개인정보 처리방침
최종 업데이트: 19 October 2026 · 운영: Titan Limited
이 문서는 영어로 게시되며, 영어 원문이 구속력 있는 버전입니다.
- Titan Limited is responsible for your personal data. Write to support@cantoncap.cc about anything in this policy.
- You can use CantonCap without an account. We collect what you give us (an account, a profile, posts, articles, questions to the assistant, payments, messages) and what any server records (logs).
- Your posts and published articles are public, and your profile is public unless you choose otherwise. Your portfolio, wallets, votes, alerts and reports are private, and so is your watchlist unless you show it.
- The website counts its visits itself, with no cookie and without keeping your IP address. Google Analytics runs only if you allow it. There is no advertising, no tracking in the app, and we do not sell or share personal data.
- Our providers include Supabase (our database, in Zurich), Vercel, Google, Resend, Stripe, Apple, Expo, Anthropic and Cloudflare.
- You can see, correct, export or delete your data. Deleting your account takes one step, on the website or in the app.
요약은 문서를 읽는 데 도움을 드리기 위한 것입니다. 적용되는 것은 아래의 전문입니다.
This policy explains what personal data Titan Limited (“CantonCap”, “we”, “our” or “us”) collects when you use the CantonCap website, documentation, apps, accounts, community, News, newsletter, assistant and API (the “Services”, as defined in the Terms of Use), why we collect it, who receives it, how long we keep it, and the rights you have over it. It does not cover other companies’ sites and services that the Services link to.
Some features described here, such as card payments and price alerts, are switched on in stages. This policy covers each feature from the moment it is available to you.
1. Who is responsible
The controller of your personal data is Titan Limited, a company incorporated in the British Virgin Islands, company number 2194169 (LEI 529900E9GA8R99VOHV41):
Titan Limited3rd Floor Ritter House, P.O. Box 3189
Tortola VG1110
British Virgin Islands
support@cantoncap.cc
We apply this policy to everyone, and we meet the requirements of the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), the Virgin Islands Data Protection Act, 2021 and the privacy laws of US states wherever they apply to what we do.
We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or the UK GDPR. You, and any supervisory authority, can contact us directly at the address above, in English.
2. How we apply the Virgin Islands Data Protection Act
The Virgin Islands Data Protection Act, 2021 sets seven principles. This policy is how we meet them: we process personal data only with your consent or where it is necessary for a purpose the Act allows (section 3); we tell you what we collect and why, before or when we collect it (this policy); we disclose it only for those purposes and to the recipients in section 6; we protect it (section 13); we keep it no longer than needed (section 8); we keep it accurate and let you correct it; and you can access it (section 10).
3. What we collect, why, and on what basis
For each part of the Services, this section lists the data, what we use it for, and the legal basis the GDPR and the UK GDPR require us to name: “contract” (Article 6(1)(b), we need the data to provide what you asked for), “legitimate interests” (Article 6(1)(f), a reasonable interest of ours that does not override your rights, which you may object to as section 10 describes), “consent” (Article 6(1)(a), which you may withdraw at any time), and “legal obligation” (Article 6(1)(c)).
3.1 Using the website and the app
Our servers record, for each request, the IP address, the address requested, the time, the referring page, the browser’s or the app’s user-agent string and, for the app, its version and language. We use these records to deliver the Services, keep them secure, diagnose faults, block abuse and plan capacity. To limit abuse of our forms, the assistant, the app’s device registration and the announcement counter, we keep a keyed one-way hash of the IP address (and, for forms, of the email address typed in) with a count, never the address itself. We do not use any of this to profile anyone. Legal basis: legitimate interests.
Your theme, your watchlist while you are signed out, your table and chart choices, your assistant choices and conversation, and your consent decision are kept in your own browser or on your own phone, and are not sent to us. The Cookie Policy lists each item.
