Privacy policy

Who is responsible for your data

CoinBeaver operates this website and is the data controller for the personal data described here.

Reading the site without an account

You do not need an account to read anything published on CoinBeaver. Browsing the public site does not require you to give us your name, email address, or any other identifying detail.

There is no analytics, advertising, or tracking script on this site. We do not build a profile of what you read, we do not run cookie-based tracking, and there is no third-party tag collecting your behaviour on our pages. This is why you are not asked to accept a cookie banner.

One item is stored in your browser: a preference key named cb-theme, which remembers whether you chose light or dark mode. It stays on your device, is never sent to us, and holds nothing that identifies you. Clearing your browser storage removes it.

What we collect when you sign in

Signing in is optional and exists for the account area. We offer sign-in through Google only. When you use it, Google asks for your consent and then passes us a limited profile:

• Your name and email address, and your profile image if Google provides one.
• The Google account identifier that links your CoinBeaver account to the Google account you signed in with.
• Access and refresh tokens issued by Google, stored so your session can be maintained and refreshed.
• Session records — an opaque session token with its expiry, plus the IP address and browser user agent of the sign-in, which are what let us expire sessions and detect account misuse.
• Timestamps for when your account and each session were created and last updated.

Why we are allowed to hold it

Under the GDPR we rely on two legal bases, and on neither one do we process your data for advertising:

• Performance of a contract: account and session data is what makes signing in work at all. Without it there is no account area to provide.
• Legitimate interests: keeping the service secure and preventing abuse of accounts, balanced against your interest in not being over-monitored — which is why sign-in records are limited to what a session needs.

Who else can see it

We do not sell personal data, and we do not share it for cross-context behavioural advertising. A small number of providers process data on our behalf so the site can run:

• Google, as the identity provider you choose to sign in with. Google's own privacy policy governs what it collects when you authenticate.
• Cloudflare, which serves the site and processes request data such as IP addresses in the course of delivering and protecting it.
• Our managed PostgreSQL database provider, which stores the account and session records described above.
• Market data providers, including Binance, are queried by our servers for prices. These requests carry no information about you — your browser never contacts them on our behalf, and they receive nothing that identifies you.

Where your data is processed

The site is served from a global edge network, so requests are handled at the location nearest you. Account data may be processed in and transferred to countries outside your own, including the United States.

Where personal data leaves the European Economic Area or the United Kingdom, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent approved safeguard offered by the provider concerned.

How long we keep it

We keep account data for as long as your account exists. Session records expire on their own schedule and are removed once expired.

If you ask us to delete your account, we remove your account and session records. We may keep the minimum needed to meet a legal obligation or to resolve a dispute, and only for as long as that purpose lasts.

Your rights

If the GDPR applies to you, you can ask us to do any of the following, free of charge, and we will respond within one month:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — have your data deleted where we have no overriding reason to keep it.
• Restriction and objection — pause our use of your data, or object to processing we base on legitimate interests.
• Portability — receive your data in a machine-readable form, or have it sent to another provider.
• Complaint — raise the matter with your local data protection authority if you think we have got it wrong.

If you are in California

The CCPA and CPRA give California residents the right to know what personal information is collected and why, to request its deletion or correction, and not to be discriminated against for exercising those rights.

CoinBeaver does not sell personal information and does not share it for cross-context behavioural advertising, as those terms are defined by California law. Because we do not sell or share, there is no opt-out to offer — the access, deletion, and correction rights above still apply.

Cookies

The only cookies CoinBeaver sets are strictly necessary ones for signed-in sessions. They keep you signed in and protect the session; they are not used to track you between sites, and they are not set at all unless you sign in.

Blocking them will stop sign-in from working, but leaves the public site fully readable.

Children

CoinBeaver is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we handle your data, we will make that clear rather than relying on the date alone.