Privacy Policy

We do not run identity verification, so there is nothing to collect. We do not ask for or store government ID, biometric data, proof-of-address documents, national insurance or social security numbers, employment details or income information. We do not buy data about you from brokers and we do not track you across other websites.

• Email address and password hash, or the Google account you chose to sign in with
• Two-factor authentication secrets and hashed backup codes, if you enable them
• Balance, deposits, card loads, card transactions and payouts
• For a bank payout: the account holder name, postal address and bank details you enter, because the receiving bank requires them
• Card data as issued by the card partner; full card numbers are shown to you on request and are never stored in our own database
• Your IP address, browser and device type. Like every website, our servers and the third-party services we use see the IP address of whoever connects to them; that is how the internet works and no website can promise otherwise. We use it for security and to show you your active sessions.
• Messages you send to support

We use your data to operate your account, process deposits, cards and payouts, detect fraud and abuse, answer support requests and send service emails such as a login from a new device or a completed payout. We do not send marketing email unless you opt in, and we do not profile you for advertising.

Where a card partner or payment institution is legally required to keep transaction records, we share the minimum they need to do so.

• Clerk (authentication): stores your email and login credentials and handles sign-in
• Crypto payment processor: sees the deposit address, the coin and the amount; it does not receive your email
• Card issuing partner: receives the data needed to issue and operate a card and to process transactions
• Payout partner: receives the account holder name, address, bank details and amount for each payout

The dashboard sets a session cookie so you stay signed in, a short-lived security cookie during sign-in, and a preference cookie that remembers whether the sidebar is open. Support requests are submitted through the dashboard and do not add a third-party chat cookie. There are no advertising or cross-site tracking cookies.

All traffic is encrypted with TLS. Sensitive values such as two-factor secrets and backup codes are encrypted or hashed before storage. Full card numbers never touch our database. Access to production systems is limited to the people who operate the service, and abusive or automated traffic is rate-limited.

• Email, name and login data: for as long as your account is open, then removed on deletion
• Deposits, card transactions, payouts and the payout bank details: seven years, because our partners must keep them under financial record-keeping rules
• Support conversations and security logs: kept while the account is open and reviewed for deletion afterwards

You can ask for a copy of the data we hold about you, correct anything that is wrong, receive it in a portable format, or delete your account. Deletion removes your login, email and name straight away; the transaction records above are kept for the legal period under an internal account ID rather than your email. Terminate your cards and move any balance out before you delete, as the balance cannot be recovered afterwards.

Account deletion is in settings. For anything else, write to us and we answer within 30 days.

If we change what we collect or who we share it with, we announce it by email or in the dashboard before the change applies. Minor wording changes are published here with a new date.