3.2 Your account
When you open an Account we keep your email address, your sign-in method, the language you were using, the dates you joined and last signed in, your role, and the settings you choose (such as your language, your notification choices and whether you removed the assistant). If you choose a password, it is stored only as a one-way hash by our authentication provider, and we never see it. If you sign in with Google, we receive your name, email address and Google account identifier. If you sign in with Apple, we receive your Apple account identifier, the email address Apple gives us, which may be a private relay address, and any name you choose to share. We also keep the token Apple issues at sign-in, only so that we can revoke your Apple sign-in when you delete your Account, as Apple requires. Our authentication provider logs sign-in events with the IP address and user agent, for security. Legal basis: contract, and legitimate interests for security.
3.3 Your profile and who sees it
A profile carries a username, a display name, and, if you add them, a photo, a short biography and links to a website and to your X, Telegram and LinkedIn accounts. It also shows the month you joined, a team badge for CantonCap staff, and how many members you follow and how many follow you. You choose who sees your profile (anyone, signed-in members only, or only you) and which sections it shows; your watchlist is hidden unless you choose to show it. Your photo, display name and username appear with your posts and articles whatever you choose. A photo is cropped and re-encoded to 512 pixels before it is stored, which removes its embedded metadata, including any location. Legal basis: contract.
3.4 The community
We keep the posts and replies you write, the asset each concerns or mentions, the members you mention, the bullish or bearish lean you may give a first post, when you published and edited them, your reactions, the members you follow, the members you block, your bullish or bearish vote on an asset, and the reports you file with their reason and note. We keep records of moderation decisions: what was hidden, removed, restored or paused, by whom and why. We count each asset’s votes and leans over seven days to draw its sentiment gauge, and the posts of the last day to list the assets most talked about; neither shows who voted or leaned which way. Legal basis: contract, and legitimate interests in keeping the community safe and lawful, which include acting on reports of illegal content.
3.5 News articles
If you write for News, we keep your drafts and articles (title, subtitle, text, cover image, category, topics and the assets they name), when you saved, submitted and published them, and the review history: who on our team accepted or sent back an article, when, and the note they left for you. Published articles are public and offered to search engines, with your name and username as author. We count how often each article is read, per day, without recording who read it. Legal basis: contract, and legitimate interests in reviewing what we publish.
3.6 Your watchlist
Signed out, your watchlist stays on your device. Signed in, we keep the assets you starred and when you starred or removed each one, so that every device you use shows the same list. Your watchlist is private unless you show it on your profile. We publish only the number of members watching an asset (“N watching”), never who they are. Legal basis: contract.
3.7 Portfolio and wallets
If you keep a portfolio, we store the assets, quantities, cost basis and notes you enter. If you add a wallet, we store its network, its address, a one-time challenge and whether your signature verified it; we never receive a private key or a recovery phrase. Both are private to you. Bear in mind that a public blockchain address and its history are visible to anyone on that blockchain, independently of us. Legal basis: contract.
3.8 Notifications, price alerts and devices
Members receive notifications about replies, mentions, reactions, new followers, articles and large moves of assets on their watchlist, in a list on the Site and in the App, and, as they choose in their settings, by push and in an email digest. We keep each notification, the member it concerns, the member whose action caused it, and when it was read, pushed or emailed.
When you set your first price alert in the App, or turn on push notifications as a Member, the App asks your permission to send notifications and registers your device with us. We keep the device’s push token, its platform (iOS or Android), the App’s version and language, and a cryptographic hash of a secret only your device holds; while you are signed in, the device is linked to your Account. For each alert we keep the asset, the direction and the price you set, and when it fired. Alerts belong to the device and work without an Account. You can turn notifications off in your phone’s settings or in your Account settings at any time. Legal basis: contract.
Home-screen widgets read public prices from us and the list you keep in the App. They send nothing about you.
3.9 The assistant
When you ask the assistant a question, your question, the recent turns of the conversation, the kind of page you asked it on, your language and whether you are signed in are sent to Anthropic, which generates the answer. To answer, the assistant may also run web searches and fetch web pages through Anthropic; a search is a query the assistant writes from your question. Your name, email address and IP address are not sent to Anthropic.
