How your data is handled.

Account and access data

We process your account ID, email and proposed email changes, username, registration and verification dates, service and security settings, and the version and time of Terms acceptance. Password sign-in uses a salted password hash. Sessions, API keys, password-reset links, two-factor authentication and recovery codes involve credentials or protected verification material. Login and activity records can include your IP address, browser information, actor identity, time and outcome.

A registered account needs an email and a working sign-in method; verification can be required for particular protected actions or features. Guest access and individual features have their own limits. Optional fields are not required unless the chosen function needs them.

Service, payment and other people’s data

Projects, address books, watched addresses, labels, notes, wallet-source public material, transaction IDs, amounts, asset and network information, events and delivery history are linked to your account or project. Public blockchain information can identify people when combined with these links; we do not treat it as necessarily anonymous.

Billing records include plans, usage, invoices, charges, crypto payments and prepaid services. USD is a pricing and accounting unit, not a fiat or bank balance. We do not request payment-card or bank-account details to pay for Cryptanio.

If you invite team members or submit customer, subscriber or donor information, we receive the identifiers, contact information, roles, references, comments and metadata you provide. Optional donor email and note are available to the page owner and are not published in the public donation-page HTML. Supply only data you are entitled to use and inform the people concerned. Your published page content is visible to its visitors.

Wallet information and Monero

Wallet-source functions can process extended public keys, descriptors, public derivation information and assigned addresses. These can reveal relationships between addresses and transactions. We do not require seed phrases or private spending keys.

Monero view-only monitoring is a specific exception for a private view key: if you choose this function, you provide it with the primary address. Cryptanio stores the view key encrypted and makes it available to the service’s view-only scanning component. It can reveal incoming transactions and does not authorise spending. Do not send spending keys, seeds or unrelated secrets in notes or email.

Google and GitHub sign-in

If you choose Google, we request openid and email and use its account identifier and verified email. If you choose GitHub, we request read:user and user:email and use its account ID and primary verified email. This login implementation does not use profile names or photos, access your mailbox or Google Drive, or read GitHub repositories.

The identifier links the sign-in method to Cryptanio; a verified email can connect it to an existing account with that email. Access tokens are used during identity verification, rather than saved as your account credentials. Google and GitHub receive the sign-in request and process it under their own policies: Google and GitHub. Disconnecting a method in Account does not revoke permissions at the provider; you can revoke those in the provider’s settings.

Purposes and applicable legal bases

We use account, service and payment data to provide the functions and transactions you request and manage the service relationship. Where applicable law requires a legal basis, necessary service processing relies on performance of that relationship or steps you request before it; security and abuse prevention rely on legitimate interests in protecting users, accounts and infrastructure, where permitted; binding legal duties rely on the relevant legal obligation. These purposes do not permit unrelated uses.

We request consent separately where that is the applicable basis, for example for optional public-site language storage. Browser notification permission is a separate device control; it is not blanket consent to other processing. You can withdraw consent or disable permissions through the relevant controls. Necessary account and security processing does not depend on consent to advertising. The website and Account currently have no advertising or optional analytics trackers. Browser identifiers are used for security and abuse prevention.

Browser storage and security checks

The public website keeps privacy choices for 180 days and, only with your permission, language for up to 365 days. Account uses the HttpOnly cryptanio_session cookie for up to 30 days, a ten-minute cryptanio_oauth_state cookie, a random security identifier in cryptanio_user_mark and cryptanio:user-mark-id, and a tab identifier. The server stores only a cryptographic hash of the browser mark and may link it to multiple accounts used in that browser; Cryptanio does not derive a browser fingerprint from the mark.

Account also keeps interface preferences and unfinished-operation data in browser storage. Language, selected-project and navigation preferences in local storage persist until changed or cleared, without automatic expiry. Unfinished-operation data, including pending new API secrets or recovery codes, may remain in session storage until the associated action is completed or dismissed, or the tab session ends. Signing out ends the login session but does not erase all browser storage. You can clear site data in your browser. See the Cookie Notice for named cookies and choices.

The current service uses a local computational security check (proof of work). If a protected action instead displays Cloudflare Turnstile, Cloudflare can receive IP, TLS fingerprint, User-Agent, site key, origin and other technical signals; Cryptanio sends the check token and IP for validation, not account form contents or the browser mark. Cloudflare processes signals for site protection and independently to improve detection under its Turnstile Privacy Addendum. This conditional integration is not active for current sign-in checks.

