Privacy Policy
1. What we collect
| Data | Why | Kept |
|---|---|---|
| Email address | Sign-in (one-time links), receipts, renewal reminders, security notices and service messages | Until you delete your account |
| Public wallet addresses you add | To read the blockchain history that the report is built from | Until you delete the report or your account |
| Transaction data derived from those addresses, and the reports and documents we generate | The service itself | Documents: until you delete them, or — if you set a retention period in your security settings (7 days to 10 years) — until that period ends, with a warning 7 days before deletion. Account and report records: until deleted |
| Country, tax year and cost-basis method you select | To apply the right rules and currency | With the report |
| Subscription status and Stripe customer reference | To know what you are entitled to and to bill renewals. Card numbers are held by Stripe, never by us. | Until you delete your account; billing records as required by law |
| Authenticator enrolment and recovery-code hashes | Second-factor check before documents are released | Until you remove them or delete your account |
| Access log: who opened or downloaded a document, when, from which approximate location (IP-derived) | Your delivery receipt and our fraud/abuse protection | Kept with the account even after documents are purged, so your record survives |
| Accountant sharing: the recipient’s email (encrypted) and their verification code activity | To deliver a document to someone you choose, once, after they verify | Until the share expires or you revoke it |
| Technical logs (IP address, browser, request timing, errors) | Security, rate-limiting and keeping the service working | Rolling 30 days, or longer if needed to investigate abuse |
We do not collect private keys, seed phrases, exchange logins, government identifiers or payment card numbers. If you email us, we keep the correspondence to help you.
2. How we use it
- To provide the service: scanning, computing, rendering and securely delivering your reports.
- To run your subscription: receipts, a reminder before every automatic renewal, failed-payment notices, and — if you cancel — a record that you cancelled so we honour it and can, at most, invite you back once a year. You can opt out of any marketing message with one click.
- To keep the service secure and lawful: authentication, abuse prevention, and responding to legal requests.
- To improve the service using aggregate, de-identified usage statistics.
We do not sell or rent personal data, we do not use it for advertising, and we do not build profiles of your wealth or trading for any purpose other than producing the report you asked for.
3. Who we share it with
Only processors that are needed to run the service, each bound by contract to use the data solely for that purpose:
- Stripe — payments and subscription billing (your email and amount; card details go directly to Stripe).
- Supabase — database, authentication and encrypted document storage (United States region).
- Cloudflare — the application servers and network security.
- Resend — transactional email delivery.
- Blockchain data and price providers (for example Alchemy, Helius, DefiLlama, CoinGecko) — they receive the public wallet address or token identifiers being looked up, never your identity.
- A recipient you designate (for example your accountant) receives only the document you share, after verifying their email.
- Authorities, where the law requires it and after checking the request is valid.
4. Cookies and local storage
We use no advertising or tracking cookies. Your browser keeps a sign-in session in local storage so you stay logged in; it is removed when you sign out. We may use a privacy-respecting analytics tool that records page views without identifying you.
5. Security
Documents are stored encrypted in a private bucket and are never attached to emails; they are released only after your authenticator check, through single-use links that expire in minutes, and every release is logged. Wallet-to-identity links are treated as our most sensitive data and are encrypted at rest. Access to production systems is restricted and audited.
6. Retention and deletion
Generated documents are kept until you delete them, unless you set a retention period in your security settings, in which case we purge them when it ends and remind you seven days before. You can revoke any share you have made at any time. To delete your entire account, email support@koini.io from your sign-in address; we confirm and delete within 30 days, and deletion cascades to your wallets, reports, documents, shares and authenticator data. Billing records that we are legally required to keep (for example invoices) are retained for the statutory period and then deleted.
7. Your rights
Wherever you live, you can ask us to access, correct, export or delete your personal data, or to stop using it for marketing, by emailing support@koini.io. Residents of the European Economic Area, United Kingdom and Switzerland have these rights under the GDPR and UK GDPR, including the right to object and the right to complain to a supervisory authority; where we rely on legitimate interests (security, service improvement, renewal reminders) you may object at any time. California residents have equivalent rights under the CCPA/CPRA; we do not “sell” or “share” personal information as those terms are defined there. We respond within 30 days.
8. International transfers
We operate from the United States and our processors store data there. If you are outside the United States, your data is transferred to and processed in the United States under appropriate safeguards, including standard contractual clauses with our processors where required.
9. Children
The service is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
10. Changes
If we change this policy in a way that matters, we will post the new version here and email account holders before it takes effect.
11. Contact
KOINI Global, LLC
130 Cass Avenue, Mount Clemens, Michigan 48043, United States
support@koini.io