Privacy policy
Last updated:
What personal data sportfitracker.com processes, why, on what legal basis, who receives it, how long it is kept and how to exercise your rights.
1. Controller
The controller is Hitbox Agency, SAS, 60 rue François 1er, 75008 Paris, France (RCS Paris 999 796 238), represented by its President, Clément Guérin. Privacy contact: [email protected].
This policy applies under Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 (Informatique et Libertés). An account is optional and needs only an email address and a password; the site never asks for your name, postal address, payment details or private keys; a public wallet address is needed only if you choose to import one.
2. What we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the site and keeping it secure (content delivery, protection against abuse and attacks, error diagnosis) | IP address, date and time, requested address, referring page, browser user agent | Legitimate interest in running a secure site (art. 6(1)(f) GDPR) | Server logs: 6 months at most. Cloudflare logs: according to Cloudflare's own retention periods. |
| Rate limiting of the public data endpoints, the chat, and the sign-in and account endpoints | IP address | Legitimate interest in keeping the service available for everyone (art. 6(1)(f)) | Held in server memory only, for the current window (1 minute for data and account endpoints, 5 minutes for the chat, 10 minutes for account creation), never written to disk |
| User account (optional): creating it, signing you in and keeping you signed in | Email address, password hash (never the password itself), creation and update dates; for each signed-in device: a random session token, the IP address and browser user agent, the expiry date | Performance of the contract, the terms of your account (art. 6(1)(b) GDPR); legitimate interest in securing accounts for the session IP address and user agent (art. 6(1)(f)) | Account data: until you delete your account. Sessions: until you sign out, or 30 days after your last visit at most, then deleted within a day. |
| Watchlist, price alerts and notifications, with an account | The tokens you star; each alert (token, condition, value, when it fired and at what value); the in-app notifications it creates | Performance of the contract (art. 6(1)(b)) | Until you delete them or your account |
| Manual portfolio, with an account | The holdings you enter (token, quantity, optional average cost and note) and the transactions you choose to log (type, date, quantity, optional price) | Performance of the contract (art. 6(1)(b)) | Until you delete them or your account |
| Wallet import, with an account (optional, read-only) | The public Chiliz Chain address you paste, the date of its last sync, and the holdings read from it (token and quantity) | Performance of the contract (art. 6(1)(b)) | Address: until you remove the wallet on the Portfolio page or delete your account. Balances read from the explorer: held in server memory for 5 minutes, never written to disk. |
| Watchlist without an account | The tokens you star, stored only in your browser (local storage) | Legitimate interest in providing the feature you use (art. 6(1)(f)); the list does not reach us until you sign in | Until you clear your browser data; when you sign in, it moves to your account and leaves the browser |
| Answering your questions in the Ask SportFi chat | The questions you type and the conversation shown in the chat window (up to 12 messages), the page language | Legitimate interest in answering the question you ask (art. 6(1)(f)) | Not stored by us. The conversation stays in your browser tab until you close or reload it. |
| Audience measurement and product analytics (PostHog), only if you accept | A random identifier stored in a cookie and in local storage, pages viewed, referring page, clicks and other interactions, browser and device type, screen size, approximate location (country, city) derived from the IP address, JavaScript errors | Your consent (art. 6(1)(a) GDPR and art. 82 of the Informatique et Libertés law) | Identifier: 12 months on your device. Events: 12 months. |
| Remembering your cookie choice | Your choice (accepted or refused), the banner version and the date | Legal obligation to be able to prove consent (art. 6(1)(c) and art. 7(1) GDPR) | 6 months, in a cookie on your device |
| Newsletter | Email address, language of the page you signed up from, sign-up date, subscription status, confirmation and unsubscribe dates | Your consent (art. 6(1)(a) GDPR and art. L.34-5 of the French Postal and Electronic Communications Code) | Until you unsubscribe, then kept only as unsubscribed so that we never write to you again (see section 5). Unconfirmed addresses: deleted after 30 days. |
| Answering your messages and requests to exercise your rights | Email address, content of the message, any identity information you choose to send | Legitimate interest (art. 6(1)(f)); legal obligation for rights requests (art. 6(1)(c)) | 3 years after our last exchange; rights requests 5 years, as proof of our answer |
We do not sell personal data, do not build advertising profiles and make no automated decision with legal or similarly significant effects about you. If your browser sends a Do Not Track signal, PostHog analytics does not run, whatever your cookie choice.
3. The Ask SportFi chat
When you ask a question, our server sends your question, the earlier messages of the conversation shown in the chat window, the page language and extracts of our own market data to Cloudflare Workers AI, a service of Cloudflare, Inc., which generates the answer. The request is sent by our server: Cloudflare Workers AI does not receive your IP address from us.
