Privacy policy

Swolecharts is run by an independent developer, not by any exchange or data vendor.

Accounts are optional: the market data needs no login. If you create an account we keep its username, email address, a one-way hash of its password and the settings you save. We don't ask for your name, and we don't sell personal data. This page lists what the site stores or lets a third party collect, and for how long.

• Server logs. Our web server keeps standard access logs (IP address, browser user agent, requested URL and time). They are used only for security, abuse prevention and aggregate traffic statistics, and are kept for at most 30 days, then deleted.
• Page-view counts. Our own counter keeps one daily total per page path, referring website (domain only) and visitor kind (person, search-engine crawler or other bot). It never stores an IP address, a user agent or any user id, and it sets no cookie.
• Visible-browser estimate. After five visible seconds on a public page, a small same-origin request sends only its page path, without query strings, referrer or credentials. It creates no cookie or browser storage. Private access-log processing estimates browser clients using transient network and coarse browser metadata; only aggregate sketches and coverage persist, for up to 35 days. No person-level hashes or IP/browser lists are saved. Short visits are excluded; this is not a count of identified people. Account pages send no confirmation. DNT, GPC and the fixed analytics opt-out are honoured. Cookieless measurement alone does not establish that every consent requirement is met.
• Cloudflare Web Analytics. A cookieless Cloudflare script measures visits and page load times in aggregate. It sets no cookie and does not follow you across sites (Cloudflare privacy policy).
• Advertising. Google AdSense serves the ads and uses cookies: see Advertising and cookies below.
• Your site settings. Without an account, your theme, filters, watchlist and table settings are not saved anywhere by default: they last until you reload the page. With an account they are saved on our server: see Your account.
• Storage in your browser. Only if you switch on Remember on this device (it is off by default), your starred coins, theme and spike feed filters are kept in this browser's local storage under one key, sc.device. They are never sent to us (unless you later choose to import them into an account), and switching it off deletes the key. While you are logged in, a copy of your account's theme is kept in local storage so pages open in the right colours; it is removed when you log out. The private link that manages your alerts, if you set any up, is kept in your browser's local storage. Settings that an earlier version of this site kept in your browser stay there, untouched, until you clear this site's data or import them into an account, which sends them to us and then removes them from the browser.
• MCP server. Our public MCP server (/developers/mcp) keeps only daily aggregate call counts per tool and an approximate distinct-caller count. It does not store request arguments, IP addresses, API keys or per-request logs of its own (the server access logs above still apply).
• Alerts, if you create them. Your alert rules; the Telegram chat ID if you link the Telegram bot; the push subscription your browser issues (an endpoint URL and keys) if you turn on browser push. The private manage link is stored only as a one-way hash. A log of sent alerts records when each rule fired and whether delivery worked.
• Messages you send us. If you contact us, we keep the message to reply to it.

Every market page works without an account. An account only saves your site settings so they follow you to other devices. If you create one, this is what we keep:

• Username and email address. The email is used to send the password-reset links you ask for and, if ever needed, a message about your account. No newsletter or marketing, and it is never sold or shared.
• Your password, as a salted one-way hash (PBKDF2), never the password itself. Nobody here can read or recover it.
• Account dates. When the account was created and when you last logged in.
• Saved settings. Your theme, spike-feed filters, watchlist, sound and notification choices, and market-table and live-trades settings, stored on our server with your account (at most 16 KB). Each save replaces the last one; no history is kept.
• Login sessions. A server-side record that links your browser's session cookie to your account while you are logged in. It holds no password.
• Rate-limit counters. To slow down password guessing and sign-up abuse, attempts to sign up, log in, reset a password or save settings are counted. Each counter is keyed by a one-way digest of your network address, the account name or email involved, or (for saving settings) your user id, which changes with every time window (1 minute to 1 hour), so no IP address or email is stored in it, and it is deleted when its window ends.

A Swolecharts account has nothing to do with exchange accounts: opening an exchange account through one of our referral links creates nothing here, and an account here tells no exchange anything.

The sign-up, log-in, password and account pages load no ads, no analytics script and no other third-party script.

These are set only when you open a page with a form or log in. They are not used for ads or analytics, and the market pages work without them.

• sessionid: keeps you logged in. Page scripts can't read it, it is only sent over HTTPS, and it ends when you log out or 14 days after you log in (activity doesn't extend it).
• csrftoken: a random value that stops other sites from submitting forms here as you. Set by pages with a form (sign-up, log-in, account, API keys); it lasts up to a year and holds no personal data.
• sc_in: the value 1, so cached pages can show “Account” instead of “Log in”. It identifies no one, is removed when you log out and otherwise expires with the login.

This site shows ads from Google AdSense, which keeps it free. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

You can opt out of personalised advertising in Google Ads Settings, and opt out of some other vendors' cookies at aboutads.info. Read how Google uses information from sites or apps that use its services.

Apart from the ad cookies, the site sets no tracking cookie. The account cookies are essential ones, listed under Essential cookies. Your browser can block or delete cookies at any time, and the data pages keep working without them.

• Google (AdSense): ads and ad cookies.
• Cloudflare: DNS, the network every request to the site passes through (it sees your IP address and the request, and passes the address on to our server for its logs and rate limits), and cookieless Web Analytics.
• Hetzner Online: the server in Germany that hosts the site, its logs and its database.
• Our email provider: sends the password-reset messages you ask for.
• Telegram and your browser's push service: they deliver alert messages, only if you set up alerts on that channel.

• Your account, email, password hash and saved settings: until you delete the account.
• Login sessions: until you log out, or 14 days after you log in. A password change or reset ends every other session. Session records that have stopped working are deleted by a daily clean-up once they expire.
• Password-reset links: they work once, for 1 hour.
• Administrator changes: if an administrator changes an account (for example deactivates it), the admin audit log keeps the account name, what changed and when, also after the account is deleted.
• Rate-limit counters: deleted when their window ends (at most 1 hour), with a daily clean-up as a backstop.
• Database backups: the nightly backups on our server also contain account data, and they are replaced on a rolling schedule, so a deleted account leaves them as older backups are removed.
• Page-view counts: 400 days, then deleted automatically.
• Log of sent alerts: 30 days, then deleted automatically.
• Alert rules, Telegram chat ID and push subscription: until you delete them, or until Telegram or your browser reports that channel gone, which removes it.
• Server access logs: at most 30 days, then deleted.
• Browser storage: until you clear it.

Delete your account at any time on your account page, with your password: the account and its saved settings are deleted at once and every device is logged out. Alerts made on /alerts are separate and are deleted there. An administrator can also deactivate an account (for abuse, or on request): it can no longer log in and its sessions stop working, but its data is kept until the account is deleted. Send /stop to the Telegram bot to unlink your chat; its chat ID is removed at once. Delete single rules, or your whole alert subscription, on the alerts page with your manage link. Clearing this site's data in your browser removes everything kept there.

For anything else, including a copy or deletion of what we hold about you: Message @CryptoZyzz on X, or see the contact page.

When what the site collects changes, this page changes with it and the date at the top is updated.