Privacy Policy
How CoinKirin collects, uses, shares, and protects your personal data.
This Privacy Policy describes the personal-data processing implemented by CoinKirin. Controller identity, production providers, processing regions, contracts, transfer mechanisms, and formal retention schedules require operational and legal verification before this engineering text is treated as a final compliance statement.
1. Data controller
The entity responsible for processing your personal data (the "data controller" under GDPR, or the "personal information handler" under PIPL) is:
Entity CoinKirin.com
General privacy contact privacy@coinkirin.com
Data Protection Officer (DPO) dpo@coinkirin.com
EU representative (GDPR Art. 27) We are in the process of appointing an EU representative. Until one is designated, please contact us at privacy@coinkirin.com.
PIPL representative in China Not yet designated. Chinese users may contact privacy@coinkirin.com with the subject "PIPL Request".
2. Categories of personal data we collect
We collect the minimum data necessary to operate the Service. Specifically, we process the following categories of personal data:
Account data
Email address, password (stored only as a bcrypt hash with cost factor 12 — we never see or store the plaintext), TOTP secret for two-factor authentication (AES-GCM encrypted at rest), display name, account creation timestamp.
User preferences
Language, theme, locale, notification preferences, currency preference.
Financial data (user-entered)
Price-alert rules and archived portfolio or watchlist records from retired features, where they exist. These records are never sent to brokers or exchanges and are available through account export or deletion.
Device and technical data
IP address (truncated to /24 before use in analytics), User-Agent string, device fingerprint / refresh-token device ID, screen resolution and locale (optional, client-side only).
Usage data
Pages viewed, features used, search queries, click events, Core Web Vitals (LCP, CLS, INP), and anonymized error reports.
Cookies and similar technologies
Strictly necessary cookies (session, CSRF, locale), preference cookies (theme), and — only with your explicit consent — analytics cookies. See our Cookie Policy for the full list.
We do not intentionally collect special-category data (race, religion, health, sexual orientation, political opinions, biometric or genetic data). Please do not submit such data to us.
3. How we collect your data
We obtain personal data in the following ways:
Directly from you
When you register an account, edit your profile, create a price alert or advertising campaign, submit feedback, or otherwise interact with the Service.
Automatically
Through cookies, server logs, and usage analytics when you visit the Service.
From third parties
Cloudflare provides us with approximate country information derived from your IP address for security and localization purposes. We do not purchase personal data from data brokers.
4. Purposes of processing and legal bases
Under GDPR Article 6, we only process your personal data when at least one lawful basis applies. The table below lists our purposes and the corresponding legal basis:
| Purpose | Legal basis |
|---|---|
| Providing the Service (account creation, authentication, market data, price alerts, notifications, API keys, and advertiser tools) | Performance of a contract (GDPR Art. 6(1)(b)) |
| Security, abuse prevention, and fraud detection (rate limiting, CAPTCHA, anomaly detection, audit logging) | Legitimate interests (GDPR Art. 6(1)(f)) |
| Transactional emails (email verification, password reset, security alerts, welcome messages) | Performance of a contract / legitimate interests |
| Product analytics and improvement of the Service | Legitimate interests, with opt-out via cookie settings |
| Marketing emails and promotional content (future feature) | Consent (GDPR Art. 6(1)(a)); you may withdraw consent at any time |
| Complying with legal obligations (tax records, responding to lawful requests) | Legal obligation (GDPR Art. 6(1)(c)) |
5. Data retention
We retain personal data only for as long as necessary to fulfill the purposes described above, or as required by law. Specifically:
Account deletion immediately disables and anonymizes the account and attempts to remove directly owned alert, notification, push-token, API-key, and archived portfolio data. A scheduled job physically removes the account after the configured grace period (30 days by default).
General audit logs: an approved production retention schedule and automated expiry job are required; this repository does not currently prove a one-year deletion boundary.
Security and deletion audit records may require longer retention for legal or incident-response purposes. The purpose, fields, access, and exact period must be approved and documented.
Client error reports: stored in PostgreSQL when submitted. A production retention job and verified deletion evidence are required; source code alone does not establish a 90-day TTL.
Analytics events: stored in PostgreSQL only after the applicable client consent path. A production retention job and verified deletion evidence are required.
Refresh tokens expire after at most 30 days and are revoked on logout-all, password change, or account deletion.
Backups are encrypted and rotated according to production configuration. The repository default is not proof of the deployed retention period or off-site deletion; those controls must be verified.
6. How we share your data
We do not sell your personal data. We do not share your personal data for cross-context behavioral advertising as defined under the CCPA/CPRA.
The integration list below reflects services configured by the application. Actual activation, processing region, contract, DPA, and transfer safeguards must be verified against the production account before this notice is published as a final legal record:
Legal disclosures
We may disclose personal data when required by applicable law, court order, or valid legal process — for example, in response to a subpoena or a regulatory request. Where legally permitted, we will notify affected users before disclosure.
Business transfers
If CoinKirin is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify users and provide a meaningful choice where required by law.
