Privacy Notice

• We collect what we need to run your account, the timeline, Messages, Levels and your portfolio, and no more.
• We do not sell your personal data. Ever.
• Messages are encrypted when stored, but they are not end-to-end encrypted. Our systems check them for scams and abuse, and a person reads a message only when it is reported or held as a likely scam.
• AI features (Ask Decryptr, the daily brief, portfolio checks, the weekly coach) only run once you agree. What they need is then sent to OpenAI to produce an answer. Your Ask conversations are saved to your account until you delete them. You can turn AI features off in Settings at any time.
• If you link an exchange, we only accept read-only keys, and we keep them in an encrypted vault.
• Ads are only personalised if you agree, and nothing is locked if you decline.
• You can download your data, or delete your account, from the app.

Decryptr Limited (registered office 18B Gregory Street, Nottingham, NG7 2LR, company number 17484593) is the data controller for Decryptr.

For anything about your data, email [email protected].

Where we rely on legitimate interests, the interest is running a safe, working product, protecting people from fraud, and improving the app. We have weighed it against your rights. You can object at any time: see Your rights. The legal obligation is mainly the Online Safety Act 2023, which requires us to protect users from illegal content, including fraud.

When we send your daily reminder. If you keep the daily reminder on, we use how you use the app to choose when to send it, and whether to send it at all: the times you usually open the app and read the news, how long you stay, which tab you start on, whether your phone is on Wi-Fi or mobile data when you open it, your notification permission, your streak and Levels play, and how you responded to earlier reminders. This stays in our own database, is never shared or sold, and never includes your IP address or location. We do this on the basis of our legitimate interests in sending fewer, better-timed notifications. The raw activity is kept for at most 90 days, after which only a summary remains. Switch off analytics in Privacy & data and we stop, delete the summary and send at 18:00 or the time you pick; switch off the reminder in Notifications and it stops.

We do not ask for sensitive information such as health, religion or political views. If you choose to write it in a post or message, we treat it with the same care as everything else, and you can delete it.

What we store. When you use Messages (direct messages, group chats, rooms and event rooms), we store what you send: text, photos, posts you share, reactions, and when you sent and read them. Messages are private to the people in the conversation and, for rooms anyone can read, to anyone signed in.

How we protect them. Messages are encrypted in transit and when stored; photos are encrypted on your phone before upload. They are not end-to-end encrypted: our systems can read them, so we can keep you safe.

Automated checks. We check every message and photo automatically, as it is sent, for scams (for example requests for seed phrases, fake support, wallet-drainer links, impersonation) and for illegal or abusive content. A message that is very likely a scam is hidden straight away until a moderator reviews it. Links are checked before they can be opened. These checks use our own rules and OpenAI's moderation service (text and images are sent to OpenAI for this check only; OpenAI does not use them to train its models and does not keep them after the check).

When a person reads your messages. A member of our team reads a message only when someone in the conversation reports it, or when our automated checks hold it as a likely scam. They see that message, any photo in it, and the five messages before it. Every time a moderator opens a conversation or a private photo, it is logged.

How long we keep them. Messages stay until everyone has left the conversation. If you delete your account, your messages stay in other people's conversations as "Deleted account", so reports and evidence of scams survive; your photos are deleted. Copies of messages that were removed, unsent, edited or held are kept for 12 months for moderation and appeals. Notifications about messages are deleted after a day. Event-room chat is deleted 90 days after the event.

Your choices. You choose who can message you, whether people see when you've read their messages, whether notifications show the message, and you can mute, archive, clear or delete any chat, block anyone and report anything.

Which features use AI. Ask Decryptr (typed or spoken, with any image or document you attach), the daily brief, coin reads, position and portfolio checks, and the weekly coach on Decryptr X. Each sends OpenAI what it needs to answer: what you type or say, what you attach, the recent conversation, and the parts of your own data it is about, such as your holdings, trades, wallets you track, watchlist, alerts and journal notes. Never your email, password or exchange keys. Documents are read on your device and only their text is sent. OpenAI processes this on our instructions.

Your consent. None of these features sends anything until you agree, on a screen that says what is shared, with whom and why. Your answer is saved on your account, so it applies on every phone and on this website, and we keep a record of when you gave or withdrew it. You can turn AI features off at any time in Settings, Privacy and data, AI features, on the app or the website: from then on nothing is sent for them, and the weekly coach stops writing reviews, until you turn them on again. Everything else in Decryptr works without them. If we change what is shared in a way that matters, we ask again.

Where it goes and for how long. OpenAI processes this in the United States. Under our agreement with them, they do not use it to train their models. They may keep API content for up to 30 days to detect abuse, and then delete it. In the app your Ask conversations are saved to your account (your 50 most recent) and on your phone, so they come back on a new phone, until you delete the conversation or your account. On the website they are kept in your browser. Coach reviews stay on your account until you delete it. We keep a count of the credits you use.

What does not need your consent. Our safety checks on posts, messages, photos and profiles also use OpenAI's moderation service (see Messages above). They run whatever you choose for AI features, on the basis of our legal duties to tackle illegal content and our legitimate interest in keeping people safe from scams and abuse. Questions you ask Ask Decryptr are checked the same way. Once an hour we also send the text of recent public posts, without names, handles or account ids, to OpenAI to name the day's trending topics, on the basis of our legitimate interest in showing what the community is talking about. If you turn AI features off, your posts are left out of this too.

Please do not type private keys, seed phrases, passwords or other people's personal details into the assistant. We block them when we spot them.

Wallet addresses. A wallet address you add is public blockchain data, but linked to your account it becomes personal data, so we treat it as such. To show its activity we look it up with blockchain data providers (Etherscan, Alchemy, public network nodes, Hyperliquid and Lighter). They receive the address, never your name or email. We never ask for, and can never access, your private keys or seed phrase. To verify a wallet you sign a message; the signature proves control and moves nothing.

