PRIVACY POLICY — ChainCompass Pro
Last updated: 2026
1. WHAT WE COLLECT
We collect the minimum data needed to run the application:
• Access code hash (16 hex chars) — used as your anonymous user identifier; we never store your raw access code.
• Trading activity (paper trades, signals viewed, settings) — scoped to your hashed user ID.
• Optional Telegram chat ID — only if you explicitly enable Telegram alerts.
• Optional exchange API keys — encrypted at rest with AES-256 (Fernet).
• Access log (IP address + timestamp of login attempts) — kept for security auditing.
2. WHAT WE DO NOT COLLECT
• No real name, email, or government identifiers.
• No payment information (the app is access-code gated, not paid).
• No tracking pixels, advertising IDs, or third-party analytics SDKs.
• No data sold or shared with advertisers under any circumstances.
3. WHERE YOUR DATA LIVES
• Primary storage: MongoDB inside our application infrastructure.
• Daily encrypted backups: stored locally for 7 days + mirrored to Cloudflare R2 with 30-day retention.
• No data leaves our infrastructure except (a) Telegram messages you opt into and (b) backup archives sent to Cloudflare R2.
4. THIRD-PARTY SERVICES WE CONTACT (ON YOUR BEHALF)
• CoinPaprika — price data lookup (no user data sent).
• Coinbase Advanced Trade WebSocket — public market data (no user data sent).
• Binance public WebSocket — public market data (no user data sent).
• OKX public WebSocket — public market data (no user data sent).
• Cloudflare R2 — encrypted database backups.
• Cloudflare Turnstile — bot/CAPTCHA verification on the access gate (IP only, no PII).
• Telegram Bot API — only if you enable alerts.
• Emergent LLM API — for pipeline incident diagnosis (server logs only, no user data).
5. YOUR RIGHTS (GDPR / CCPA)
• Right to access: hit GET /api/auth/me to see your user ID; all your data is scoped to it.
• Right to be forgotten: hit DELETE /api/user/me to wipe every record we hold about you. We provide a button for this in Settings.
• Right to portability: contact us for an export.
• Right to object: stop using the app; your data is purgeable on request.
6. COOKIES
We use three cookies for session management:
• access_token — HttpOnly + Secure + SameSite=Lax (15-min access JWT)
• refresh_token — HttpOnly + Secure + SameSite=Lax (7-day refresh JWT)
• csrf_token — non-HttpOnly + Secure + SameSite=Lax (CSRF double-submit defense token)
These are technically required to keep you logged in and protect against CSRF attacks. We do NOT use tracking, advertising, or analytics cookies.
7. SECURITY
• All traffic uses HTTPS with HSTS (max-age=31536000, includeSubDomains, preload).
• Exchange API keys are encrypted at rest (Fernet/AES-256).
• Global API rate limiting (100 req/min/IP) + per-endpoint rate limiting on auth.
• Cloudflare Turnstile bot protection on the access gate.
• CSRF protection via double-submit cookie pattern.
• Daily encrypted backups with off-pod R2 mirror.
8. CONTACT
For privacy-related questions or to exercise your rights, contact the operator directly through the in-app feedback channel or the Telegram bot.