What we keep about you

Without an account

Nothing about you is stored on our side, and no cookie is set until you sign in. Two things are worth naming exactly. The portfolio page keeps the wallets you add in your own browser, so they are still there when you come back; they never leave it except to be valued, and clearing your browser clears them. And the limits that stop one person flooding the site count against a key made by hashing the IP address under a secret, never the address itself; those counters are cleared after a day.

The server also counts how many times a page was opened and how many times something was used — a portfolio lookup, a wallet read — and, so that a hundred looks by one person do not read as a hundred people, it counts distinct wallets by hashing the address with a secret made when the server starts and written down nowhere. Only the totals are kept. Nobody who takes that file can ask it whether a particular wallet was here.

With an account

Your email address

Kept, because signing in with an email needs it, and so do the confirmation and the notices we send when something about the account changes. Signing in with a wallet gives us no address at all, and we store a random placeholder that can never receive mail.

Your password

Never kept. The account holds a hash it cannot be recovered from. When you choose one, the first five characters of a hash of it are sent to Have I Been Pwned to see whether it is in a known breach; the password itself never leaves this site.

Google, if you use it

The email address Google reports, and nothing else: not your name, not your picture. The tokens Google returns are used once and discarded, never written to the database.

Your wallet addresses

The address you sign in with and any address you add to your portfolio, along with the names you give them. Signing in proves the wallet is yours with a signed message, which costs nothing and cannot move anything. We never ask for a key, a seed phrase, or a transaction.

Sessions

One row per sign-in with an expiry, and a plain device label such as “Chrome on macOS”. The IP address is dropped before the row is written, so it is never stored.

Your portfolio history

For each address you track: what it was worth each hour and its biggest positions, and a daily history of the last ninety days rebuilt from that address’s own public transactions. All of it is public chain data; the account is what ties it to you.

Rate limits

Counters that stop one person flooding the site. Their keys are an HMAC of the IP address under a secret, never the address itself.

Who else sees it

These are the only companies involved, and each is told the least it needs.

Microsoft Azure

Hosts the site and the database, and delivers our email. Servers are in the United States.

Helius

Reads the chain for us. The wallet addresses we look up are sent to them, as they would be to any Solana node.

GeckoTerminal and Jupiter

Give us token prices. They are asked about coins, never about you or your addresses.

StonkFun

Tells us what a reward coin is paying. Asked about coins only.

Google

Only if you choose to sign in with Google.

Have I Been Pwned

Receives five characters of a hash when a password is chosen, and nothing else.

How long it lasts

• A sign-up that is never confirmed is deleted within a day, and the address is free again.
• Sessions end at their expiry, or when you sign out, or when you change your password.
• Portfolio snapshots are kept hourly for two weeks, then one a day. Rebuilt history covers ninety days.
• Reward readings, which are about coins rather than people, are kept for ninety days.
• Rate-limit counters are cleared after a day.
• Logs carry warnings and errors only, with email addresses removed, and no IP addresses or tokens.

Deleting it

Your account page has a delete button. It removes the account and everything that hangs off it — sessions, sign-in methods, watched addresses and their settings — in one go, and it cannot be undone. The snapshots for an address nobody tracks any more are removed by the nightly housekeeping. If you would rather ask a person, or want a copy of what is held about you first, write to us.

Cookies

The session cookie that keeps you signed in, set when you sign in and gone when you sign out. It is marked HttpOnly and Secure, so scripts cannot read it and it never travels in the clear. Signing in with Google adds a short-lived cookie for the length of that round trip, which is how the answer from Google is matched to the request that started it. There are no others: no advertising, no analytics, nothing to consent to.

Changes

This page was last changed on 17 September 2026. If what we keep ever changes, this page changes with it and the date above moves. The security page covers what the program itself can and cannot do with your tokens.