Privacy notice
Last updated
In short: no accounts, no cookies of our own and no advertising or third-party trackers. We count visits with a code that changes every day, and visit counting does not store your IP address.
Who we are and how to reach us
This notice covers tokenizedstonks.io. The operator of this website decides how the data below is used (the controller). For any privacy question or request, email hello@tokenizedstonks.io.
Counting visits
When you open a page of the app, your browser sends one small message to our server: the page (for example the markets page, or which asset), the website that linked to us (its name only, on the first page you open) and a flag if the browser reports that it is automated. The server adds:
- your country, looked up from your IP address in a DB-IP country database kept on our own server (no outside service is asked);
- a device type: mobile, desktop or bot, worked out from your browser's user agent;
- a visitor code: a shortened SHA-256 hash of your IP address and user agent, mixed with a random secret that changes every day (UTC). The old secret is deleted, so codes cannot be linked across days or turned back into an address.
Visit counting does not store your IP address, your full user agent or the full address of the page that linked to you. These records are used only to count visitors and page views per page, referring site, country and device.
How long: single page-view records and visitor codes are deleted after about 48 hours (a cleanup runs every few minutes). Hourly totals are kept 90 days and daily totals 400 days; totals contain no visitor codes.
Clicks on outbound links
Trade and buy buttons and other outbound actions go through /go/, and only those clicks are recorded. For each click we record the link, the page of our site it was on, the time, your country and whether a referral link was used (and why). The country also decides whether a referral link may be used where you are. No IP address, user agent or identifier is stored, so these records do not identify you; we keep them without a fixed end date for click reports. Other links, including the plain website links of exchanges, issuers, block explorers and data sources, open directly and are not recorded.
The destination of a /go/ link does not receive the address of our page (the links use noreferrer), but a referral link tells it the visit came from us.
Crawlers and AI agents
For requests from bots and other non-browser programs, we count requests per day and keep the name a crawler gives itself (its user agent, including any contact web address it lists) when it identifies itself. Ordinary browsers leave no record here. No IP address or cookie is stored, and neither is the address of the page requested or its query string. Daily counts are kept 400 days, crawler names until 180 days after they were last seen.
Security and server logs
- To share capacity fairly, the server holds your IP address in memory for rate limits. It is not written to disk and is gone when the server restarts.
- Our web server keeps no access log. When the application is briefly unavailable (for example during an update), the web server's error log can record the failed request, including its IP address, page address and browser. The application's own log records operational events (start-up, errors, data jobs), not visitor addresses or pages. The system journal deletes old entries as it fills up.
- Requests to the private administration area, which visitors do not use, are logged with the network part of the IP address (an IPv4 address without its last number) and a code that cannot be turned back into the address, to detect break-in attempts. These entries are kept in the same system journal.
Cloudflare
All traffic passes through Cloudflare, which provides our content delivery, DNS, encryption and protection against attacks and bots. To do that, Cloudflare processes your IP address and request details on our behalf, under its data processing terms, which also cover transfers outside the EU and UK. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) when it checks for bots. See Cloudflare's privacy policy.
Cookies and your browser
- We set no cookies, and there are no accounts or sign-ups for visitors.
- Pages load no third-party scripts, fonts, images or trackers.
- Your browser's local storage keeps the settings you choose (motion, navigation layout, sidebar open or closed), the assets you save to your watchlist and which promotion banners you closed. Session storage, cleared when you close the tab, notes which site versions the tab already reloaded for after an update. These stay in your browser; only when you filter a list to your saved assets are their ids sent with that request, to fetch the list, and they are not stored. You can clear all of this in your browser settings.
Why we may do this (legal basis)
Our legitimate interests (Article 6(1)(f) of the GDPR and UK GDPR): understanding in aggregate how the site is used, keeping it secure and available, reporting on outbound and referral clicks, and applying referral rules by country. We do not use this data for advertising or profiling, do not sell it and do not combine it with other data.
Who receives data
Cloudflare (above), the company that hosts our server, where the records are stored, and the email provider that handles our contact address. Nobody else. Sites you open through our links have their own privacy policies.
Your rights
Under the GDPR and UK GDPR you can ask for access to your data, its correction or deletion, restrict or object to its use, and ask for a copy. Email hello@tokenizedstonks.io. Because we keep no names or accounts, visit counting stores no IP addresses, and visitor codes cannot be traced back once the day ends, we usually cannot find records about one person, but we will help as far as the data allows. If you write to us, we use your email only to answer you and delete the conversation once it is no longer needed. You can also complain to your data protection authority.
Changes
We update this notice when what we record changes. The date at the top shows the latest version.