attempts;
• whatever you add yourself: watchlist entries, portfolio holdings and buy prices.

If you sign in with Google

Google sends us your email address, your name as shown on your Google account and a Google user identifier. We store those three things. We never receive your Google password, and we have no access to anything else in your Google account. Your use of Google Sign-In is also governed by Google’s own privacy policy.

Portfolio data

Portfolio entries are typed in by you. The Site connects to no exchange and no wallet, so we do not know what you actually own — only what you chose to record.

3. Why we process it, and on what basis

• To run your account — authentication, watchlist, portfolio. Basis: performance of the service you asked for.
• To keep the service secure — session records, login throttling, server logs. Basis: our legitimate interest in protecting the Site and its users.
• To send account emails — address verification and password resets. Basis: performance of the service. We do not send newsletters or marketing email.

4. Who else sees it

We do not sell personal data, and we do not share it with advertisers. Data reaches third parties only in these ways:

• Hosting provider — the server that stores the database and logs.
• Google — only if you choose Google Sign-In, and only as part of that sign-in.
• Market data providers (CoinGecko, CoinPaprika) — we send them no user data at all. Requests for prices come from our server on a schedule, not from your browser, so those providers never see your IP address.
• Authorities — if we are legally required to disclose something.

5. How long we keep it

• Account data — until you delete the account.
• Login sessions — 30 days from the last use, then removed automatically.
• Server logs — short-term, in the ordinary course of hosting.

Deleting your account removes your email address, username, password hash, Google identifier, watchlist and portfolio entries from our database.

6. Your rights

You have the right to access your data, to correct it, to have it deleted, to receive a copy in a portable form, to object to processing based on legitimate interest, and to restrict processing. The account page lets you do the two most common ones — see and delete your data — directly. For anything else, write to support@coincap.biz and we will respond within one month. If you believe we are handling your data improperly, you also have the right to complain to the data protection authority in your country of residence.

7. Security

The Site runs over HTTPS. Passwords are hashed with Argon2id. Sessions live in the database with expiry and are bound to a cookie that is not readable by scripts. Logins are rate-limited by IP address. Administrative access requires two-factor authentication. No system is perfect, but these are the measures in place.

8. Children

The Site is not intended for people under 16, and we do not knowingly create accounts for them. If you believe a child has registered, write to us and we will remove the account.

9. International transfers

Our infrastructure is located in the European Union. If you use Google Sign-In, that sign-in involves Google’s own infrastructure and its terms.

10. Changes

If this policy changes, the date at the top of the page changes with it. Significant changes affecting account holders will also be announced on the Site.