Privacy Policy
1. Who we are
Coin Strike is software for trading SOL, BTC, ETH and XRP on the user's own Kraken Spot account, offered by invitation at coinstrike.trade. For any privacy question or request, write to [email protected].
2. What we collect
- Invitation requests: name, email, phone or WhatsApp number, the allocation range you select, a truncated hash of your IP address and the request date.
- Operator accounts: username, display name, email, a password hash (scrypt, never the password itself), language, time zone and theme preferences, and the time of your last sign-in.
- API keys you connect (Kraken, Anthropic): stored encrypted with AES-256-GCM and never shown back in plain text.
- Push notifications, only if you enable them: the subscription address and keys your browser provides, your alert preferences and a short description of the device (browser user agent).
- Trading data for your account: orders, positions, results and the engines' decision log, in paper or live mode.
- Technical data: IP addresses are processed in memory to rate-limit requests and block abuse; they are not stored except as the truncated hash mentioned above.
3. Cookies and local storage
When you sign in we set one strictly necessary cookie (strike_s): a signed, HttpOnly session token. The terminal also keeps interface preferences (layout, language, theme) in your browser's local storage. We do not use advertising or analytics cookies.
4. Where the data lives
Data is stored in a PostgreSQL database on our own server, with local backups on the same machine that rotate after about seven days. Fonts, scripts and the charting library are served from our own server.
5. Third parties and when they are involved
| Service | What it receives | When |
|---|---|---|
| Cloudflare, Inc. | Website traffic (encryption in transit and attack protection) | Every visit |
| Kraken (Payward, Inc.) | Orders and account queries signed with your API key; public market data requests from our server | Only if you connect Kraken keys and enable live mode |
| Anthropic, PBC | Market context, news headlines and the engines' positions — no names, emails or contact details | Only while the AI committee is enabled |
| Your browser's push service (Apple, Google, Mozilla or Microsoft) | Encrypted notification content | Only if you enable push notifications |
Our server also reads public news feeds (CoinDesk, Cointelegraph, Decrypt) and the Fear & Greed index from alternative.me; none of your data is sent to them. We do not sell, rent or share personal data for advertising.
6. How long we keep it
- Invitation requests: until access is granted or you ask us to delete them.
- Accounts, keys and trading data: while the account is active, and deleted on request when it is closed.
- Backups: replaced on a rolling basis of about seven days.
7. Your rights
You can ask to access, correct, export or delete your data, or to stop receiving notifications, by writing to [email protected]. You can turn push notifications off at any time from the terminal or your device settings.
8. Security
API keys are encrypted at rest, passwords are stored only as hashes, access is by invitation and sessions use signed HttpOnly cookies. No system is perfectly secure; if we learn of an incident that affects your data we will tell you.
9. Changes
We will update this page when our practices change and show the new effective date at the top.