Privacy Policy

What we collect

Almost nothing. For a member account: a username, your email address or a passkey (a public key, never a secret), your tier badge and the date it was last checked, and your payment status for the current period, with the address you paid from kept only as the reference that confirms the payment arrived. For an optional invite code: the code.

We do not collect your real name, a photo or a phone number.

Verification and wallets

You verify by signing a free message in each of your wallets; balances across several wallets can be combined. No funds move, no seed phrase is shared and no custody is taken. We read the balances once, assign a Shark or Whale badge, and then delete every verification address, so none is ever linked to your username. We do not retain verification addresses. A periodic re-check repeats the same steps.

Usernames

Your username is a display name only. It must be 3 to 20 letters, numbers or underscores, and cannot be an email address, phone number, @handle or web address, or a name that suggests the team. We ask you not to use anything tied to your real identity. You can change it once every 30 days, and a name you give up is held back from other members for 90 days, so nobody can take it to impersonate you. Until you choose, you have a temporary name like Tribe-4821.

How we use it

To sign you in, give you access to the rooms your badge allows, run membership, keep members safe, and meet legal duties. We do not sell personal data and we do not share it with advertisers.

Crypto Concierge

Anyone can ask Crypto Concierge questions without an account. Crypto Concierge summarises themes across rooms and never reveals an individual member’s posts, holdings or identity. We do not keep Crypto Concierge questions linked to your username.

Payments

Payments are in crypto only (BTC, SOL, ETH, USDT on TRC-20), sent to the company receiving wallet for the coin you choose. Blockchain transactions are public by nature. We keep only the address you paid from, as the reference that confirms the payment arrived, linked to your account for the paid period. We keep no transaction hash and no other payment data. Because that address is stored, pay from a fresh wallet that is not linked to your main holdings. Verification addresses are never stored.

When a payment is confirmed we show a one-time activation link on the screen (we do not yet have your email address). It works once and expires after 15 minutes. You then set up your account with an email and password or a passkey, and your first trusted device is registered.

The free newsletter

The free daily brief by email needs only an email address. We use double opt-in: we send one confirmation email and add you only when you click the link. Every email carries a one-click unsubscribe link, and unsubscribing removes your address. The newsletter covers the free daily brief, reports, Crypto Crime and Wallet Security only: member-room content is never sent by email. Crypto Crime coverage relies on public records only (court and regulator records, sanctions lists and official statements); we name people only when an official record exists and we link it. Subscriber addresses are held in a separate service from member logins, so a subscriber cannot be linked to a username or a tier. Being a member does not subscribe you; a member can opt in separately, with a tickbox that is off by default.

Sign-in, devices and sessions

You sign in with your email address and a password (or an emailed one-time code), or with a passkey. The username is only a display name and is never used to sign in. Your email address is private and is never shown beside your username.

One seat means one active session per account, on at most two trusted devices. To recognise a device we store a hash of a few coarse browser and device signals (never the signals themselves), a coarse label such as “Chrome on macOS”, and the date it was last used. A new device must be confirmed with an emailed code or a passkey. Sessions end after 30 minutes without activity (with a warning at 25 minutes) and after 12 hours at most, whichever comes first. A passkey makes signing back in quick.

Coarse location signals

To spot an account that is being shared or taken over, we compare the approximate location of each sign-in with the previous one. We look up the network address you connect from only to work out a coarse place, at country or city level, then discard the address itself. We keep only that coarse place, a hash of the network prefix and a timestamp. We never show or store IP addresses in plain text, and we do not use them for advertising or profiling.

If two sign-ins imply a journey faster than about 900 km/h (a flight, roughly), or two different countries within 60 minutes, we flag the account. A flag ends all sessions and asks you to re-confirm with a passkey or an emailed code, and adds an entry to a short review queue that our team sees under your display username only: no email address and no network address is shown. A flag never locks you out on its own, and members who use a VPN or travel with a mobile network can be treated more leniently.

Retention and auto-deletion

Device hashes, coarse locations, flags and review entries are deleted automatically after 30 days without use, or sooner when you remove a device or close your account. Anything older is not kept in backups beyond the normal backup cycle. Verification addresses are never stored, as described above.

Cookies and similar technologies

This site sets no cookies and runs no analytics or advertising trackers. The prototype keeps your demo tier choice, and the demo sign-in session, in your browser’s own storage on your device. If we add analytics later, we will ask for your consent first.

Retention and your rights

We keep the minimum data for as long as your membership is active and for a limited period afterwards. You may ask to access, correct or delete your data at any time, and may have further rights under UAE and EU data-protection law.