Privacy Policy
Last updated: October 26, 2026
Short version: we collect as little as possible. No ads, no tracking, no selling your data. We only store what we need to log you in, send your alerts and handle your subscription — and you can download or delete it any time in Settings.
1. Who we are
Coinbell (“we”, “us”) is operated by Coinbell. We are responsible (the “data controller”) for the personal data described in this policy. Contact: support@coinbell.org.
2. What data we collect
| Data | When | Why |
|---|---|---|
| Email and password: your email address and a salted, one-way hash of your password (we never see or store the password itself) | When you sign up with email or add a password | To log you in, confirm your email and reset your password |
| Google account data: Google account ID, email, name and profile photo URL | When you continue with Google or connect it | To log you in and show your photo if you choose |
| Telegram account data: Telegram user ID, first and last name, username, chat ID | When you log in with or connect Telegram | To log you in and send you alerts |
| Profile: display name, bio, avatar emoji and colour | When you edit your profile | To show your profile to you |
| Portfolio: the coins, amounts, prices, dates, fees and notes you enter, plus a daily total value | When you use the portfolio tracker | To show your holdings and profit. It is private unless you choose to show your allocation (percentages only) on a public profile |
| Public profile: your username and the sections you switch on | Only if you turn it on in Settings | To show a profile page that anyone with the link can see |
| Invites: which account invited you, and whether you later upgraded | When you sign up through an invite link | To give both of you the promised Pro days |
| Alerts, watchlist, saved plans and preferences: coins, target prices, DCA plans, currencies, brief setting | When you use the service | To provide the features you ask for |
| Notification subscriptions: a push address from your browser's push service (Google, Apple, Mozilla or Microsoft), its encryption keys and a device label such as "Chrome on Android" | Only if you turn on notifications | To show alerts on that device. Turning notifications off or deleting your account removes them |
| Mood poll votes: bullish or bearish, linked to your account if you're logged in; otherwise to a salted one-way fingerprint of your IP address and browser, which we can't turn back into either | When you vote in the daily poll | To count one vote per person. Fingerprints are deleted after two days; only the totals are kept |
| Payment records: order ID, plan, amount, payment status, coin used, payment ID | When you buy Pro | To activate Pro, handle support and meet accounting law |
| Technical data: IP address, browser type, request logs | Every visit | Security, abuse prevention and fixing errors |
| Messages you send us | When you email us | To answer you |
We never receive your phone number from Telegram, your Google password, your card or bank details, your wallet private keys, or your exchange passwords. We never ask for them — anyone who does is not us.
3. What we don't do
- We don't use advertising or third-party analytics trackers.
- We don't sell, rent or trade your personal data.
- We don't send marketing messages. Telegram messages and emails are limited to alerts you set, the daily brief (if you are Pro and enabled it), email confirmation, password resets and important account, security and payment notices.
4. Legal bases
Where data protection laws such as the GDPR or Sri Lanka's Personal Data Protection Act No. 9 of 2022 apply, we process data because it is necessary to provide the service you requested (contract), for our legitimate interests in keeping the service secure and preventing fraud, and to comply with legal obligations such as keeping payment records.
5. Who we share data with
We share data only with service providers who help us run Coinbell, and only what they need:
- Google — if you choose “Continue with Google”, Google confirms your identity and shares the profile details listed above.
- Telegram — to deliver login confirmations, alerts and briefs to your Telegram account.
- Our email provider — to send confirmation, password-reset, alert and security emails.
- NOWPayments — our crypto payment processor. When you pay, you do so on their checkout page under their own privacy policy. We receive only the payment status and the details listed above.
- Our hosting and database providers (for example Render and MongoDB Atlas): run the website and store the database on secured servers.
- Browser push services (Google, Apple, Mozilla, Microsoft): if you turn on notifications, alert texts are sent through your browser maker's push service, encrypted so that only your device can read them.
- GoPlus Security: when you use the token checker, the contract address you enter is sent to GoPlus to analyse. No account data is sent.
- Wise: the send-money comparison asks Wise's public price comparison for quotes using only the currencies and amount you choose. Provider logos are loaded by your browser from Wise's servers.
- CoinGecko — coin logos are loaded by your browser from CoinGecko's image servers, which therefore see your IP address. No account data is shared.
- News publishers: headline images on the news pages are loaded by your browser from the publisher's own servers (for example Cointelegraph or CoinDesk), which therefore see your IP address. We send them no referrer and no account data. When you open a story you leave Coinbell and their privacy policy applies.
Market data providers (CoinGecko, Binance, Bybit, Alternative.me, exchange-rate and news services) receive no personal data from us. We may disclose data if required by law or to protect our rights and users' safety.
6. International transfers
Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep data
- Account, alerts and preferences: until you delete your account.
- Login sessions: up to 60 days; one-time login codes: 10 minutes; password-reset links: 1 hour; email confirmation links: 48 hours.
- Rate-limiting data (IP addresses): a few minutes, in memory only.
- Poll fingerprints: two days. Notification subscriptions: until you turn them off, or until your browser tells us they no longer work.
- Server logs: up to 30 days.
- Payment records: as long as accounting and tax law requires (usually up to 7 years). When you delete your account these are anonymised.
8. Your rights
Depending on where you live, you can: access your data, get a copy (Download your data), correct it (Profile and Settings), delete it (Delete account), object to or restrict processing, and complain to your data protection authority. To use any right, use your Account page or email support@coinbell.org. We reply within 30 days.
9. Security
We use HTTPS, secure httpOnly cookies, hashed session tokens, scrypt password hashing, single-use expiring reset links, cryptographically signed payment notifications, strict security headers, rate limiting and minimal data collection. No system is 100% secure, but we work to protect your data and will notify you and authorities of a serious breach as the law requires.
10. Children
Coinbell is only for people aged 18 or older. We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete the data.
11. Cookies
We only use essential cookies and browser storage. See our Cookie Policy.
12. Changes
We may update this policy. We'll change the date above and, for important changes, tell you on the website or via Telegram.
13. Contact
Coinbell · support@coinbell.org · Sri Lanka