Privacy policy

This policy explains what Kestrel collects, why, and your choices. Last updated 27 September 2026.

What we collect

Account data: name, email, password (stored only as a salted scrypt hash), and optional profile details you add (phone, country, time zone, Telegram username). Billing data: the plan, amount, blockchain transaction ID and receiving address of your payments. We never receive card numbers. Exchange API keys (Auto-Trade only): encrypted with AES-256-GCM and never shown again. Security logs: sign-in times, IP address and browser, used to protect your account.

How we use it

To provide the service, confirm payments, send transactional emails and alerts you enabled, prevent fraud and abuse, pay referral commissions, and meet legal obligations. We do not sell your data.

Service providers

Hosting (Hostinger), email delivery (Resend), Telegram (for alerts you link), and public blockchain data (TronGrid). Payment transactions on public blockchains are visible to anyone by design.

Retention

We keep account and billing records while your account exists and as long as required for accounting. Deleting your account anonymises your personal data and removes stored API keys immediately.

Your rights

You can view and edit your data in your profile, export it on request, and delete your account at any time from Profile → Delete account. Contact us through the contact page for any privacy request.

Security

HTTPS everywhere, hashed passwords, encrypted API keys, two-factor authentication for accounts, audit logging and daily encrypted backups. No system is perfectly secure; please use a unique password and enable 2FA.

Cookies

We use only essential cookies. See the cookie policy.