1. Controller
Responsible for the processing of your data on this website and in TRACER is Elias Schulte-Einhaus, Tracer (Sole proprietorship), Annenstraße 33, 20359 Hamburg, Germany, Email: service@usetracer.app (hereinafter "we").
You can find more information about the provider in the Legal Notice.
For questions about data protection and for any requests regarding your rights, the easiest way is to write to us at this email address.
2. In brief
- No advertising, no tracking, no third-party analytics tools, no social media plugins.
- We count visits ourselves on our own server, without cookies and without storing your IP address.
- Only technically necessary cookies: for sign-in and for the selected language. That is why there is no cookie banner.
- Fonts, icons and video come from our own server, not from Google or other providers.
- Your account is located in the EU, with Supabase in Frankfurt.
- The sources that TRACER queries about a coin learn neither your IP address nor who you are.
- You can download your data at any time and delete your account yourself.
3. Visiting the website
When you open a page, your browser technically necessarily sends information to our server: your IP address, the address you requested, date and time, and details about your browser and operating system. Without it, no page can be delivered.
TRACER runs on its own virtual server in a data center in Spain, which is in the EU. TRACER and the upstream web server do not write access logs. Technical error messages from the server and the daily database backups on the same server are deleted after 14 days.
Server provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur
To protect against abuse (for example many failed login attempts), TRACER counts requests per IP address for at most one hour, in memory only.
The legal basis is our legitimate interest in a secure, functioning website (Art. 6 para. 1 lit. f GDPR).
To know how many people visit the website and where they come from, TRACER counts page views on our own server. We do not set a cookie for this and do not store anything in your browser. So that you are counted only once per day, TRACER creates a checksum (HMAC-SHA256) from your IP address and your browser's identifier using a secret key. The key is generated anew every day; the next day, it and all checksums from the previous day are deleted. This means neither your IP address can be reconstructed nor a visit on another day can be assigned to you.
Only daily totals are kept: how many visitors and page views, which pages in which language, which website visitors came from (only its name, for example x.com), and whether they used a mobile phone or a computer. The legal basis is our legitimate interest in knowing the reach of our service (Art. 6 para. 1 lit. f GDPR). You can object (section 13).
4. Cookies and storage in the browser
TRACER only sets cookies and browser entries that are necessary for the service you are using. We do not need consent for these (§ 25 para. 2 no. 2 TDDDG). They contain no advertising or tracking identifiers and are not passed on to third parties.
tracer_at(Cookie): keeps you signed in. Lasts about one hour and is renewed as long as you stay signed in.tracer_rt(Cookie): renews your sign-in. Ends after 30 days without a visit or when you sign out.tracer_reset(Cookie): allows a new password to be set after using the link in the email. Valid for 15 minutes.tracer_lang(Cookie): the language you chose, so the home page opens in that language. If it only contains the language code, it lasts one year.tracer.lang(Browser storage): the selected language. Remains until you delete it.tracer:first-coin(Browser storage): the address you pasted before registering, so TRACER can open it afterwards. Deleted when it is opened.tracer-pending-email(Browser storage, only for this tab): your email address, so the confirmation email can be sent again. Deleted after confirmation or when the tab is closed.tracer.lang-applied(Browser storage, only for this tab): records that your account language has already been applied.
The sign-in cookies cannot be read by any script on the site (HttpOnly). You can delete cookies and storage in your browser at any time; you will then be signed out and the language will be selected again.
5. Account
For your account we process your email address, your password (stored only as a bcrypt hash; nobody at TRACER can read it), when you accepted the Terms of Use and in which version, and, if you provide them, your name, your country and your settings (language, Chain, animations).
We need this data to manage your account and to perform the contract with you (Art. 6 para. 1 lit. b GDPR). Without an email address and password, no account can be created; name, country and settings are optional.
Sign-in runs via Supabase (Supabase Inc., USA) with servers in Frankfurt am Main. Supabase processes the data on our behalf.
We store the data until you delete your account. You can do this at any time in your account under "Data & Privacy"; there you can first download everything we store about your account as a file.
6. Emails
We only send you emails that relate to your account or contract: confirmation of your address, a link to set a new password, confirmation of a new email address, and confirmation when you cancel or withdraw. There is no newsletter.
The emails are sent via Resend (Resend, Inc., USA) from the Ireland region. Resend receives your email address and the content of the email for this purpose. The legal basis is Art. 6 para. 1 lit. b GDPR.
7. Research, plan and coins
When you check a coin, we store in your account which address you checked and when (your history), your plan and how many coins you have used in which month. This lets you see your history, and lets us count the coins of your plan (Art. 6 para. 1 lit. b GDPR).
