Privacy statement

coiners.club is the controller for the personal data described here, as meant in the General Data Protection Regulation (GDPR). You can reach us at the address under Contact.

• Your email address. It is only added to our newsletter list after you click the confirmation link we send you.
• The country you live in, which you choose when you sign up. We use it to send you offers that are available there. Like your email address, it is only added to the list after you confirm.
• That you are verified, and the date you joined. This is the date your address was added to the list.
• How you proved your bitcoin: with a wallet or with a statement.
• When you apply with a statement: the statement, your email address and your country, until we have reviewed it and at most 14 days. The statement and your email address are stored encrypted.
• When you send feedback: your message, and your name and email address when you fill them in.
• One-time verification codes. They expire after 30 minutes, are not linked to you and are deleted automatically.

• Names
• Bitcoin addresses
• Balances or amounts
• Signatures
• API keys

A statement you send us is an exception: it shows your name and your balance, and we keep it only until it is reviewed, at most 14 days.

Feedback is the other exception: a name you fill in there is kept with your message.

Verification happens once. The addresses and balances you verify are thrown away as soon as the check is done. Your email address never appears in our logs or error reports.

You sign a one-time message with your wallet. We check the signature and add up the confirmed balances of the addresses your wallet shares. When they hold at least one whole bitcoin together, we send a confirmation link to your email address. The link is valid for 24 hours.

Some wallets sign with one address of an account only and share the other addresses of that account. Those addresses count too: we read their balances and throw them away as soon as the check is done.

Is your bitcoin with an exchange or a broker? Then you have no keys to sign with and you send us a statement instead. We review it by hand: it has to show at least one whole bitcoin and a recent date. Only the reviewer sees it. With the decision the statement is deleted, and you get an email with a confirmation link or a note that it was not accepted.

We accept that someone could let a friend sign for them. Preventing that would mean storing addresses, and that is a bigger risk.

• Verification, the newsletter and offers for your country: your consent, which you give with the checkbox when you sign up. You can withdraw it at any time.
• Feedback: our legitimate interest in improving the website. Your name and email address are optional.
• Statistics: our legitimate interest in knowing how many people visit the website and how many complete the application.
• Protecting the website against abuse: our legitimate interest in keeping the verification safe.

• Your email address and country stay on the list until you remove them. When you only unsubscribe, they stay on the list marked as unsubscribed, and you receive no more newsletters.
• An email address and country you enter but never confirm are not stored by us. They only travel inside the confirmation link, which stops working after 24 hours.
• One-time verification codes are deleted within a day after they expire.
• A statement, with the email address and country you sent with it, is deleted as soon as it is reviewed, and after 14 days at the latest.
• Feedback stays in our issue tracker. Email us and we remove your name and email address from it.

We set no cookies for statistics or tracking. The website sets a session cookie and a security token cookie, which are needed to send forms safely, and a cookie that remembers the colour scheme setting. The session stays in that encrypted cookie in your browser, not on our servers.

We count visits to our public pages with Plausible. It sets no cookies and stores nothing in your browser. To tell visits apart it combines your IP address and browser type with a key that changes every day; the IP address itself is not stored. The pages of the application and the links we email you are not counted as page visits: we only count that a step was reached, never the link. A step is, for example, that a wallet was connected or that the addresses held less than one bitcoin together, never an address or an amount.

To limit how often someone can try to verify, request emails or send feedback, we count attempts per IP address. We only store a keyed hash of your IP address for this, which expires after at most an hour.

Our emails load their heading font from coiners.club. If your email app loads it, our hosting provider sees your IP address and the time you opened the email. The font address is the same in every email, so we cannot tell which email or which member a request belongs to.

• mempool.space and blockstream.info: we look up the balance of each address you verify with mempool.space, and with blockstream.info when mempool.space does not answer. These public services can see which addresses are checked.
• Reown (WalletConnect): when you use the connect wallet button, the connection with your wallet runs through their relay. The manual route does not use Reown.
• Laravel Cloud: our hosting provider runs the website and its database, where a statement waits encrypted until it is reviewed, and processes your IP address to deliver its pages.
• Laravel Nightwatch: we use it to see errors and slow pages. It receives technical details of each page request, such as the page and how long it took. We remove IP addresses, email addresses, bitcoin addresses and the codes in our links before anything is sent.
• Plausible: counts visits without cookies and without storing your IP address. The data stays in the European Union.
• Resend: our email provider stores the newsletter list, with your email address, your country and how you proved your bitcoin, and sends our emails. Resend stores data in the United States, covered by a data processing agreement and standard contractual clauses.
• GitHub: feedback you send is stored as an issue in our private repository at GitHub, with your name and email address when you fill them in. GitHub stores data in the United States.

Partners never receive email addresses or countries. Offers reach members through codes or links from coiners.club.

Every newsletter contains an unsubscribe link. To remove your email address and country from our list completely, use the leave the list page.

You have the right to access, correct and delete your personal data, to restrict or object to its use, to receive it in a portable format and to withdraw your consent. Email us to use these rights. Because we store so little, removing your email address with the leave page usually covers everything.

You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Questions about your privacy? Email [email protected].