We store each question and its answer, with the page, the time, the language, usage figures (such as the length of the answer, the searches it ran and its cost) and either your Account, if you are signed in, or otherwise a keyed one-way hash of your IP address (never the address itself), for up to 30 days, to answer follow-up questions, to prevent abuse and to improve the assistant; then they are deleted automatically. Our staff can read them in that time. Daily totals without any personal data are kept longer. To enforce the limits we also count how many questions were asked, against your Account or the hash. If you hide or remove the assistant, your browser remembers that choice, and so does your Account if you are signed in. Please do not put personal information in your questions. The assistant is not used to make any decision about you. Legal basis: legitimate interests in offering the assistant, improving it and preventing its abuse, and contract for Members.
3.10 Payments and API keys
Card checkout is handled by Stripe Payments Europe, Ltd. and Stripe, Inc. (“Stripe”). Stripe collects your name, email address, billing address, tax identifier where you give one, and payment details. We receive from Stripe your name, email address, billing address, the plan, the amounts, the payment status, invoices and a customer reference, never your full card number. If you are signed in, the purchase is recorded with your Account.
For an API key we keep its identifier, a short hint, its plan, its bounds, its status, its holder and a history of what was done to it; the key’s secret is stored encrypted, and only you can reveal it in your Account. The API records each request with the key that made it, the endpoint, the time and the response code, so that we can apply the plan’s limits, support you and understand which endpoints matter. Legal basis: contract, and legal obligation for accounting records. Stripe acts as an independent controller for the payment itself; its policy is at stripe.com/privacy.
3.11 The newsletter
If you subscribe, we send a confirmation link to the address you entered, and nothing is added to the list until you confirm. Once you confirm, we keep your email address, your language and when you confirmed. We do not track whether you open an issue; we may count clicks on links in it to see which stories are read. Every issue carries a one-click unsubscribe link, and Members can also switch it off in their settings. Legal basis: consent, which you can withdraw at any time.
3.12 Emails, forms and support
We send the emails the Services need, such as sign-in codes, confirmations of a form you sent, receipts and notices about your Account. When you use the contact, support, listing, or venue forms, or write to one of our addresses, we receive what you send: your name, email address, company, the topic, your message, any link you give and any file you attach. Form messages are delivered to our team’s mailboxes, and a copy of each (without attachments) is kept in our database so that our team can track and answer it. Legal basis: legitimate interests in answering you, and contract where you are a customer.
3.13 Announcements
Notices we publish on the website are counted anonymously: how often each was shown, opened, clicked or closed, per day, with no address, Account or device stored with the count. If you choose “Don’t show again” while signed in, your Account remembers it so that the notice stays hidden on every device. Legal basis: legitimate interests.
3.14 Visit statistics, without cookies
The website counts its own visits, so that we know which pages are read, where readers come from and whether signing up and buying work. It sets no cookie for this and stores nothing on your device. As a page loads, your browser tells our server the page’s address, the page that referred you and any campaign tags in the link (such as utm_source). Our server adds the country, region and city our hosting provider derives from your IP address, your device type, browser, operating system and preferred language from the request, and whether you are signed in, never who you are.
To tell one visitor’s pages from another’s, your IP address and browser details are combined with a secret that changes every day into a code that lasts for that day only. The address and the browser details are then discarded, and each day’s secret is deleted when the day ends (UTC), so the code cannot be traced back to you or linked to your visits on other days, by anyone, us included. We also count events on the website: a sign-up, a sign-in, a checkout started, a purchase, a form sent, a tap on an app store link, a link followed off the site, with the plan, sign-in method or form concerned but never with your Account, email address or payment details. Pages of the website that the App opens in its in-app browser are counted the same way and marked as opened from the App; the App itself carries no analytics. A browser that blocks the request is simply not counted. Only our team reads these statistics, and they are kept for up to 25 months. Legal basis: legitimate interests in running, measuring and improving the Services.
3.15 Analytics, if you allow it
If you switch Analytics on in the cookie settings, the website loads Google Analytics 4. It records the pages you view and how you use them, your browser, device type, screen size, the referring page and an approximate location, under a random identifier kept in a cookie. It uses your IP address only to estimate that location and does not store it. Google signals and advertising features are switched off. Until you allow it, Google Analytics does not load and nothing is sent to Google. The App carries no analytics. Legal basis: consent, which you can withdraw at any time in the cookie settings.
