How TrackBTC handles personal data.

1. Organisation and DPO contact

TrackBTC is responsible for the personal data described in this policy. Contact us using the email below.

Our public data-protection officer and privacy contact is support@trackbtc.bot. Use that address for access, correction, consent withdrawal, or privacy complaints.

2. Information we collect

• Account and authentication: email address, passkey credential metadata, verification and sign-in events, sessions, and security records. TrackBTC does not receive your biometric data or a passkey private key.
• Contract and access: the accepted legal-document versions, acceptance time, account snapshot, recorded use confirmations, access permissions and changes, and reports made available to the account.
• Communications: support messages and information you provide when requesting help or a correction.
• Public-site analytics: only after you choose Accept analytics, the information described below.

Operational Reports use public Bitcoin blockchain information, accepted market-price information, and qualified organisation or service associations. This reporting material is separate from account data. TrackBTC publishes entity names rather than natural-person identities.

3. Cookies and Google Analytics 4

The public site offers an Accept analytics or Reject analytics choice. Before acceptance, TrackBTC does not load Google Analytics. We store your choice in your browser's local storage so the site can remember it. You can reopen Analytics choices from the footer.

If you accept, Google Analytics 4 may set a first-party _ga cookie and receive browser and device information, page and interaction activity, and approximate geographic information. Google states that an internet protocol address is used at collection to derive location information and is then discarded rather than logged or stored. Do not send personal or confidential information through public-page addresses or fields intended for analytics.

If you reject, the analytics script is not loaded. If you later change a granted choice to rejected, TrackBTC removes known first-party Google Analytics cookies it can reach and reloads the page without analytics. Browser controls may also block or delete local storage and cookies.

4. Why we use personal data

We use personal data to create and secure accounts; authenticate users; record contract acceptance; manage account access; deliver reports; respond to support and correction requests; prevent abuse and fraud; diagnose failures; measure the public site's use when consent is granted; maintain records; and meet legal obligations.

Where consent is the basis for analytics, you may withdraw it for future collection. Other processing may be necessary to perform the contract, provide requested services, protect legitimate business and security interests, or comply with law.

5. Service providers and overseas transfers

We disclose personal data only as reasonably needed for the purposes above. Providers include Google Cloud services for application hosting, databases, object storage, and task processing; Mailgun for account and service email delivery; and Google Analytics for consented public-site measurement.

These providers may process information outside Singapore. We use contractual and operational measures intended to provide protection comparable to Singapore's Personal Data Protection Act where required. Providers also handle information under their own applicable terms and privacy notices.

We may disclose information to advisers, authorities, or counterparties where reasonably necessary to establish, exercise, or defend legal rights; comply with law; protect users or the service; or complete a corporate reorganisation or transfer subject to appropriate safeguards. We do not sell customer personal data.

6. Retention and security

If you previously transacted with TrackBTC, we may retain the existing transaction records needed for accounting, disputes, or legal obligations.

We keep personal data only while it serves the purpose for which it was collected or a business, security, accounting, dispute, contract, or legal requirement. Authentication challenges are short-lived; signed-in sessions have a maximum lifetime of 30 days; analytics retention follows the configured Google Analytics property settings; and contract-acceptance, access, and support records may be retained longer to establish the agreement or meet legal obligations. We delete or anonymise data when it is no longer needed and retention is not required.

We use access controls, encryption in transit, authentication controls, logging, backups where appropriate, and limited staff or provider access. No security measure eliminates all risk.

7. Access, correction, withdrawal, and complaints

Subject to applicable law, you may ask for access to personal data we hold about you, information about its use or disclosure, or correction of inaccurate or incomplete data. You may withdraw consent for future consent-based processing. Withdrawal does not affect earlier lawful processing and may affect a feature that depends on that consent.

Email support@trackbtc.bot with enough detail for us to identify the request. We may verify identity and may decline or limit a request where law permits or requires. You may also raise a complaint with Singapore's Personal Data Protection Commission.

We may revise this Policy prospectively. A material revision will receive a new document version and an updated effective date. Document version: trackbtc_privacy_policy_v3.