The short version
We use what the site needs to work, and we remember the settings you choose. Analytics that store anything on your device only start if you press Accept all. We do not use advertising cookies on the website, and we do not let advertisers place any.
You can change your answer whenever you like: .
What we mean by cookies
A cookie is a small file a website saves in your browser. Websites can also save things in the browser's local storage (kept until it is cleared) and session storage (cleared when you close the tab). The law treats all of these the same way, and so does this policy: where we say cookies, we mean all three.
The rules are the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR. Under PECR we may store something on your device without asking only if it is strictly necessary for a service you asked for. Everything else needs your consent first.
Your choice
The first time you visit, a banner asks whether we can see how people use the site. The two answers are the same size and carry the same weight:
- Accept all turns on the analytics in Analytics, only if you accept, including session recordings with everything you type hidden.
- Refuse non-essential means nothing is stored for analytics. We still count visits, without cookies (see Measuring without cookies).
Until you answer, the site behaves as if you had refused. Refusing does not stop any part of the site working.
To change your answer, use at the foot of any page. The banner comes back and you can choose again. If you refuse after accepting, we remove our own analytics entries, and PostHog stops recording and removes its cookies and its id for you. Until you close the tab, PostHog may keep a note of the page that sent you in session storage; it holds no id.
Signed in, you can also switch off product analytics for your account in Settings, under Privacy and data. That stops our own counts on the website and in the app, and deletes what we hold.
Essential
These make the site work: signing in, keeping you signed in, and remembering the choices you made about cookies. They are strictly necessary, so they do not need consent, and the site cannot work properly without them.
| Name | What it is for | Set by | How long |
|---|---|---|---|
| dx_signed_in (cookie) | Tells our server that this browser is signed in, so account pages open straight away and signed-out visitors are sent to sign in. It holds the value 1 and nothing else: no token, no account id. | Decryptr | 30 days, renewed on each visit; removed when you sign out |
| sb-hnhlsvudvygmxlydxpgn-auth-token (local storage) | Your sign-in session, so you stay signed in between visits. | Decryptr, through Supabase | Until you sign out |
| decryptr.consent (local storage) | Remembers your answer to the cookie banner, so we do not ask on every page. | Decryptr | Until you clear it or change your choice |
| __ph_opt_in_out_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw (local storage) | Records your answer for PostHog, so that a refusal is respected on every page. | PostHog, for us | Until you clear it |
| decryptr.appleTokenSent (local storage) | After you sign in with Apple, records that Apple's token has been passed to our server, so that deleting your account can also revoke Decryptr's access at Apple. | Decryptr | Until you clear it |
| decryptr.invite.pending (local storage) | The invite code from a friend's invite link you opened, so it can be offered when you sign up. | Decryptr | 30 days at most; removed once used or turned down |
| decryptr.passes.pinged (local storage) | The date of the last daily check-in for the invite scheme, so it is sent once a day at most. | Decryptr | Until you clear it |
| token_risk_coins (session storage) | A short-lived copy of the coin list used by the token safety check, so it is not fetched on every page. | Decryptr | Until you close the tab |
When you sign up, sign in or reset a password, Cloudflare Turnstile checks that you are a person and not a bot. It runs in a frame from Cloudflare, only on those forms, and is a security measure we rely on to protect accounts.
Your settings and drafts
These remember things you chose or wrote, so they are there next time. They are only ever set because you did something, they stay in your browser, and they are not used to measure you. Names ending in <account> are kept separately for each account that signs in on the browser.
| Name | What it is for | Set by | How long |
|---|---|---|---|
| decryptr.theme | Light or dark, if you picked one. | Decryptr | Until you clear it |
| decryptr.sidebar.collapsed, decryptr.sidebar.closedGroups | Whether the side bar and its groups are open or closed. | Decryptr | Until you clear it |
| decryptr.messages.info | Whether the details panel in Messages is open. | Decryptr | Until you clear it |
| dx.chart.indicators.v1.* | The indicators you added to charts. | Decryptr | Until you clear it |
| dx.drawing.v1.<coin> | The lines and notes you drew on a coin's chart. | Decryptr | Until you delete them or clear it |
| decryptr.viewCoinFilters, decryptr.notifCoinFilters.<account> | The coins you filtered news and notifications to. | Decryptr | Until you clear it |
| decryptr.palette.recent | Your recent searches in the command menu. | Decryptr | Until you clear it |
| decryptr.postDrafts.<account>, decryptr.postDraftsSync.<account> | Posts you saved as drafts on this browser, kept per account and shown only while that account is signed in. | Decryptr | Until you post or delete them |
| chatDraft:<account>:<conversation> | A message you started typing and have not sent, kept per account. | Decryptr | Until you send or clear it |
| decryptr.ask.<account>, decryptr.ask.history.<account> | Your Ask Decryptr conversation and its history, so it is there when you come back. | Decryptr | Until you clear the chat or the browser's data |
| decryptr.inboxTriage.<account> | How you sorted your notifications. | Decryptr | Until you clear it |
| dx.robot.eye | The colour you picked for the robot's eyes. | Decryptr | Until you clear it |
Things you have already seen
These stop the site showing you the same tip, animation or message again. They hold little more than "seen", they are not sent to us, and they are not used to measure you. Show tips again in Settings clears the tips.
