Loading…
Loading…
Last Updated: October 23, 2026
This Privacy Policy explains which personal data Squaby.com (“we,” “us”) processes when you visit squaby.com, why we process it, who receives it and how long it is kept. It also lists your choices. It describes what the website actually does today.
The operator of this website is identified on the Imprint page.
For privacy questions and requests, write to support@squaby.com.
Our hosting provider, Vercel, records technical data for each request (IP address, URL, browser, time). We use your IP address in Upstash Redis to rate-limit requests per visitor, which protects the tools and the administrator login against abuse. Legal basis: our legitimate interests in operating and securing the website (Article 6(1)(f) GDPR).
We load Google Tag Manager and Google Analytics. Cookies, identifiers and advertising signals are used only after you consent, separately for Analytics and Advertising. Legal basis: your consent (Article 6(1)(a) GDPR and the e-privacy rules). You can withdraw it at any time with the Cookie settings button in the footer or below.
When you use the Wallet Profiler, your wallet address is sent from our server to public blockchain RPC providers to read balances. We do not store it in our database or caches, but it is part of the request address and can therefore appear in server logs (section 3.1). Price lookups use public market data and contain no address. When you use the Token Approval Checker, your wallet address is sent from our server (in the request body, not in the URL) to public blockchain RPC providers to read token allowances. We do not store it in our database or caches. When you use the Contract Scanner, the contract address and chain are sent from our server to GoPlus Security, and the result is cached in Redis for one hour under a key that contains the address. The Watchlist is stored only in your browser (local storage) and is never sent to us. Legal basis: our legitimate interest in providing the tools you ask for, and your own request (Article 6(1)(f) GDPR).
Site staff sign in to an administration area. Their IP address is stored with each audit-log entry in Supabase, a hashed IP address is used to count failed sign-ins, and a session lasts 8 hours. Legal basis: legitimate interests in the security and traceability of content changes (Article 6(1)(f) GDPR).
If you e-mail us, we process your e-mail address and message to answer you. Legal basis: our legitimate interest in answering enquiries or, where you ask about a service, steps before a contract (Article 6(1)(b) and (f) GDPR).
Squaby does not embed swap widgets. The link to the swap provider ChangeNOW leads to its own website, which processes whatever you enter there, including any identity checks, under its own privacy policy. Links to exchanges, wallet makers, gaming sites and other partners lead to their websites, where their policies apply. The promotional banners on the Binance, Kraken and Bybit review pages are loaded directly from the image servers those exchanges use (public.bnbstatic.com, images.ctfassets.net, cdn.bybit.com), so those servers receive your IP address. Other images, such as partner logos, are delivered through our own website. The exception is a logo stored as an SVG file: your browser loads it directly from the server that hosts it, which then receives your IP address.
The administration area has an AI writing assistant for staff. The text a staff member enters is sent to an AI service (OpenAI). No visitor data is sent to it. See the Editorial Policy.
_ga): set only after you consent to Analytics or Advertising. They are removed when you withdraw consent.We use Google Consent Mode v2. All four consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to “denied” before any Google tag loads, and they change only after your choice. Google tags are loaded in advanced mode: while consent is denied they set no cookies, but they can still send cookieless pings to Google. These pings contain no cookie identifiers; they contain technical information such as the page address and basic browser details, and, as with every request to a server, Google receives the IP address of your device. We also restrict advertising data while advertising consent is denied.
Change or withdraw your choice at any time:
These providers receive data when you use the website. Where they are located and which safeguards they use for international transfers is described in each provider's own documentation.
| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| Google (Google Analytics, Google Tag Manager) | Usage statistics and, if advertising tags are enabled in our tag setup, advertising measurement. | With your consent: cookie identifiers, pages viewed, device and browser information. Without consent: cookieless pings (see section 4). | See provider documentation | See provider documentation |
| Vercel | Hosting and delivery of the website, server logs. | IP address, requested URL, browser (user agent) and time of each request. | See provider documentation | See provider documentation |
| Upstash (Redis) | Rate limiting, short-lived caches, session data for site administrators. | IP address (rate-limit keys), contract address and chain you scan (cache key), hashed IP address (administrator login failures), administrator session data. | See provider documentation | See provider documentation |
| Supabase | Database for published articles, image storage, administrator audit log. | Public article content; IP address and actions of site administrators in the audit log. | See provider documentation | See provider documentation |
| Public blockchain RPC providers (for example PublicNode, LlamaNodes) | Reading wallet balances, block numbers and gas prices on public blockchains. | The wallet address you enter in the Wallet Profiler or the Token Approval Checker. The request is sent from our server, not from your browser. | See provider documentation | See provider documentation |
| GoPlus Security | Token contract security flags in the Contract Scanner. | The contract address and chain you enter. The request is sent from our server, not from your browser. | See provider documentation | See provider documentation |
| CoinMarketCap, Alternative.me | Market prices and the Fear & Greed Index. | Our server requests the data and sends no visitor data. | See provider documentation | See provider documentation |
| Exchange image hosts (public.bnbstatic.com, images.ctfassets.net, cdn.bybit.com) | Promotional banners on the Binance, Kraken and Bybit review pages. | Your IP address and browser details, because your browser loads the banner directly from these hosts. | See provider documentation | See provider documentation |
| ChangeNOW | Partner site of the swap provider. | Nothing is sent to them while you use Squaby. If you follow the link, your browser connects to ChangeNOW, which decides on its own how the data is used. | See provider documentation | See provider documentation |
The periods below are the technical limits set in our systems. “To be defined” means that we have not yet fixed a period.
| Where | Data | Kept for |
|---|---|---|
| Rate-limit counters (Redis) | IP address | Up to 21 seconds for most requests, about 2 minutes for the Wallet Profiler, Token Approval Checker and Contract Scanner, about 30 minutes for administrator sign-in attempts |
| Contract scan cache (Redis) | Contract address and chain, scan result | 1 hour |
| Market data, price and sentiment caches (Redis) | No personal data | 1 minute to 1 hour, depending on the cache |
| CoinMarketCap usage counter (Redis) | Monthly number of API calls, no personal data | About 35 days |
| Blocked-request counter (Redis) | Daily number only, no IP address | 48 hours |
| Administrator login failures (Redis) | Hashed IP address of the person signing in | 1 hour |
| Administrator session (Redis, cookie) | Session data of site staff | 8 hours |
| Consent record in your browser | Your choices, date and version | 180 days, then we ask again |
| Watchlist in your browser | Addresses you saved | Until you delete them or clear your browser data |
| Administrator audit log (Supabase) | Actions and IP address of site administrators | To be defined |
| Server logs (hosting provider) | IP address, URL, browser, time | To be defined; see the provider documentation |
| Google Analytics data | Usage data collected with consent | To be defined |
| E-mails to our contact address | Your e-mail address and message | To be defined |
The website is served over HTTPS. Administrative functions require an authenticated session that expires after 8 hours, and sign-in attempts are rate-limited. No online service can be completely secure, so we cannot guarantee that data will never be accessed without authorization.
Depending on where you live, you may have the right to access, correct, delete or restrict your data, to object to processing based on legitimate interests, to data portability and to withdraw consent at any time. Details, and how to lodge a complaint with a supervisory authority, are in our GDPR Statement. To make a request, write to support@squaby.com.
The website is intended for adults aged 18 or older. We do not knowingly collect personal data from minors. If you believe a minor has sent us personal data, contact us and we will delete it.
We update this policy when our processing changes. The date at the top shows the latest version. When the purposes or providers for analytics or advertising change, we ask for your consent again.