Privacy Policy

Information we collect

Account information: your email address, an account identifier, how you signed up (email and password, or Google), your plan, trial and subscription status, and your settings (for example notification and email preferences).

Information from Google Sign-In: if you choose “Continue with Google”, Google shares your name, email address, profile picture and a Google account identifier with us, using only the basic “openid”, “email” and “profile” permissions. We do not receive your Google password and we do not access your Gmail, contacts, Drive, calendar or any other Google data.

Payment information: payments are processed by Stripe. We receive your subscription status, plan, invoice and payment status and the last four digits and brand of your card for display; full card numbers are held by Stripe and never by us.

Content you add: a profile picture you upload, research you save, price alerts, holdings and trades you record, notes and journal entries, questions you ask Buddy, feedback (including an optional star rating and whether you allow us to quote it anonymously) and support messages.

Usage and device information: pages and features you use, actions such as generating a report or swiping a card, browser and device type, your timezone, the link or campaign that brought you to us, and error reports. We use your IP address only in one-way hashed form to count daily visits and to limit repeat free trials from the same network; our hosting and sign-in providers also see it in their standard security logs. We do not use advertising trackers or sell this information.

How we use your information

To create and secure your account and sign you in (including with Google); to provide the features you ask for, such as analyses, saved research, alerts and portfolio tools; to process your subscription and payments; to send the emails listed below; to respond to support requests; to prevent abuse such as repeat free trials; and to measure and improve the product.

Our legal bases under UK GDPR are: performance of our contract with you (account, features, billing), legitimate interests (security, abuse prevention, product measurement and improvement), legal obligation (tax and accounting records) and consent where required (for example marketing emails you can unsubscribe from at any time, and optional quotes of your feedback).

Emails we send

Account and service emails (performance of our contract with you; they stop when your account is closed): sign-up confirmation and password-reset links; one reminder to confirm your email address if you have not; trial started, trial ending, subscription confirmed, payment failed and cancellation confirmed; Buddy Credits nearly used or used up; a referral reward; the price alerts you set, when they are reached; and an acknowledgement when you contact support.

Marketing emails (sent to customers under the soft opt-in, or with your consent; every one has a one-click unsubscribe that turns off only that email, and the regular ones can also be switched off in Settings → Notifications): the getting-started emails (a welcome, then at most two reminders about the free trial until you start one); up to three trial tips; the Monday weekly briefing (a shorter version once your plan has ended or a payment has failed); the Friday recap of your saved coins and holdings; the morning top-rated alert and the evening top-rated email, only if you switch them on (the sign-up box turns on the morning alert and the weekly briefing); one reminder if you open the trial checkout and do not finish it; one email 14 days after a paid plan ends; and one invitation to leave a review of CryptoBuddy 14 days into your first paid period.

The weekly newsletter on our public blog is sent only with your consent: you confirm your subscription from a confirmation email, and every issue has an unsubscribe link.

Internal emails: a support request you send is forwarded to our support inbox, and a daily summary of product activity is sent to CryptoBuddy’s own staff addresses only.

How we use Google user data

Data we receive through Google Sign-In (your name, email address, profile picture and Google account identifier) is used only to create your CryptoBuddy account, sign you in and show your name and picture inside the product. We do not sell it, use it for advertising, use it to train AI models, or share it with anyone except the service providers listed below that run our sign-in and hosting, and only so they can provide that service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect CryptoBuddy from your Google account at any time at myaccount.google.com/permissions, and you can ask us to delete your account and its data as described below.

Who we share information with

We use trusted service providers who process data on our behalf: Supabase (database, sign-in and stored profile pictures), Vercel (hosting), Stripe (payments and payment fraud checks), Resend (email delivery), Anthropic (AI explanations; OpenAI may be used as a backup provider), PostHog in the EU (product analytics, sent from our servers only: your account identifier and the product actions you take, never your email or name; no PostHog script or cookie runs in your browser, and IP geolocation and person profiles are switched off) and Sentry in the EU (error monitoring: error messages and technical details of the failure).

Market data is fetched from crypto data providers (for example CoinGecko, CoinGlass, DexScreener and exchange APIs); your personal information is not sent to them.

When you ask for an AI analysis or ask Buddy a question, the relevant content (for example the coins involved, your question, and holdings, prices or recorded trade levels you chose to include) is sent to the AI provider to produce the answer. Please do not include passwords, private keys, seed phrases or card details in questions; we never need them.

We do not sell your personal information. We may disclose information if required by law or to protect our users and service.

How long we keep it

We keep your account information and content while your account is open. When you ask us to delete your account, we delete or anonymise your personal information within 30 days, except records we must keep by law (for example invoices and payment records, kept for up to 6 years for UK tax purposes). Detailed technical usage logs are kept for up to 30 days. Encrypted backups are overwritten on a rolling basis.

Your choices and rights

You can update your settings, switch off marketing emails (every email has an unsubscribe link) and delete saved items in the product. Under UK GDPR you have the right to access, correct, delete, restrict or object to the use of your personal information, to data portability, and to withdraw consent at any time. To make a request, email support@cryptobuddy.so from your account email; we respond within one month.

If you are unhappy with how we handle your information you can complain to the UK Information Commissioner’s Office (ico.org.uk); users in the EEA can contact their local data protection authority.

Cookies

We use only strictly necessary cookies (to keep you signed in, to know your timezone and to carry your sign-up email choice through Google sign-up) and keep display and feature preferences in your browser’s own storage. We do not use analytics or advertising cookies. See our Cookie Policy for the full list.

Security and international transfers

We protect your information with access controls, encryption in transit, and by keeping secrets on our servers only. Some of our providers process data outside the UK; where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses. No online service can be completely secure, so please use a strong, unique password.

Children

CryptoBuddy is for adults aged 18 and over. We do not knowingly collect information from children.

Changes to this policy

If we make material changes we will update the date above and, where appropriate, tell you by email or in the product.