Privacy Policy

KEPTRA (keptra.app) is built and operated by Kodessium, an independent studio established in the European Union. Kodessium is the controller of the personal data described in this policy under the EU General Data Protection Regulation (“GDPR”).

For anything about your data, including the rights listed below, write to hello@keptra.app.

You can browse the public pages without an account. We then store nothing about you ourselves; our hosting provider keeps the standard technical logs described below.

When you create an account and use it, we collect:

• Account data - your email address and, if you sign up with email, a password that our authentication provider stores only in hashed form; or the name, username, email and profile picture your sign-in provider shares when you use Google or X. X does not share an email address, so an account created with X may have none.
• One account per person - to stop the free trial and our limits being multiplied with extra accounts, when your account is first used we record a keyed cryptographic hash of a random identifier kept in a cookie in your browser, and of your network address (for IPv6, only its network part). We never store the identifier or the address themselves, and the hashes cannot be turned back into them. A new account from a browser, or within 30 days from a network, that another account already came from is refused; write to us if that happens to you by mistake.
• What you save - favorite chains, price and metric alert rules, notification settings (channels, quiet hours, time zone and any webhook URL you enter), portfolio transactions you record, saved chart layouts, your votes in chain sentiment polls, and the API keys you create. We keep only a cryptographic hash of each API key, never the key itself.
• Notifications - the alerts we generate for you and whether each was delivered.
• Bug reports - when you use “Report a bug”: what you write, the page you were on, your browser and window size, and any screenshot you attach. Screenshots are kept in private storage that only we can open, because they can show what was on your screen.
• Product usage - while you are signed in, the pages you open and how long you spend on each chain's page. We use this to understand which features and chains are used and to improve them. It is tied to your account and not shared with anyone.
• Subscription data - if you subscribe, your plan, billing interval, status, renewal and cancellation dates, and the customer and subscription identifiers our payment provider assigns. We never receive your card or bank details.
• Messages - what you send us by email, and our replies.

Technical data. Like any website, our hosting provider processes your IP address, browser details and the pages requested, to deliver the site, keep it secure and investigate errors.

Wallet addresses you look up. Wallet Trace reads public blockchain data. For MultiversX your browser queries the public MultiversX API directly, so that service sees the request and your IP address. For chains read through Etherscan, the address you enter is sent to our server, which queries Etherscan for you. We do not store the addresses you look up in our database or keep a history of them; like any request, they can appear briefly in our hosting provider's logs.

• To provide the Service you signed up for - your account, saved items, alerts, API keys and a Pro subscription. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To send the newsletter, if you ask for it - only when you tick the box at sign-up or in your profile, and until you unsubscribe from any issue or untick it. Legal basis: your consent (Art. 6(1)(a)).
• To keep the Service secure and working - preventing abuse, enforcing rate limits, investigating errors. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).
• To improve the product - aggregate understanding of which pages and chains are used. Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f)).
• To meet legal obligations - for example keeping records needed for tax or to answer lawful requests. Legal basis: legal obligation (Art. 6(1)(c)).

• We do not sell or rent your personal data.
• We do not show advertising and do not use advertising or cross-site tracking cookies.
• We do not use advertising or cross-site analytics; the page-view measurement described above uses no cookies and does not identify you.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use a small number of service providers, each only for the purpose listed:

• Supabase - database and authentication.
• Resend - delivery of our emails: account confirmation and password reset, and the alert emails and newsletter you choose to turn on. It receives your email address and the content of each message, and for the newsletter it keeps your address on our mailing list until you unsubscribe.
• Vercel - hosting of the website and its server functions, and privacy-friendly visit and page-speed statistics (Web Analytics and Speed Insights). These use no cookies; a visit is counted with a hash that changes daily and cannot be traced back to you.
• Google and X - only if you choose to sign in with them or link them to your account. They process your data under their own privacy policies.
• Telegram - only if you connect it for alerts and briefs. It receives the messages our bot sends to your chat, and we keep your chat id and Telegram username until you disconnect.
• Google (Gemini API) - the questions you type into Ask KEPTRA are sent to Google to work out the answer, together with the KEPTRA figures the answer is built from. Under Google's terms it may keep and review them to improve its services, so do not type personal information into a question.
• PayPal - checkout, payments and renewals of the Pro and Developer subscriptions. PayPal processes your payment data as an independent controller under its own privacy policy; we receive the subscription's status and payment dates, never your card or account details.
• Etherscan and MultiversX - public blockchain lookups for Wallet Trace, as described above.
• Cloudflare Turnstile - the automated check on the sign-up, sign-in and password-reset forms that tells people from bots. It runs in your browser when you use those forms, under Cloudflare's privacy policy, and is not used to track you.
• Have I Been Pwned - when you choose a new password, your browser checks it against known data breaches. Only the first five characters of a one-way hash of the password are sent, which is shared by hundreds of other passwords; the password itself never leaves your device.

If you add a webhook URL to your notification settings, we send your alerts to that address; the service behind it is chosen and controlled by you.

Some of these providers are based in, or use infrastructure in, countries outside the European Economic Area, including the United States. Where that happens, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework, for certified providers) or by the European Commission's Standard Contractual Clauses.

• Account data, everything you saved, your notifications and your usage data are kept while your account exists, and are deleted together with the account.
• Messages you send us are kept for as long as needed to deal with your request, and no longer than two years afterwards.
• Payment records are kept by PayPal for the periods the law requires of it; our record of what was sold, to which account and when is kept for as long as tax law requires.
• Hosting logs are kept for the short periods set by our hosting provider.

We only use cookies and browser storage that the site needs to work, or that remember choices you make. None of them track you across other websites, so no consent banner is required.

• Sign-in cookies - set by our authentication provider to keep you signed in.
• Device cookie - a random identifier that lets us tell whether an account was already created from this browser (see “One account per person” above). It holds nothing about you and is not readable by any script on the page.
• Interface preferences - your light or dark theme, whether the side menu is collapsed and whether you dismissed the upgrade notice.
• Local storage in your browser - recent searches, chart layouts, whether alert sounds are muted, and whether you have seen the follow-on-X card. This stays on your device and you can clear it at any time from your browser settings.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted, including your whole account;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a portable, machine-readable format;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To exercise any of these rights, email hello@keptra.app from the address linked to your account, or tell us how to identify the account if it has none. We reply within one month. There is no charge.

Connections to the site are encrypted with HTTPS. Access to the database is restricted by row-level security, so each account can only read its own data, and API keys are stored only as hashes. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the competent authority where the law requires it.

The Service is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

We will update this policy when what we collect or how we use it changes. The date at the top shows the latest version, and we will notify account holders of material changes by email or in the app. The Terms of Service explain the rest of our relationship with you.