Privacy Notice

Who is responsible

DEX TRACER (“we”) is responsible for the personal data described here. Questions and requests go to support@dextracer.com.

What we keep

Only what running your account needs. We use it to provide the service you signed up for and to keep it secure.

• Account: your name and email address (none if you sign in only with a wallet), whether the email address is confirmed, and when the account was created.
• Password: stored only as an Argon2id hash, never as the password itself.
• Sign-in methods: which methods you use, the addresses of Solana wallets you link, and, if you use Google, your Google account ID. We keep no Google access or refresh tokens.
• Terms acceptance: the versions of the Terms of Service and this notice you accepted, that you confirmed your age, how you accepted (email, Google, wallet or a prompt in the app) and when.
• Sessions: for each signed-in browser, its IP address, browser user agent and times. Settings shows each device with a shortened network address, never the session secret.
• Two-step verification: if you enable it, we store the authenticator secret encrypted, recovery codes as keyed fingerprints, and short-lived sign-in proofs. Session tokens are stored as fingerprints rather than the original tokens.
• Account assistance: you can open support conversations and exchange plain-text replies with staff. We store the category, messages, status and dates with your account. Staff may also keep internal case notes; the Support area shows only your conversations and replies explicitly addressed to you. Your data export includes your case history without staff identities. A case does not itself restore account access. Do not include passwords, authenticator codes, recovery codes or wallet secrets in a message or note.
• Security records: account security events (such as sign-ins, password and email changes, linked methods and ended sessions) with a shortened network address instead of the full IP address; the number of consecutive failed password sign-ins; and short-lived request counters per network address that slow down abuse.
• Email: when we email you, the message and your address wait encrypted in our delivery queue until they are sent, and we keep a record of whether delivery succeeded. If mail to an address bounces or is reported as spam, we keep a keyed fingerprint of the address (not the address itself) so that we stop sending to it.
• Recovery restrictions: we keep minimal account or contact identifiers, keyed address fingerprints, preference categories and dates to record deletions, retired contacts, email suppression and notification opt-outs. These records contain no names, readable email addresses, passwords, message text or research notes. They help prevent older backups from undoing those restrictions.
• Your research: your Watchlist, private notes, saved screeners, alert rules and which notifications you have read.
• Wallet trading, if you use it: the Privy user identifier bound to your website account, public wallet and token addresses with their networks, quoted amounts, decimals, route, reported fees, slippage, expiry and dates, and execution outcomes and transaction hashes. Retained unsigned transaction instructions and provider request identifiers support execution and reconciliation. Our server does not store wallet private keys, Privy access tokens or signed trading transactions.
• Web server logs: IP address, time, page and user agent of each request, for security and troubleshooting.

In your browser

Cookies are used only to keep you signed in and to protect sign-in from forgery, including a short-lived cookie that ties a wallet signature request to your browser; there are no advertising or analytics cookies.

If you connect a trading wallet, the Privy SDK manages its wallet session in your browser and stores its access tokens in localStorage by default. Those tokens can be read by scripts on the page; they are separate from the website account session, whose cookie is HttpOnly. We do not copy Privy tokens into our own browser storage. Pending EVM transaction identifiers can be kept in sessionStorage, scoped to the website account, so an already submitted transaction can be recorded without sending it again.

What we do not do

We do not sell or rent personal data, show ads, use analytics or tracking scripts, or send marketing email. We send account email (sign-up and confirmation links, password reset links and notices about important changes to your account), receipts for payments and replies to your support cases. Alert and daily digest email arrive only if you turn them on, and each has an unsubscribe link.

Who else is involved

These providers process personal data for us, each only for its task:

• Hosting. The service runs on a rented server, whose provider stores and processes the data on our behalf.
• Resend sends our email from its Tokyo, Japan region. It receives your email address and the message; open and click tracking are switched off.
• Google, only if you choose Google sign-in: it tells us your Google account ID, name and email address and whether Google verified the address. It also sends a profile picture, which we do not keep.
• Have I Been Pwned: when you choose a password, we first check it against a list of common passwords on our server, then ask this service whether it appeared in a data breach. Only the first five characters of a hash of the password are sent, and the answer is padded so that its size gives nothing away; the password itself never leaves our server.
• Solana wallets: we receive only the wallet’s public address and the signature you approve.
• Privy, only when wallet trading is configured and you connect a wallet: authenticates the wallet session and supplies the linked public wallet addresses and Privy user identifier we verify against your website account.
• Jupiter for Solana swaps and 0x for EVM swaps: receive the public wallet and token identities, amounts and quote parameters needed to find and execute a route. Jupiter receives the signed Solana transaction you approve. Dedicated blockchain RPC providers receive public transaction hashes, addresses and transaction queries needed to verify metadata and execution. Wallet software and blockchain networks also process transactions you authorize; public blockchain records are not private account data.

How long we keep it

Account data, terms acceptances and research stay until you delete your account. Deleting it removes the account, its sessions, sign-in methods and research from our database straight away.

• Sessions end when you sign out, after 7 days without use, and after 30 days at most.
• Security events are kept for 90 days; after an account is deleted, its remaining events no longer name it.
• Assistance cases are removed 90 days after closure, or when the member account is deleted. Open cases stay while the account exists. Separate staff security audit records contain action and case/account identifiers without case text and are kept for 365 days.
• Trading quotes and execution history are removed by bounded maintenance after 90 days from quote creation, or when you delete your website account. The Privy identity binding stays until account deletion. Staff can read aggregate network and outcome counts, without owned quotes, wallet addresses or member identifiers. Public blockchain records and records held by wallet or execution providers are outside our account-deletion process.
• Queued email is erased once it is sent; delivery records are kept for 30 days.
• Request counters are kept for 2 hours, and web server logs for about 14 days.
• Database backups are kept on our server for 14 days. Encrypted copies kept elsewhere for recovery are retained for up to 6 months and then removed within a further 90 days. Deleted accounts leave backups only when those backups expire.
• Minimal recovery restrictions remain separate from the deleted profile and do not currently expire automatically. Removing them requires verifying that older recoverable backups can no longer undo the restriction. Backup recovery requires checking these records before account access or email is reopened.

Your choices

In Settings you can change your name and email address, download a copy of your account, research, assistance-case history and retained trading history as a JSON file, and delete your account. Trading exports include the owned quote review and outcome but omit executable transaction instructions, private provider context and Privy identifiers. The export also omits staff identities and internal security audit. Under Security you can see every signed-in website device and sign out any of them, or all others at once.

For any other request about your data, write to support@dextracer.com.

Security

Passwords are hashed with Argon2id. The site is served over HTTPS, and the session cookie cannot be read by scripts on the page. Links in our emails work once, expire after 30 minutes and are stored only as hashes. Sensitive changes need a sign-in from the last few minutes.

Changes

When this notice changes, we update this page, its version and its date, and ask you to acknowledge the new version before you use your account again.