Exchange and prop firm keys. You can link an account at a supported exchange (Bybit, OKX, Binance, Bitget, Coinbase) or prop firm with an API key. We only accept keys that the exchange confirms are read-only: they can see balances, positions and trades, and cannot trade or withdraw. The key is stored in an encrypted vault, is only used by our servers, and never comes back to your phone. Our sync service reads your balances, positions and trades so we can show them, and stores what it reads.

Some prop firms confirm accounts for us through a partner connection. When they do, we may compare the email address on the firm's record with the one on your Decryptr account, to check the account is yours.

Unlink an account and we delete the key at once, along with what we read with it. Remove a wallet and we stop reading it. Whether your wallets, trades and results are visible to others is your choice, in Settings.

If you link your X account, X asks you to approve it. We receive your X account id and handle, and store only those. We do not post for you, read your timeline or keep any access to your X account: the access X gives us is used once and cancelled. Your handle shows on your profile; your X account id does not. You can unlink it at any time.

When you post or send a link, we check it against our own rules, public scam lists (from MetaMask, ScamSniffer and others) and, where enabled, Google Web Risk. Google receives the web address only, never who sent it. We keep a record of links that were blocked or held, with the account that tried to share them, for 90 days.

When a post names a token contract, we check it with services such as GoPlus, Honeypot.is, RugCheck and DexScreener. They receive the contract address only, which is not personal data.

Decryptr shows ads through Google AdMob, and ads we sell directly. Where the law requires your consent before anything is stored on or read from your device for advertising (the UK, the EEA and Switzerland), we ask for it before the ad SDK starts, and you can refuse in one tap. On iOS, Apple also asks you separately for permission to track, wherever you are. And everywhere, personalised ads can be switched off at any time in Settings.

If you say no, you still see ads, but they are contextual: no advertising identifier is read, and no profile is built about you for advertising. Nothing in the app is restricted or slowed down because you declined. Google may still use your IP address to estimate your country or city for the ad and to prevent fraud.

If you say yes, Google receives your advertising identifier and ad interaction data, and acts as a controller of that data in its own right. Google's handling of it is described in the Google privacy policy.

For the ads we sell directly, we count views and taps against your account so we can report totals to advertisers. Advertisers never receive your identity.

You can change your mind at any time: Settings → Privacy in the app, and on iOS Settings → Privacy & Security → Tracking.

decryptr.ai runs on our own server at Hetzner in Finland, delivered through Cloudflare, which also blocks attacks. Neither sets analytics cookies. PostHog measures how the site is used; until you accept cookies it runs without them, and it only records sessions if you accept. Cloudflare Turnstile checks that a person, not a bot, is signing up, signing in or resetting a password.

Every cookie and similar technology the website uses, what each is for and how long it lasts, and how to change your choice, is in the cookie policy.

We use these providers. Each processes data only on our instructions, unless the table says it is a controller.

Hetzner runs our servers in its own data centre in Helsinki, Finland. The UK treats the EU as adequate for data protection, and any other transfer outside the UK follows the rules in Where your data goes.

We also share data where the law requires it. That includes a court order, or a report we must make about illegal content, such as child sexual abuse material to the National Crime Agency. We do not sell personal data, and we do not share it with data brokers.

Anything you post publicly (your profile, your posts, your Levels drawings once a round locks, your position on a leaderboard, public rooms) is visible to anyone using Decryptr, and to search engines where the page is public.

Our news service reads public posts from a list of X accounts that post about crypto markets, such as projects, founders and well known traders. We store the post, the handle and the account's public name and picture, use OpenAI to sort what is news, and publish short news items that may quote or link to the post. Our lawful basis is legitimate interests: timely market news. If it is your account and you want us to stop, email [email protected].

Our main database is in Ireland. Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified to it, and otherwise on the UK International Data Transfer Agreement or Addendum, together with an assessment of the risks of that transfer. Transfers to the EU rely on the UK's adequacy regulations.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you (you can download most of it yourself in Settings, under Privacy);
• correct anything that is wrong;
• delete your data (you can do this yourself in Settings → Delete account);
• restrict or stop a particular use of it;
• send your data to another service in a portable format;
• object to uses based on our legitimate interests, including feed personalisation and analytics;
• withdraw a consent you gave, such as notifications, personalised ads or AI features, at any time.

Some decisions are made automatically. Our moderation system can hide a post or message, remove a clear breach of the rules, and give a strike that limits your account for a time. It never bans an account; only a person can. You can appeal any decision and a person will look at it.

Email [email protected]. We respond within one month and it costs nothing. If a request is especially complex we may take up to two months more, and we will tell you within the first month if so.

If you are unhappy with how we handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first.

Decryptr is for adults. You must be 18 or over to have an account, because the app is about cryptoasset markets, carries advertising, and lets adults message each other. We ask you to confirm your age when you sign up.

We do not knowingly collect data about children. If you believe a child is using Decryptr, tell us at [email protected] and we will close the account and delete the data.

Data is encrypted in transit and at rest. Message text is encrypted again with a key held in a vault, and message photos are encrypted on your phone. Exchange keys are kept in the same vault. Access to production systems is limited to people who need it and protected by multi-factor authentication. Sign-in tokens are held in your device's secure keychain, not in ordinary app storage. Photos have location and other hidden details removed before upload.

No system is perfect. If a breach happens that risks your rights, we will tell the ICO within 72 hours and tell you without undue delay where the risk to you is high.

When we change how we use your data we will update this notice and change the date at the top. If the change is significant we will tell you in the app or by email before it takes effect.

See also our Terms of Use and Support.