| Name | What it is for | Set by | How long |
|---|---|---|---|
| dx.coach.v2.<account>.<page> | The robot's first-visit tips: which pages' tips you have finished or skipped, per account. | Decryptr | Until you clear it, or tap Show tips again in Settings |
| levelsHowDismissed, levelsRevealed, leaguePromotionSeen, dx.streakMilestone | Levels: that you closed the how-to, which results you have already seen revealed, and which promotion and streak messages you have seen. | Decryptr | Until you clear it, or tap Show tips again in Settings |
| calls_seen_right_v1 | Which of your calls you have already seen marked right. | Decryptr | Until you clear it |
| chat_voice_played | Which voice messages you have played. | Decryptr | Until you clear it (the last 600) |
| dx.confetti.last | When the last celebration played, so it is not repeated too often. | Decryptr | Until you clear it |
| decryptr.passes.stamped (session storage) | That you have seen the invite passes animate. | Decryptr | Until you close the tab |
| decryptr.stayonweb, decryptr.nudged (session storage) | That you chose to stay on the website rather than open the app, or closed the sign-up prompt. | Decryptr | Until you close the tab |
| dx.setup.toured, dx.robot.seen.*, dx.scene.seen.*, dx.chart.drawn.*, lvRecapHidden (session storage) | Tours, animations and recaps you have already seen in this visit. | Decryptr | Until you close the tab |
| site_demo, mod_demo, dx.demo.levels, demo_* (session storage) | Only when a demonstration link is opened: keeps the demonstration running as you move between pages. | Decryptr | Until you close the tab |
Analytics, only if you accept
These are only stored if you press Accept all. They tell us which pages and features people use and where the site goes wrong, so we can improve it. PostHog processes this for us in the United States (see where your data goes). If you are signed in, PostHog receives your account id, never your name or email. We switch off PostHog's city and region lookup from your IP address.
| Name | What it is for | Set by | How long |
|---|---|---|---|
| ph_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw_posthog (cookie and local storage) | PostHog's random id for this browser, so it can link your visits, the clicks you make and a recording of the session with everything you type hidden. | PostHog, for us | 1 year |
| ph_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw_posthog_cpm (cookie), ph_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw_posthog__flags (local storage) | PostHog's own settings for this browser, such as which of its features are switched on. | PostHog, for us | 1 year, or until you clear it |
| ph_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw_posthog, ph_phc_ASnDqnWnnrPAJWioxyR9QCXHEAghejiY7T63ZQ2qBqBw_window_id (session storage) | PostHog's id for the current visit and this tab, and the page that sent you. | PostHog, for us | Until you close the tab |
| decryptr.anon (local storage) | A random id for this browser in our own visit counts, so a returning visitor is not counted twice. | Decryptr | Until you clear it or refuse |
| decryptr.landing (session storage) | Where you arrived from: the campaign tags in the link, the site that sent you and the first page. If you then create an account, it is recorded with the sign-up. | Decryptr | Until you close the tab |
Measuring without cookies
Some measurement happens whatever you choose, because it stores nothing on your device:
- PostHog in cookieless mode. Before you answer, and after you refuse, PostHog counts page views without storing anything on your device. It does not record sessions or clicks in this mode.
- Our own counts. Pages viewed and features used are sent to our own database with a random id that lasts only as long as the tab, unless you accept, when it is kept as decryptr.anon.
How this data is handled is set out in the privacy notice.
Other companies' pages and frames
A few things on the site come from other companies, in their own frame or on their own page. They may set their own cookies under their own policies, which we do not control:
- TradingView, only if you switch a coin's chart to the TradingView view. Their chart is loaded from tradingview.com at that moment, not before.
- Stripe, if you subscribe on the website. Checkout and Manage subscription open on Stripe's own pages, where Stripe uses cookies to process the payment and prevent fraud.
- Apple and Google, if you use Sign in with Apple or Google. Signing in happens on their pages.
- Cloudflare Turnstile, on the sign-up, sign-in and password reset forms (see Essential).
GIFs and stickers are searched through our own server, and pictures in posts are served from our storage, so neither sets cookies.
In the app
The Decryptr app does not use browser cookies, but it uses similar technologies on your phone:
- Google AdMob shows ads. In the UK, the EEA and Switzerland, Google's consent form asks before the ad SDK stores or reads anything for advertising, and you can refuse in one tap. On iPhone, Apple also asks whether the app may track you. Change either at any time: in the app, Settings, Privacy & safety, Privacy & data, Ad choices; on iPhone, also the phone's Settings, Privacy & Security, Tracking.
- Google Firebase delivers push notifications and receives crash reports, without your account id.
- Our own product analytics count what you use in the app, in our own database. Switch it off in Settings, Privacy & safety, Privacy & data, Product analytics; off deletes what we hold.
- The app keeps your sign-in in the phone's secure storage, and your settings and drafts on the phone, much as the website does.
The app does not use PostHog. The privacy notice explains advertising in full.
Removing them
Signing out ends your session and removes the sign-in entries, but it does not remove your settings, drafts or Ask Decryptr conversation from the browser. On a shared computer, clear the site's data as well.
Every browser can delete what a site has stored and block cookies, usually under Settings, Privacy. Blocking all of them will sign you out and stop you signing in, because the essential entries are needed for that.
Questions
Email [email protected]. If we add or change anything on this page, we update it and the date at the top before the change goes live. Anything that needs your consent will ask you first.