This Privacy Policy explains how Crypto Chemistry (“Crypto Chemistry”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit cryptochemistry.net and use our crypto-analytics platform, dashboards and related services (the “Service”). It also describes the rights you have over your personal data under the EU General Data Protection Regulation (“GDPR”) and applicable national law.

By accessing or using the Service you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Service.

1. Who we are (Data Controller)

The controller responsible for your personal data is the owner and operator of Crypto Chemistry (cryptochemistry.net), based in Slovenia, in the European Union. You can contact us about any privacy matter - and request the controller’s full registration details - at support@cryptochemistry.net.

2. Scope

This Policy applies to personal data we process through the Service. It does not apply to third-party websites, services or applications that we link to or that are embedded in the Service (for example payment providers or charting widgets), which are governed by their own privacy policies.

3. Information we collect

3.1 Information you provide to us

Account data: your name (optional), email address and, for password accounts, a password (which we store only in hashed, salted form - we never see your plaintext password).
Profile data: an optional profile image and your account preferences (such as theme).
Security data: whether two-factor authentication (2FA) is enabled, and short-lived verification, password-reset and 2FA tokens.
Payment data: your subscription plan and billing status. Card payments are processed by our payment provider (Stripe); we do not store or have access to your full card number - see Section 5.
Communications: the content of messages you send us (e.g. by email or support requests).

3.2 Information we collect automatically

Usage data: limited technical information about how the Service is used - such as the pages you view, an approximate location and the general type of device and browser. We use it to keep the Service working, to understand which features are used and to prevent abuse.
Product analytics: we operate our own first-party analytics - usage is recorded in our own database rather than sent to an external analytics company. See Section 4.1.
Security records: records of account and security events (for example logins, password changes and role changes), which include the IP address and browser identifier of the action. We keep these for security, troubleshooting and abuse prevention.
Cookies and similar technologies: see Section 4.

3.3 Information from third parties

If you sign in with Google, we receive basic profile information from that provider - typically your name, email address, profile image and a provider account identifier - in accordance with that provider’s settings and your choices. We also receive your subscription and payment status from Stripe.

4. Cookies and similar technologies

We use a limited set of cookies and local storage:

Strictly necessary: a session/authentication cookie set when you log in, which is required for the Service to function.
Preferences: your theme choice, stored in your browser’s local storage.
Analytics identifiers: our own first-party analytics stores two identifiers in your browser - cc_aid in local storage and cc_sid in session storage. See Section 4.1.
Hosting analytics: we also use Vercel Analytics and Speed Insights, provided by our hosting provider, to understand aggregate usage and page performance.
Third-party embeds: charting widgets (e.g. TradingView) may set their own cookies when displayed.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent you from logging in or using parts of the Service. Clearing your browser’s local and session storage removes the analytics identifiers described below; a new cc_aid is then generated on your next visit.

4.1 Our own (first-party) analytics

We run our own analytics instead of embedding a third-party analytics script. The events are stored in our own database and are not shared with, or sold to, any advertising or analytics company.

To tell visits apart, the two identifiers named above (cc_aid and cc_sid) are random values generated in your browser - they are not derived from anything about you. Alongside them, a record keeps only what we need to understand usage: the page or interaction, an approximate location, a general device and browser type, a timestamp and, if you are signed in, your account identifier. These records do not contain your IP address; it is used only transiently, to derive the approximate location and to rate-limit abusive traffic.

5. Payments

Subscriptions are processed by Stripe, which acts as an independent payment processor. When you subscribe, your card details are collected and processed directly by Stripe under its own privacy policy and PCI-DSS obligations. We receive only the information needed to manage your subscription (such as a customer identifier, plan, and payment status). We do not store your full payment card number.

6. How we use your information and legal bases

We process personal data for the following purposes, relying on the legal bases set out in Article 6 GDPR:

Purpose	Legal basis
Creating and managing your account, authenticating you and providing the Service	Performance of a contract
Processing subscriptions, payments and invoicing	Performance of a contract / legal obligation
Sending transactional emails (verification, password reset, 2FA, service notices)	Performance of a contract
Securing the Service, preventing fraud and abuse, and keeping audit logs	Legitimate interests
Measuring and improving performance and usage	Legitimate interests
Operating our own first-party product analytics (Section 4.1) to understand which pages and features are used, and to detect broken or abused flows	Legitimate interests
Optional marketing or product emails	Consent (which you can withdraw at any time)
Complying with legal and regulatory obligations	Legal obligation

7. How we share your information

We do not sell your personal data. We share it only with the following categories of recipients, acting as our processors or independent controllers, and only as needed:

Hosting and infrastructure: Vercel (application hosting) and Neon (database hosting).
Payments: Stripe.
Email delivery: Resend (transactional email).
Authentication provider: Google (only if you choose to sign in with it).
Embedded market data / charts: providers such as TradingView and Alpha Vantage (market data is not personal to you).
Legal and safety: authorities, courts or advisors where required by law, to enforce our terms, or to protect our rights and the safety of others.
Business transfers: a successor entity in connection with a merger, acquisition or sale of assets.

8. International data transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. After your account is closed we retain data only as long as necessary for legitimate business purposes (such as billing records and audit logs) or to comply with legal obligations, after which it is deleted or anonymised.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk, including hashing of passwords, restricted access to systems on a need-to-know basis, and encrypted connections. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase your data; restrict or object to certain processing; data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at support@cryptochemistry.net.

Deleting your account. You can delete your account yourself at any time from Account settings → Danger zone (we will ask you to confirm your identity first), or by writing to support@cryptochemistry.net from the email address on the account. Deleting your account signs you out on every device and cancels any active subscription for future billing. Your personal data is then removed from our systems and backups within 30 days, except where we are required to keep certain records (for example billing records) to comply with legal obligations - see Section 9.

You also have the right to lodge a complaint with a supervisory authority - in Slovenia, the Information Commissioner (Informacijski pooblaščenec), ip-rs.si, or the authority in your country of residence.

12. Children’s privacy

The Service is not directed to children. We do not knowingly collect personal data from anyone under the age of 15 - the age of digital consent under Slovenian law (GDPR Art. 8 lets each member state set this between 13 and 16, so a higher age may apply in your country). If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where required by law.

14. Contact

For any questions about this Privacy Policy or your personal data, contact us at support@cryptochemistry.net. See also our Terms of Use.