Privacy policy

This policy explains how Coinmico (“Coinmico”, “we”, “us”) handles personal data when you visit coinmico.com, create an account, use our market data API, or use the Coinmico apps for Android and iOS. It applies to every page and endpoint served from coinmico.com and its subdomains, and to both apps.

It does not apply to the exchanges, block explorers, wallets and social networks we link to. Once you follow such a link, that operator's own policy governs what happens to your data.

Coinmico is the controller of the personal data described here. You can reach us about anything in this policy at [email protected]. For contractual or legal notices, write to [email protected].

We answer requests about your own data within 30 days. If we need more time because a request is complex, we will tell you why before that deadline passes.

Coinmico works without an account: browsing coins, charts, exchanges and categories requires no personal data at all. The categories below are collected only for the features you actually use.

We do not collect payment data, we do not ask for identity documents, and we never ask for a wallet private key, seed phrase or exchange API secret. Nobody at Coinmico will ever request them.

Signed out, your watchlist is kept in your browser's local storage and never reaches us. The same is true of your display currency, theme, chart interval, indicators and drawings, and the row count you last chose on a table. Clearing site data erases them, and we cannot restore them.

The Android app talks only to coinmico.com and our content network, and it collects nothing the website does not. Signed out, your watchlist, price alerts, portfolio holdings, display currency and theme live in the app's private storage on the phone and never leave it; uninstalling the app erases them. Signed in, the watchlist and alerts are stored against your account exactly as described above, and the app keeps the same coinmico_session cookie in private storage so you stay signed in.

Signed out, price alerts are checked by the app itself, on the device, by requesting public prices from our API. Signed in, our servers also check your alerts and the whale traders you follow, and send a push notification through Firebase Cloud Messaging. A notification is shown only if you granted the notification permission, and you can revoke it at any time in Android settings. Apart from the advertising ID permission used for campaign measurement (described below), the app requests no other permission: no location, contacts, camera, microphone or storage access. A profile picture is chosen with the system photo picker, which gives the app only the picture you pick. The promotional banners described below are served by Coinmico itself.

The app uses Google Analytics for Firebase to measure how it is used: which screens are opened, which coins are viewed, and when a coin is shared, an alert is created, or someone signs up or signs in. These events carry an app-instance identifier generated by Firebase, the app version, device model, OS version and an approximate country, but never your email, watchlist, holdings or alert prices. Firebase's collection of the Android advertising ID and ad personalisation signals is turned off.

To measure our own advertising campaigns, such as ads for Coinmico on X (Twitter), the app includes the AppsFlyer attribution SDK. When the app is opened, AppsFlyer receives the Android advertising ID, the Google Play install referrer, an identifier generated by AppsFlyer, the app version, device model, OS version, IP address and an approximate country, and uses them to tell us which campaign, if any, led to the install. AppsFlyer may report that install to the ad network that ran the campaign so it can count it. We send AppsFlyer no email, account, watchlist, holdings or alert data. You can reset or delete your advertising ID at any time in Android settings (Settings > Privacy > Ads).

The iOS app talks only to coinmico.com, our content network and the Apple and Google services named in this policy, and it collects nothing the website and the Android app do not. Signed out, the price alerts you set, your display currency, language and theme stay in the app's storage on your iPhone and never leave it; deleting the app erases them. Signed in, your watchlist, portfolio, alerts and follows are stored against your account exactly as described above, and the app keeps its session on the iPhone so you stay signed in.

The app asks for two permissions, both optional. Notifications let our servers deliver your price alerts and whale alerts through Firebase Cloud Messaging and Apple Push Notification service. Face ID or Touch ID is used only if you turn on the portfolio lock; the check is performed by iOS, the app learns only whether it succeeded, and no biometric data reaches us. A profile picture is chosen with the system photo picker, which gives the app only the picture you pick. The app requests no location, contacts, camera, microphone or tracking permission.

The app uses Google Analytics for Firebase in the same way as the Android app: which screens are opened, which coins are viewed, and when a coin is shared, an alert is created, or someone signs up or signs in. These events carry an app-instance identifier generated by Firebase, the app version, device model, OS version and an approximate country, but never your email, watchlist, holdings or alert prices. The app does not ask for tracking permission, so it has no access to the advertising identifier (IDFA), and it does not track you across apps or websites owned by other companies.

You can delete your account at any time in the app, under Profile → Delete account.

The website and the Coinmico apps may show promotional banners, including advertisements for third-party products such as crypto exchanges. Third-party advertisements carry an “Ad” label. Banners are chosen and served by Coinmico from our own servers; they are not served through an advertising network or SDK, and we do not share any personal data with advertisers.

• To decide which banner to show, we read an approximate country from the IP address of the request at that moment. The country is not stored or linked to you.
• We count how many times each banner is shown, clicked and closed, as daily totals per banner. These counts carry no account, device or advertising identifier.
• If you close a banner, that choice is remembered in your browser or in the app's private storage on your phone for a few days, so the banner stays hidden. It never leaves your device.

