Privacy notice

1. Who is responsible

The controller of the personal data described here is Osmium Network Ltd.. Contact: info@cryptosrank.com. If you are in Türkiye, our KVKK notice gives the same information in the form required by Law No. 6698.

2. Using the site without an account

You can use markets, asset pages, calculators, the converter, comparisons and the map without signing up. Your language, currency, theme, chart and sidebar settings, the watchlist you keep as a guest and the list of assets you viewed recently are stored only in your own browser. To show their prices, your browser asks our servers for the current quotes of those symbols; such requests are handled like any other page request and are never saved to an account.

Our servers record technical data with each request — IP address, browser, requested page and time — to deliver pages, protect the Service against abuse and fix errors. Rate limiting uses your IP address in server memory only.

To show what is trending, we count views of each asset page. These counts contain no IP address, account or other identifier and are deleted after 7 days.

Google Analytics is loaded only if you accept it in the cookie banner. Until then, no data is sent to Google for analytics. See the Cookie policy.

3. If you create an account

We store your email address and username; your password as a hash, or — if you sign in with Google — your Google account identifier, name and profile photo; and the data you add: portfolio holdings, watchlist, price alerts, comments and likes.

If you turn on notifications in our app, we store a device token together with the platform, app and operating-system version and device name, so that we can deliver the alerts you set.

4. What is public

Your username, display name, profile photo and the comments you post are visible to everyone. Your portfolio, watchlist, alerts and email address are private and protected so that other users cannot read them.

5. Crypto wallet connection

If you connect a wallet, its public address is kept only in your browser. Balances are read directly by your browser from public Ethereum nodes (LlamaRPC, PublicNode, Cloudflare and Ankr), which receive your address and IP address. We never ask for, and never receive, private keys or seed phrases.

6. Purposes and legal bases

Providing your account and the features you use — signing in, syncing your portfolio, sending the alerts and verification codes you request: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).

Security, prevention of abuse and fraud, server logs, anonymous view counts and improving the Service: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).

Analytics cookies and push notifications: your consent, which you can withdraw at any time (GDPR Art. 6(1)(a); KVKK Art. 5/1).

Meeting legal obligations and answering lawful requests from authorities (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).

We do not sell personal data, do not use it for advertising and do not take decisions about you based solely on automated processing.

7. Who receives data

Our hosting provider, which runs the servers our database and authentication system are installed on; Google, for Google sign-in (if you use it), Google Analytics (only with your consent) and delivering our emails through Google Workspace; Google Firebase Cloud Messaging and the Apple Push Notification service, to deliver notifications; and the public blockchain nodes listed above, if you connect a wallet.

These providers act on our instructions or under their own terms for the services they provide. We disclose data to authorities only where the law requires it.

8. International transfers

Some of these providers, including Google and Apple, process data outside Türkiye and the European Economic Area, including in the United States. Where required, these transfers rely on appropriate safeguards such as standard contractual clauses and are made in line with Article 9 of the KVKK.

9. How long we keep data

Account data, portfolio, watchlist and alerts: until you delete them or your account. Comments: until you or we remove them, or your account is deleted. Device tokens: until you sign out or they expire or become invalid. Anonymous view counts: 7 days. Server logs: only as long as needed for security and troubleshooting. Analytics data: according to the retention we set in Google Analytics, at most 14 months.

Deleted data may remain in backups for a limited period until those backups are overwritten.

10. Your rights

You have the right to access your data; to have it corrected, deleted or its processing restricted; to receive it in a portable format; to object to processing based on our legitimate interests; and to withdraw consent at any time, which does not affect processing carried out before. You can change your analytics choice at any time under “Cookie settings” at the bottom of every page.

To exercise your rights, email info@cryptosrank.com; we reply within 30 days. You may also complain to a data protection authority — in Türkiye the Personal Data Protection Board (KVKK), in the EU the authority of your country.

11. Security

Connections are encrypted (HTTPS), passwords are stored only as hashes, and database access rules ensure that each user can reach only their own private data. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

12. Children

The Service is not directed at children, and accounts may only be created by people aged 18 or over. If you believe a child has given us personal data, contact info@cryptosrank.com and we will delete it.

13. Changes and contact

If this notice changes, the date above changes with it. Questions: info@cryptosrank.com.