We do not record conversations on our server. Cloudflare states that it does not use Workers AI content to train models or to improve its services, and does not store it unless the customer uses a Cloudflare storage service with it, which we do not. Please do not type personal information into the chat.
4. Your account
An account is optional: every page of the site works without one. With an account, your watchlist, price alerts and portfolio are kept on our server so that you find them on every device. Our server checks active alerts against the latest prices every 5 minutes; a triggered alert creates a notification shown on the site only, then pauses until you re-arm it.
The portfolio holds the numbers you type and, if you choose, the balances of a public Chiliz Chain address you import. The site shows it to you alone. We value it with our own latest prices. You can download it as a CSV file at any time from the Portfolio page.
If you import a wallet, the lookup is read-only: we never ask for a private key, a recovery phrase or a signature, and nothing on the site can move your tokens. Our server sends the address, and nothing else about you (not your IP address), to the public Chiliz Chain explorer (scan-api.chiliz.com, run by Chiliz), which returns its balances. Saving the address links it to your account; since a blockchain address is public, anyone who knows it can see its balances and history on the explorer, so we never show it to anyone but you. Removing the wallet on the Portfolio page deletes the address at once; the holdings read from it stay, as manual ones you can edit or delete.
We send no email to account holders: there is no email verification and no password reset by email yet. We will update this policy before that changes.
You can change your password or delete your account at any time from the Account page. Deleting it erases your account, sessions, watchlist, alerts, notifications, portfolio and imported wallet address from our database at once. If you can no longer sign in, write to [email protected] from the address of the account and we will delete it.
6. Recipients and processors
Your data is accessed only by Hitbox Agency and by the following service providers, acting as processors on our instructions (art. 28 GDPR):
| Provider | Role | Where the data is |
|---|---|---|
| Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Server hosting (website, database and server logs) | Frankfurt, Germany |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States | Content delivery network, DNS, security, and answers of the Ask SportFi chat (Workers AI) | Global network, which may include the United States |
| PostHog Inc., United States (PostHog EU Cloud) | Audience measurement and product analytics, only if you accept | Frankfurt, Germany |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States | Sending emails, and the newsletter contact list | EU region (Ireland); provider established in the United States |
| Google (Google Workspace) | Mailbox of [email protected] | Google data centres |
When you import a wallet, our server sends the public address to the Chiliz Chain explorer, a public service run by Chiliz that is not our processor (see section 4).
We may also disclose data to public authorities when the law requires it.
7. Transfers outside the European Union
Cloudflare, Inc., PostHog Inc. and Plus Five Five, Inc. (Resend) are established in the United States. All three are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection on 10 July 2023 (art. 45 GDPR). As a fallback, all three rely on the European Commission's Standard Contractual Clauses (art. 46 GDPR). PostHog analytics data is stored in Frankfurt; a transfer can occur only through remote access, covered by the same safeguards. Resend sends our emails from its EU region in Ireland; as a provider established in the United States, it may access or hold the data there, under the same safeguards.
8. Your rights
- Access to your data and a copy of it
- Rectification of inaccurate data
- Erasure
- Restriction of processing
- Portability of the data you gave us on the basis of your consent or of our contract (account, watchlist, alerts, portfolio and imported wallet address)
- Objection, at any time, to processing based on our legitimate interest
- Withdrawal of your consent at any time, without affecting processing done before: use "Cookie settings" at the bottom of every page for analytics, and the unsubscribe link in every email for the newsletter
- Instructions on what happens to your data after your death (art. 85 of the Informatique et Libertés law)
Write to [email protected] or to our postal address above. We answer within one month; this can be extended by two months for complex requests, in which case we tell you. We ask for proof of identity only if we have a reasonable doubt about it.
If you believe your rights are not respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr/fr/plaintes — or with the supervisory authority of your EU country of residence.
9. Minors
The site deals with crypto-assets and is not intended for people under 18. We do not knowingly collect data about minors; if you believe a minor has sent us personal data, write to us and we will delete it.
10. Security
Traffic is encrypted (HTTPS). Access to the server and to the analytics tool is limited to authorised people with individual accounts. Secrets are kept out of the source code. Passwords are stored only as a salted hash (scrypt). Session cookies are HttpOnly, Secure and SameSite=Lax, and sign-in attempts are rate-limited.
11. Changes
We will update this policy before introducing any new processing, for example emails to account holders, sign-in with another service or affiliate links, and show the date of the last update at the top of this page.