This policy describes what data atollcoins collects, how we use it, and who we share it with. We aim to collect the minimum necessary to operate a quantitative trading platform.
1. What we collect
- Account data. Email address (for transactional emails + account recovery) and a hashed password. Optional: a Telegram chat ID if you link the alert relay.
- Payment data. We do not collect credit card or bank-account information; subscriptions are paid in cryptocurrency. We record the on-chain transaction hash, sender address, amount, and the invoice it satisfied so we can confirm payment and reconcile.
- Usage data. Pages visited, features used, alerts delivered, and aggregate performance metrics so we can improve the Service and detect abuse.
- Configuration. The tokens you track, the strategies you enable, your alert preferences, and watchlist entries.
2. How we use it
- To deliver the Service — generate signals, route alerts, and gate plan-tier access.
- To send transactional emails — welcome on signup, payment receipts on activation, and important account notices.
- To diagnose bugs, monitor uptime, and detect abuse (rate-limit breaches, scraping, account takeover attempts).
- To comply with applicable legal obligations.
We do not sell your data, profile you for advertising, or share it with marketers.
3. Third-party processors
We use a small set of vendors to operate the Service. They receive only the data necessary to perform their function and are bound by their own privacy commitments.
- Cloudflare — DNS, CDN, and DDoS protection. Sees request metadata (IP, user-agent) for the marketing site and the app.
- Resend — transactional email delivery (welcome, receipts). Sees your email address and the message content.
- Telegram — optional alert relay. If you link your Telegram account, your chat ID is stored and alerts are pushed through Telegram's API.
- Bybit — derivatives exchange. atollcoins uses Bybit for live trading execution; customer accounts are not forwarded — only the platform's own trading account interacts with Bybit.
- An upstream market-data provider — supplies on-chain and market data feeds that the strategies consume. No personally identifiable customer data is shared with this provider.
- Microsoft Azure — VM hosting for the API + webhook infrastructure (Singapore region).
4. Cookies & local storage
We use a session cookie to keep you logged in and a small set of
localStorage entries to remember UI preferences (theme,
display options). We do not use third-party tracking cookies. No
cross-site advertising trackers.
5. Data retention
Account and payment records are retained for as long as your account exists and for a reasonable period afterward (typically 24 months) for legal, accounting, and abuse-prevention purposes. Usage logs are retained for shorter windows (typically 90 days for raw logs).
6. Your rights
You can:
- Access the personal data we hold about you, via the in-app feedback system or the contact page.
- Correct inaccurate data — most of it is editable inside the app.
- Delete your account — this removes your profile, configuration, and tracked-token list. Some payment and audit records may be retained for the period noted above.
- Export your data — request a copy via the in-app feedback system.
7. International transfers
The Service is hosted in Singapore. Some processors (Cloudflare, Resend, Telegram) operate globally. By using the Service, you consent to your data being processed in jurisdictions other than your own.
8. Security
Passwords are stored hashed (bcrypt). Connections use TLS. We do reasonable things to protect data, but no internet service is ever perfectly secure. Notify us immediately if you suspect your account has been compromised.
9. Children
atollcoins is not intended for users under the age of 18. We do not knowingly collect data from anyone under 18.
10. Changes
We may update this policy from time to time. Material changes will be surfaced on this page with a new "Last updated" date.
11. Contact
Questions about this policy: use the in-app feedback system at
/account/feedback, or the Contact page
once a public channel is live.