Recipients, notifications and public sources

Service infrastructure and authorised operators process information needed to run, secure and support Cryptanio. Sign-in providers receive the requests described above. Blockchain nodes and data sources can receive the public addresses or transaction queries needed for selected functions.

When you enable a supported notification or integration, its delivery provider and the destination you configure receive the needed recipient information and content: for example email addresses and messages, Telegram chat IDs, Discord or Slack destinations, webhook event data, or browser push subscriptions and encrypted payloads. Browser push requires permission and involves your browser’s push service; notifications may show service information on a locked device. Choose destinations and device settings accordingly.

Email sent to hello@cryptanio.com includes the content, attachments, sender information and technical mail records provided by you or your mail system. We can disclose relevant data to competent authorities where a lawful binding requirement applies, or transfer relevant service records to a successor operator where legally permitted. Neither public blockchain records nor copies independently received by your chosen recipients are under our exclusive control.

Processing locations

Infrastructure, sign-in and notification providers, blockchain sources and recipients you choose can process information in other countries under their own applicable arrangements. We do not promise that all processing remains in a single country. You can ask hello@cryptanio.com about recipients and processing locations relevant to your use.

Mandatory requirements for international transfers continue to apply where applicable. This notice does not assert that every provider’s general privacy policy is a transfer safeguard or that a particular adequacy decision or standard contractual clauses apply to all processing.

Retention periods and their limits

The browser-mark observation and each browser/account link expire 365 days after last use of that respective record; deletion of an account removes its links, while the separate pseudonymous observation remains until its own expiry. One-time security challenges and proofs expire after five minutes; password-reset proofs after 30 minutes. Email confirmation links are usable for 24 hours. These validity periods do not imply erasure of every associated historical record.

Account inbox items expire after seven days and are limited to 30 items. The usual 30-day event query/replay window limits availability through those functions; it is not automatic erasure of older event records. Activity history has no scheduled automatic expiry. Core account and service records remain while the account is maintained, unless removed through available controls or account deletion.

Operational logs, correspondence and backup copies are separate records with no single service-wide expiry period. Their retention depends on system rotation, the unresolved support or security matter, restoration needs and applicable obligations. They can outlast removal from the active account store. Requests can cover these records too; we explain any applicable limitation. We do not promise instant deletion of all backups, third-party copies or public blockchain data.

Export, deletion and privacy requests

The account owner can download the available JSON export and delete the account in its security/deletion settings after an identity check. The export includes account and service information but excludes usable credentials and protected wallet-source material; it is not a copy of every infrastructure log or independently held record.

Account deletion removes owned records from the active service store and revokes access. Stopping remote observation and cleaning invalid sessions can take further reconciliation. It does not rewrite blockchains, retract delivered messages or remove records held by another workspace about you as a member, customer, subscriber or donor.

For access, correction, deletion or other requests beyond these controls, write to hello@cryptanio.com. We may need proportionate information to verify that the request concerns you. Do not send a password, API secret, seed or spending key. Depending on applicable law you may also have rights to portable data, restriction and a complaint to the competent data-protection authority.

Objection and withdrawal: you may object to processing based on legitimate interests where the law provides that right, and withdraw a voluntary consent through the relevant control or by contacting us. Withdrawal does not affect earlier lawful processing. Mandatory rights and response deadlines apply regardless of any Terms limitation.

Automatic checks and restrictions

Security checks, request limits, plan and usage rules and address checks can automatically delay or prevent an action. They use the relevant request, account, payment or address information; a failed check does not itself establish misconduct. Matching an address to a public restriction list is a source-based signal and can prevent its registration where the service’s rules require that result; it is not a determination of a person’s identity or a complete legal assessment.

If a restriction appears mistaken or you cannot complete a check, email hello@cryptanio.com with safe account or operation details to request review. Do not assume that every feature is available without the information or checks necessary for it. Any additional protections applicable to decisions with legal or similarly significant effects remain in force.

Protection and updates

We use access controls, protected authentication material and encryption for selected sensitive credentials and wallet-source material. This is not a claim that every stored field is encrypted or that any online service is absolutely secure. Protect your browser, credentials, devices and configured recipients.

We update this page when processing or applicable requirements change and communicate material changes where required. A notice update does not create retrospective consent or change historical Terms acceptance. The current revision is published at cryptanio.com/privacy/, with the corresponding Russian version. The Terms’ mandatory-law exceptions and this notice’s statutory rights remain unaffected.