Clicking a banner opens the advertiser's website, which has its own privacy policy. The link may include a referral code that tells the advertiser the visit came from Coinmico; what the advertiser collects after that is governed by its policy, not ours.

We set one cookie, coinmico_session. It is strictly necessary: it holds your sign-in token, is HTTP-only and secure, and expires 30 days after it was issued or as soon as you sign out. A short-lived cookie is also used during Google sign-in to protect the request against cross-site forgery.

On coinmico.com itself (not on embedded widgets), we load Google Analytics to count visits and page views, and the Google Ads and X (Twitter) conversion tags to measure our own advertising campaigns. These set their own cookies (such as _ga) and receive the page address, referrer, browser details and an approximate location. You can block them with your browser's tracking protection or an extension without losing any feature of the site. Where we must fetch an asset from a content network, that request carries nothing beyond the technical data a request always carries.

• To provide the service you asked for: signing you in, storing your watchlist, portfolio, alerts and baskets, and publishing the profile you chose to publish. Legal basis: performance of a contract.
• To keep the service standing up: rate limiting, abuse detection, quota enforcement, and diagnosing faults from logs. Legal basis: legitimate interest in a secure and available service.
• To act on submissions and reports you send us, including checking that a submitted asset is real before it is listed. Legal basis: legitimate interest in data quality.
• To meet legal obligations and respond to lawful requests, where we are required to. Legal basis: legal obligation.

We do not profile you, we do not make automated decisions with a legal effect on you, and we do not use your data to train third-party models.

We do not sell personal data. Data is disclosed only to the providers that run the service on our behalf, under contract and only for that purpose:

• Application hosting and content delivery for coinmico.com, which necessarily processes request logs.
• Database, cache and server infrastructure that stores accounts, product data and market data.
• Object storage for the images and brand assets the site serves.
• Google or Apple, if — and only if — you choose to sign in with them, which tells us the account identifier and the email you approved.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), which deliver notifications to your phone. A notification carries the alert text, never your email or holdings.
• Google (Google Analytics, Firebase and Google Ads) and X, which receive the usage and campaign measurement data described under cookies and the mobile apps.
• AppsFlyer, which receives the install attribution data described under the Android app, and the ad network that ran the campaign, to which AppsFlyer reports the install.
• Advertisers whose banners we show receive no personal data from us; if you click a banner, the advertiser sees that visit as described under promotional banners.

Beyond that, we disclose data only where the law requires it, or where it is necessary to establish or defend a legal claim, or to protect the service and its users from abuse.

Our providers operate data centres in several countries, so your data may be processed outside the country you live in. Where data leaves the European Economic Area or the United Kingdom, it is transferred on the basis of the European Commission's standard contractual clauses or an adequacy decision covering the destination.

• Account, profile and product data: until you delete the account. Deleting it removes the account row and everything that references it — watchlist, portfolio, alerts, baskets, follows, sessions, notification tokens and API keys.
• Uploaded profile pictures: once you replace a picture or delete the account, nothing links to the old file any more, but the file itself stays in our object storage until you ask us to purge it at [email protected].
• Crash reports: 90 days from receipt.
• Sessions: 30 days from issue, or immediately when you sign out or end the session from the account page.
• API keys: until you revoke them; the record of a revoked key is kept only as long as its usage counters, which roll off hourly.
• Technical logs and rate-limit counters: kept briefly, the counters for minutes or hours and provider logs for the short retention those providers apply.

Market data — prices, volume, candles, on-chain swaps — is not personal data and is retained under our own retention schedule independent of this policy.

Traffic to coinmico.com is served over TLS. Passwords are stored as a scrypt digest with a per-user salt; session tokens and API keys are stored only as digests, so a copy of our database cannot be replayed as a login or as a key. Access to production systems is limited to the people who operate them.

No service can promise perfect security. If a breach affects your personal data and presents a risk to you, we will notify you and the competent authority as required by law. Security issues can be reported to [email protected].

Depending on where you live, you have some or all of the following rights over your personal data: access, correction, deletion, restriction of processing, objection to processing based on legitimate interests, portability of the data you gave us, and withdrawal of any consent you gave.

Most of these you can exercise yourself: edit your profile, watchlist, portfolio and alerts at any time, end sessions on the account page, and delete the account outright from the same page or, in the Coinmico apps, under Profile → Delete account. For anything else, write to [email protected] from the address on the account.

If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection authority. If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA, we do not use it for cross-context behavioural advertising, and exercising a right will never lead to a worse service for you.

Coinmico is not directed at children and accounts are not intended for anyone under 16. If you believe a child has created an account, tell us and we will remove it.

We update this policy when the service changes what it collects. The effective date above always reflects the current version, and material changes are published here before they take effect. Continuing to use coinmico.com or the Coinmico apps after that date means the revised policy applies to you.