Privacy policy

In short

• No ads, no analytics, no tracking, and we do not sell data.
• BossCharts sets no cookies.
• Your settings, watchlists, alerts, notes and exchange API keys are stored in your browser.
• Your exchange API keys are encrypted in your browser and never sent to our server.
• An account is optional. Only with an account do we store data about you on our server.

Who is responsible

[Company legal name], a company registered in the British Virgin Islands (company number [BVI company number]), [Registered office address], is responsible for the personal data described here ("we", "us").

Contact for privacy questions: [Contact email]

Our representative in the European Union: [EU representative: name and address]

What stays in your browser

BossCharts keeps your settings, watchlists, chart layouts and drawings, alerts, notes, news bookmarks and saved market data in your browser's own storage on your device (local storage, session storage and IndexedDB). We cannot see this data.

BossCharts also creates a random identifier for this browser there, used to tell your devices apart when you sync with an account.

This storage is needed for the app to work; it is not used to track you. It stays until you delete it, for example by clearing this site's data in your browser. You can save it to a backup file and restore it; that file stays with you and never contains your API keys.

Exchange API keys and accounts

If you add an exchange account, its API key is stored in your browser, encrypted with a key that cannot leave this browser. Keys that can trade are also locked with a passphrase that only you know.

Your API keys are never sent to our server, never synced and never put in a backup file. Your browser uses them to sign requests that go straight to that exchange. Balances, orders and trades read with your key are shown in your browser and are not sent to us.

BossCharts refuses keys that can withdraw funds.

Watched wallet addresses

If you watch a wallet address, your browser asks public blockchain services about it: mempool.space for Bitcoin, PublicNode for Ethereum and Solana's public service for Solana. They receive the address and your IP address. The address is stored in your browser like an exchange account.

Services your browser contacts directly

To show what you ask for, your browser connects directly to:

• the exchanges whose public data a browser can read (Binance, Bybit, OKX, Coinbase, Kraken, and Bitget), for prices, charts, order books, trades and open interest, and data.binance.vision for Binance's history (our server reads the other exchanges BossCharts covers);
• CoinGecko, for Discover;
• the image servers of CoinGecko and of the news sites, for coin logos and story pictures;
• the blockchain services above, only if you watch an address;
• Google, when a page shows its Continue with Google button: the button is loaded from Google, which then sees your IP address even if you do not use it.

Like any website, these services see your IP address and the technical details your browser sends with each request, such as the browser type and language. BossCharts sends them nothing about you beyond what each request needs. We do not control them, and their own privacy policies apply.

What our server sees

Our server sends you the app itself and market data (candles, market lists and liquidation levels). It also fetches some public data for your browser that a browser cannot fetch directly, such as news feeds; then the news site sees our server, not you.

Cloudflare protects our website and makes it faster, so every request passes through Cloudflare first. Our server and Cloudflare receive your IP address with each request, as any website does.

Our application server's log records which address was asked for, the answer and how long it took, but not your IP address. To prevent abuse, our server counts requests per IP address over short periods (from one minute to one day). It also counts how many different visitors look at each trading pair, as totals that cannot be traced back to anyone.

If you create an account

An account is optional. If you create one, we store on our server:

• your email address and/or phone number, and your name if you give one;
• a hash of your password if you set one (never the password itself);
• if you sign in with Google or Apple, the identifier and email address they give us for your account;
• if you turn on two-step sign-in, its secret (encrypted) and your backup codes (as hashes);
• for each device you sign in on, a device identifier, a device name such as "Chrome on Windows", when you signed in and the last IP address used;
• what you sync: your watchlists, chart layouts, alerts, notes, chart setups and settings.

Synced data is stored on our server so your other devices get it. It is not end-to-end encrypted: our server can read it, for example to merge your settings between devices. Your exchange API keys are never synced.

To send sign-in codes and links we use SendGrid (email) and Twilio (text messages). They receive your email address or phone number and the language of the message. If you sign in with Google or Apple, you use their sign-in, and their privacy policies apply.

Alerts and notifications

Price and indicator alerts are checked in your browser while a BossCharts tab is open. If you allow notifications, your browser shows them. Alerts are not sent through a push service.

Why we use data, and on what legal basis

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on these legal bases:

• To provide the website and the features you ask for, such as market data, sign-in and sync: this is necessary to provide the service you use (Article 6(1)(b) GDPR), or our legitimate interest in offering BossCharts (Article 6(1)(f) GDPR).
• To keep BossCharts secure and working, such as logs and limits against abuse: our legitimate interest in a safe and reliable service (Article 6(1)(f) GDPR).
• To answer you when you write to us: Article 6(1)(b) or (f) GDPR.
• To meet legal obligations: Article 6(1)(c) GDPR.

We do not use your data for advertising or profiling, and we make no automated decisions about you.

Where data is processed

Our server is hosted in the United States. Cloudflare runs a worldwide network, so your requests may pass through servers in other countries. SendGrid and Twilio are based in the United States.

Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, we use the safeguards these providers offer for such transfers, such as the European Commission's standard contractual clauses.

How long we keep data

• Data in your browser: until you delete it.
• Our application server's logs: up to 28 days. Our web server's logs: up to 2 days.
• Counters against abuse: from one minute to one day. Visitor totals per trading pair: 8 days.
• Sign-in codes and links: they expire after 10 minutes to 24 hours.
• Signed-in devices: a sign-in ends after 60 days without use, and after 365 days at most. Its record, with the last IP address, is deleted 7 days after it ends, or 60 days after you sign out.
• Your account and synced data: until you delete your account. Copies in our database backups are deleted after 7 days.
• Emails you send us: as long as needed to answer you and to meet legal obligations.

Your rights

Depending on where you live (for example in the EU, the EEA, the UK or Switzerland), you have the right to:

• access the personal data we hold about you;
• have it corrected;
• have it deleted;
• restrict how we use it, or object to it;
• receive it in a portable format;
• withdraw any consent you gave, at any time;
• complain to a data protection supervisory authority, in particular where you live or work.

Most of your data never reaches us: you can see, export and delete it in the app. For data on our server, write to [Contact email]. We answer within one month.

Deleting your data and your account

In your browser, clear this site's data, or remove items in the app.

Your account: Profile > Delete account deletes your account, its sign-ins and everything synced to it from our server at once. Your browser keeps its own copy until you clear it, and your exchange accounts are not touched. You can also ask us at [Contact email].

Security

Connections to BossCharts use HTTPS. Exchange API keys are encrypted in your browser, and passwords are stored only as hashes. No system is perfectly secure, so please keep your device, your browser and your passphrase safe.

Children

BossCharts is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as BossCharts changes. The date at the top shows the current version. If a change matters to you, we will say so in the app before it applies.

Contact

[Company legal name], [Registered office address]

Email: [Contact email]