Privacy: what Tokenping stores and who handles it

What you can do without giving us anything

Reading the site and the blog, and looking at your positions on the dashboard, adds nothing to our database. To show your positions, your browser asks RPC providers (listed below) for your wallet's Aave data, so they see your wallet address.

What we store when you save an alert

• Your wallet address.
• The network the alert is for, and your threshold.
• The channels you picked, and the language of each.
• Your email address, if you chose email.
• Your Signal username, if you chose Signal.
• When the alert was created and last changed.
• When you last sent a test message on each channel, to allow one test per channel every 15 minutes.

If you choose Telegram, we store the Telegram username you type into the alert. When that account presses Start in the Tokenping bot, we also store its chat ID and when it pressed Start, so alerts can reach it. Anyone can check whether a Telegram username has pressed Start in the bot.

If you answer the optional "How did you hear about Tokenping?" question after saving an alert, we store your answer and the time with your wallet address.

What we don't store

• Your positions or a history of your health factor. They are read live and not saved.
• A log of the alerts we sent.
• Tracking pixels or advertising cookies: the site uses none. When you sign in with your wallet, Tokenping sets one cookie that only says which wallet signed in; it lasts 7 days or until you disconnect the wallet on this site. While you sign in, a second cookie holds the sign-in request for five minutes. Your browser keeps your theme choice, your wallet connection, which wallets have signed in on it and whether it has already shown you the "How did you hear about Tokenping?" question in its own local storage.
• IP addresses in our database. Vercel still handles every request, as listed below. When an alert check or a message fails, the error, which can include your wallet address and the recipient, goes to our server logs.

Who can see your alert settings

Alert settings are tied to a wallet address, not to an account with a password. To see or change them, you sign a message with that wallet, which proves the address is yours. It is not a transaction and costs no gas, and one signature lasts 7 days on that browser.

Only someone who can sign with your wallet can see the email address, Signal username and Telegram username saved for it, or change or delete its alerts. The public payment records described below still show which wallets have paid.

Don't enter an email address or Signal username you wouldn't want linked to your wallet address.

Who handles your data

Vercel

Hosts this site and runs the alert check every 5 minutes.

Receives: Every request to the site, including your IP address, and our server logs.

Vercel Web Analytics

Counts page views, without cookies.

Receives: For each page view: the page address, the site you came from, your approximate location, and your browser, operating system and device type. A visitor is a hash of the request that changes every 24 hours, so visits cannot be linked across days or sites.

Supabase

Our database.

Receives: The alert settings listed above.

Resend

Sends alert emails.

Receives: Your email address and the alert text.

Fly.io (our Signal relay)

Hosts the signal-cli-rest-api server we run, which hands Signal alerts to Signal.

Receives: Your Signal username and the alert text (and so does Signal).

Telegram

Delivers Telegram alerts through its Bot API.

Receives: Your Telegram chat ID and the alert text.

RPC providers (PublicNode, Alchemy and the networks' public endpoints)

Answer the blockchain reads: from your browser for the dashboard, and from our server for alert checks and to check sign-in signatures from smart wallets.

Receives: The wallet address being read (and, when you sign in, your signature), and your IP address for reads made from your browser.

WalletConnect

Relays the connection between this site and your wallet app, if you connect with WalletConnect.

Receives: What your wallet app and this site exchange to connect, such as your wallet address.

Each of these services handles that data under its own privacy policy.

What is public on the blockchain

Paying for alerts happens on Arbitrum One. Each payment records the paying address, the token, the amount, the time, the period bought and the new expiry date in a public event that anyone can read and nobody can delete. Your alert settings are never written to a blockchain.

How long we keep it, and how to delete it

• Alert settings stay until you delete the alert in the dashboard. Deleting removes that network's settings, including the email address and Signal username, and needs active access.
• Sending /stop to the Tokenping bot in Telegram unlinks your chat and stops Telegram alerts.
• If your access has expired, or you want your "How did you hear about Tokenping?" answer removed, message us on X or in our community on Telegram or Signal and we'll delete it.
• Payments on the blockchain can't be deleted by anyone.