We delete the results of a research after 30 days. History and counters remain until you delete your account.
For your subscription, we store when you took it out, changed, renewed or cancelled it, and the amount. If you delete your account, these transactions remain for our accounting, without any link to your account (Art. 6 para. 1 lit. c GDPR).
If you take out a subscription, the operators of TRACER receive a notification on their phone containing only the plan and price. Your name, your email address and other account details are not included. The notification is sent via the push service Pushover (Pushover, LLC, USA).
To retrieve data on a coin, TRACER queries public sources from our server, such as blockchains, trading platforms, coin directories and web search. These sources only receive the coin's address, not your IP address and no information about your account.
8. Test Coins per internet connection
The 3 Test Coins are available once per account and internet connection. So that they cannot be used repeatedly with ever-new accounts, TRACER forms a checksum (HMAC-SHA256) from your IP address (for IPv6, from the network /64) using a secret key and stores only this, not the IP address in plain text.
The checksum is deleted one year after the last test. It also remains after an account is deleted until then, because otherwise it would not fulfil its purpose. The legal basis is our legitimate interest in protecting the free test from abuse (Art. 6 para. 1 lit. f GDPR). You can object to this (section 13).
9. AI and translation
TRACER creates the report on a coin and translations with the AI system Claude from Anthropic (Anthropic, PBC, USA). To do this, we send public information about the coin and texts from the site to Anthropic. Before a translation, TRACER replaces email addresses, numbers and names with placeholders. Information about your account is not sent to Anthropic.
A finished report or translation is saved and shown to everyone who opens the same Coin or the same language. The legal basis is Art. 6 para. 1 lit. b and f GDPR.
10. Public posts on X
To show what is being said publicly about a coin, TRACER reads public posts on X and the details of the accounts that wrote them: name, username, profile information, number of followers, text and time of the post. The data comes from X, retrieved via the X API and TwitterAPI.io. TRACER also uses it to detect bots and purchased reach.
The legal basis is our legitimate interest and that of our users in information about crypto assets (Art. 6 para. 1 lit. f GDPR). We store the data together with the research. Once a day we check it against X: if a post has been deleted or made protected, or an account suspended, we remove or change it on our side as well.
If such a post concerns you, you can object to the processing; write to us at the address in section 1 for this.
11. Payment
Payment for a subscription is processed by Stripe (in the EU by Stripe Payments Europe, Limited, Dublin, Ireland; otherwise by Stripe, Inc., USA). Stripe acts as the seller in this process: Stripe accepts the payment, calculates the VAT and issues the invoice. You enter your card or bank details only with Stripe; TRACER never sees them. What Stripe itself processes is described in Stripe's privacy policy.
TRACER stores for your subscription only the customer and subscription IDs at Stripe, plan, status, amount, currency and the end of the paid period. Before payment we store, as proof, when you agreed to the two points in the checkout window (immediate start, no investment advice). We delete both together with your account. The legal basis is Art. 6 para. 1 lit. b and c GDPR.
When you cancel or withdraw via "Cancel contracts here" or "Withdraw contract", we store your details (name, email address, contract, type, reason, requested date, time of receipt) and the confirmation email as proof for as long as statutory retention and limitation periods run, including after your account is deleted. The legal basis is Art. 6 para. 1 lit. c and f GDPR.
12. Recipients and transfers to third countries
Your data is only received by the service providers we need for TRACER and who process it on our behalf (Art. 28 GDPR):
- Hosting: IONOS SE, Montabaur, server in Spain (EU)
- Sign-in and account: Supabase Inc., USA, servers in Frankfurt am Main
- Email delivery: Resend, Inc., USA, sent from Ireland
- Payment: Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., USA
- AI and translation: Anthropic, PBC, USA (without any information about your account)
Supabase, Resend, Anthropic and Stripe, Inc. are based in the USA. Where data may be transferred there, this is done on the basis of the EU-US Data Privacy Framework if the provider is certified under it; otherwise, it is done on the basis of the EU Commission's Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR). We have concluded data processing agreements under Art. 28 GDPR with IONOS, Supabase and Resend.
We do not sell data and do not pass it on for advertising.
13. Your rights
You have the right at any time to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to receive your data in a common format (Art. 20). You can take care of much of this yourself in your account: view, change and download your data and delete your account.
Objection. Where we process data on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.
14. Miscellaneous
TRACER does not make automated decisions about you and does not create a profile of you (Art. 22 GDPR). TRACER is aimed at adults; only persons who are at least 18 years years old may create an account.
If TRACER or the legal situation changes, we will adapt this privacy policy. The version published here applies; the date is shown at the top.