7. International data transfers
Application, backup, and provider regions depend on the production deployment and must be verified against the current hosting and provider control planes.
Where personal data is transferred outside the EEA, we use the transfer mechanism and supplementary safeguards required for the verified destination and provider.
Where UK personal data is transferred internationally, we apply the UK transfer mechanism required for the verified destination and provider.
Where personal information subject to PIPL is transferred outside mainland China, we provide the required notice and complete the applicable consent, contract, certification, or assessment process before the transfer.
8. Your rights
Depending on where you reside, you have the following rights regarding your personal data. We honor these rights for all users to the greatest extent practical, regardless of jurisdiction.
Right of access / right to know
You may request a copy of the personal data we hold about you. Registered users can export records directly linked to their account via /api/v1/auth/me/export ("Export my data" in profile settings). For records that cannot be safely linked automatically, contact privacy@coinkirin.com. (GDPR Art. 15 / CCPA right to know / PIPL Art. 45.)
Right to rectification
You may correct inaccurate or incomplete personal data via your profile page. For data that you cannot edit directly, contact privacy@coinkirin.com. (GDPR Art. 16.)
Right to erasure / right to delete
You may delete your account from the profile page. Deletion disables and anonymizes the account, removes directly owned service data, and schedules physical account removal after the configured grace period. Legally retained audit or commercial records and backup expiry are handled under the verified production retention policy. (GDPR Art. 17 / CCPA right to delete / PIPL Art. 47.)
Right to restrict processing
You may ask us to restrict processing of your personal data in certain situations (e.g., while you contest its accuracy). Contact privacy@coinkirin.com. (GDPR Art. 18.)
Right to data portability
The data export endpoint returns your data in a structured, commonly-used, machine-readable JSON format. (GDPR Art. 20 / PIPL Art. 45.)
Right to object
You may object to processing based on legitimate interests, including direct marketing. Every marketing email contains a one-click unsubscribe link. (GDPR Art. 21.)
Right to withdraw consent
Where processing is based on consent (e.g., analytics cookies, marketing emails), you may withdraw consent at any time via our cookie banner ("Reject all") or by unsubscribing.
Right regarding automated decision-making
We do not subject users to solely automated decisions that produce legal or similarly significant effects.
California-specific rights (CCPA/CPRA)
California residents may additionally request disclosure of the categories of personal information collected, the sources of such information, the business purpose for collecting it, and the categories of third parties with whom it is shared. We do not sell your personal information and have not done so in the preceding 12 months.
PIPL-specific rights
Users in China have rights equivalent to those above, plus the right to have a copy of your personal information transferred to another handler, and the right to lodge a complaint with the Cyberspace Administration of China (CAC).
Right to lodge a complaint
You may lodge a complaint with your local Data Protection Authority. EU users can locate their DPA at https://edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to address your concerns directly first — please email privacy@coinkirin.com.
How to exercise these rights
Where possible we have built self-service tools into the Service (export, delete, unsubscribe). For all other requests, email privacy@coinkirin.com. We will respond within 30 days (GDPR / PIPL) or 45 days (CCPA). We may ask you to verify your identity before acting on a request.
9. Children's data
CoinKirin is not intended for, and we do not knowingly direct the Service to, individuals under 18 years of age. In particular, we do not knowingly collect personal information from children under 13 (COPPA in the United States) or under 16 (GDPR Art. 8 in the EU). If we learn that we have collected personal data from a child without parental consent, we will delete it promptly and, where appropriate, notify the parent or guardian. If you believe we have collected data from a child, please contact privacy@coinkirin.com.
10. Security measures
We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:
TLS 1.2+ encryption for all data in transit.
AES-GCM encryption at rest for TOTP secrets and other high-sensitivity fields.
Passwords hashed with bcrypt at cost factor 12 — never stored or transmitted in plaintext.
HTTPS-only, HSTS preloaded, strict Content Security Policy (CSP), and modern security headers.
Rate limiting, Cloudflare Turnstile CAPTCHA on sensitive endpoints, and optional TOTP two-factor authentication for user accounts.
Comprehensive audit logging for all administrative actions.
Principle of least privilege for employee access, with access reviews and role-based permissions.
Regular dependency scanning and security patching.
While we take security seriously, no system is 100% secure. You are responsible for keeping your account credentials confidential.
11. Data breach notification
In the unlikely event of a personal data breach, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly by email and in-app notification without undue delay.
12. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in processing, technology, or law. Where advance notice or renewed consent is required, it must be completed before the new version takes effect. The date and policy version identify the current text.
Previous versions of this Policy are archived. To request a copy of a historical version, email privacy@coinkirin.com.
13. How to contact us
For any privacy-related question or to exercise your rights, please use the appropriate channel below:
General privacy inquiries privacy@coinkirin.com
Data Protection Officer dpo@coinkirin.com
California CCPA requests privacy@coinkirin.com — subject line: "CCPA Request"
China PIPL requests privacy@coinkirin.com — subject line: "PIPL Request"
Postal mail Contact us by email first; a postal address will be provided on request.