LEGAL

Privacy Policy

Last updated: September 15, 2026

Desktop: your data stays on your device. Web: your account data is stored on our server, in France.

1. Overview

Talu Crypt is a cryptocurrency portfolio tracker available in two versions: a desktop application you can download, and a web application at app.talucrypt.com. How your data is handled depends on which version you use. This policy explains what is collected, why, for how long, who else receives it, and the rights you have under the EU General Data Protection Regulation (GDPR).

2. Who is responsible for your data

Talu Crypt is a free, non-commercial project developed and run by one person, “Talu”, who is the data controller for the web version and for this website. For any question or request about your data, write to talu@talucrypt.com.

3. Desktop version

On the desktop version (download), your data stays on your device. We do not collect, transmit, or store the following on our servers:

  • Personal identification information (name, email address, etc.)
  • Financial data or portfolio balances
  • API keys or secrets you configure in the app
  • Crash reports
  • Device identifiers
  • Location data

All application data — including your portfolio configurations, manually entered positions, and exchange API keys — is stored locally on your Windows device. You are solely responsible for backing up and protecting this locally stored data. One exception: when you ask the AI agent to review a portfolio, that portfolio is sent through our server to OpenAI to produce the answer, and the request is logged on our server with your computer's name (see section 7).

4. Web version: what is stored

When you use the web version at app.talucrypt.com, the following is stored on our server:

  • Account: your email address and your password, stored only as a salted hash. If you sign in with Google, we receive your email address and the confirmation that Google verified it — never your Google password.
  • Portfolios: the portfolios you create, their assets and amounts, the public addresses and extended public keys (xpub) you add, the assets you enter manually, your comments, your targets and the order history the app imports.
  • Exchange connections: the exchanges and the API keys and secrets you add, so the server can read your balances and orders. Only use read-only keys.
  • Technical data: the logs needed to run and secure the service, such as failed requests and errors. Error reports sent by the app are forwarded to the developer through Telegram, only to fix bugs.
  • In your browser, not on our server: your sign-in session, your language and the last AI review are kept in your browser's storage.

Non-custodial by design

Talu Crypt is not a wallet: we never hold your cryptocurrency and never ask for a private key or a seed phrase. On the desktop version, your data stays on your device. On the web version, the data listed above is stored on our server to provide the service.

5. Why, and on what legal basis

  • Providing the web version — your account, your portfolios, the synchronisation with blockchains and exchanges, the AI review you ask for: performance of the contract you accept by creating an account (GDPR art. 6(1)(b)).
  • Sending account emails — confirmation, password reset: performance of the contract.
  • Keeping the service secure and fixing errors: our legitimate interest in running a reliable service (art. 6(1)(f)).
  • Audience measurement: our legitimate interest in knowing how the site and the apps are used (art. 6(1)(f)); you can object at any time (section 10).
  • We do not sell your data, do not use it for advertising, and make no automated decision about you.

6. Where your data is hosted

The web version and its database run on a server we operate ourselves, in France (European Union). This website (talucrypt.com) is a static site hosted by GitHub Pages (GitHub, Inc., United States); when you load it, your browser also fetches the Inter font from Google Fonts and icons from the jsDelivr CDN, which receive your IP address as part of the request.

7. Who else receives data

Your data is only passed on where a feature you use needs it:

  • Blockchain data providers (for example Tatum, Blockscout, Blockchair, Blockchain.com): the public addresses you add, to read balances and transactions. Never your email.
  • Exchanges (Binance, Bitfinex, Kraken, Mexc): your API key, to read your balances and orders — from our server for the web version, from your computer for the desktop version.
  • Price and market data (CoinGecko and similar services): coin identifiers only, no personal data.
  • OpenAI (United States): the composition of the portfolio you ask the AI agent to review, only when you ask.
  • Google (United States): only if you choose “Sign in with Google”.
  • Hostinger (European Union): sends the account emails.
  • Telegram: the error reports forwarded to the developer, which can contain technical details about the error.

When a provider is in the United States, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. Each provider's own privacy policy applies to what it receives.

8. How long data is kept

  • Account, portfolios and exchange keys: as long as your account exists. When you ask for your account to be closed, they are deleted within 30 days.
  • A portfolio you delete in the app is removed from the server straight away.
  • Technical logs: as long as needed to investigate a problem, and at most 12 months.
  • Audience measurement: at most 25 months (section 10).

9. Security

Connections to this site, to the web app and to our server are encrypted (HTTPS). Passwords are never stored in clear. An exchange API key gives access to your exchange account's information, so create it with read permission only: a read-only key can neither trade nor withdraw funds.

10. Audience measurement

This website and the Talu Crypt applications use TaluTrack, an audience measurement tool we host ourselves. It records usage events such as the pages visited, the site you came from, the buttons clicked, app launches and versions. It never records portfolio data, the values you type, or your precise location.

On this website, measurement is anonymous: a random identifier is stored in your browser's local storage for up to 13 months so returning visits can be grouped together. Your IP address is never stored in clear — only a one-way hash.

In the web version, once you are signed in, events are linked to your account's email address so a problem can be traced back to a session; the anonymous identifier from this website is carried over when you follow a link to the app.

Events are kept at most 25 months, are used only by the developer to understand how the site and the apps are used, and are never shared with third parties.

You can opt out at any time. Opting out clears the anonymous identifier from this browser and stops all further measurement until you opt back in.

11. Your rights

You can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Write to talu@talucrypt.com from your account's email address; you will get an answer within one month.

Closing your account: this cannot be done from the app yet. Send an email asking for it from your account's address; the account and all its data are deleted within 30 days and you receive a confirmation.

If you think your data is not handled properly, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your own country.

12. Children's privacy

Talu Crypt is not directed at children under the age of 13. Do not create an account on the web version if you are under 13.

13. Changes to this policy

We may update this policy. Changes are published on this page with a new date, and significant changes are announced on the site.

14. Contact

Questions about this policy or about your data: talu@talucrypt.com

An unhandled error has occurred. Reload 🗙