3.16 Issuers’ posts from X
Some pages show posts that issuers publish on X. Their images and videos load directly from X’s media servers, which receive your IP address and browser details as for any image on the web. We do not load X’s scripts and X sets no cookie through our pages. X’s own privacy policy applies to what X receives.
3.17 Security, legal claims and compliance
We may use any of the data above to detect and prevent fraud, abuse and security incidents, to enforce our terms, to establish, exercise or defend legal claims, and to comply with the law, including sanctions and requests from authorities that the law obliges us to answer. Legal basis: legitimate interests and legal obligation.
4. What other people can see
| Visible to others | Private to you |
|---|---|
| Your photo, display name and username; your biography, links, month joined, team badge and follow lists, as your profile settings allow; your follower and following counts | Email address, sign-in method, role, settings, payment details, API keys |
| Posts, replies and their lean; published articles; the reaction totals on a post | The reports you file, the members you block, your votes, your drafts and the review notes on them |
| How many members watch an asset; your watchlist, only if you show it | Your portfolio, wallets, alerts, notifications and questions to the assistant |
When you react to a post, follow a member or mention one, that member may be told it was you. Published articles are offered to search engines. Community posts and profiles are not offered to search engines today; we may offer posts later. Anything public can in any case be copied by anyone who reads it.
5. What we do not do
- We do not sell personal data, and we do not share it for advertising, including cross-context behavioural advertising.
- We show no advertising and run no advertising or tracking technology in the App.
- We run Google Analytics only for website visitors who switch it on, with its advertising features off. Our own visit statistics (section 3.14) use no cookie, keep no IP address and name no one.
- We make no decision about you by automated means that has legal or similarly significant effects, and we use neither the assistant nor any other artificial-intelligence system to moderate content or to make decisions about Members. The one automatic step is that a post with three open reports is hidden until a person at CantonCap reviews it.
6. Who receives data
Our service providers process personal data only on our instructions, under written agreements that require them to protect it. They are:
| Provider | What it does for us | Where |
|---|---|---|
| Supabase, Inc. | Accounts and sign-in, our database, profile photos, article and announcement images | Stored in Zurich, Switzerland |
| Vercel Inc. | Hosts the website and the endpoints the App reads; runs our scheduled jobs; server logs | Servers in France, with a global edge network; company in the United States |
| Google Cloud (Google LLC and its affiliates) | Runs the CantonCap API and its request records | Belgium |
| Resend, Inc. | Sends our emails and the newsletter; keeps the newsletter list | Sending in Ireland; company in the United States |
| Google Ireland Limited and Google LLC | Google Analytics with your consent; Sign in with Google; our team’s mailboxes (Google Workspace); Firebase Cloud Messaging, which delivers notifications to Android | European Union and United States |
| Apple | Sign in with Apple; the Apple Push Notification service | Ireland and United States |
| 650 Industries, Inc. (Expo) | Relays notifications to Apple and Google; delivers App updates | United States |
| Anthropic, PBC | Generates the assistant’s answers and runs its web searches | United States |
| Cloudflare, Inc. | Domain name service for cantoncap.cc | Global network |
Stripe, and Google and Apple when you use their sign-in, act as independent controllers for their own services under their own privacy policies; so does X for what its media servers receive. Apart from them, we disclose personal data only to professional advisers bound by confidentiality, to authorities where the law requires it, and to a successor if the Services are transferred, which we will tell you about. Public profile and community content is visible to everyone, as section 4 describes.
7. International transfers
We are established in the British Virgin Islands, and our providers operate in Switzerland, the European Union, the United States and elsewhere. Our database is in Switzerland, which the European Commission and the United Kingdom recognise as offering adequate protection.
Where personal data of people in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that is not recognised as adequate, including the United States and the British Virgin Islands, the transfer relies, depending on the recipient, on the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework where the recipient is certified under it, or on the European Commission’s standard contractual clauses, with the UK International Data Transfer Addendum and the adjustments the FADP requires, or on another mechanism the law recognises, such as a transfer necessary to provide a service you asked for. You may ask us for a copy of the safeguards that apply.
8. How long we keep data
| Data | Kept for |
|---|---|
| Server, sign-in and security logs | Up to 30 days |
| Rate-limit counters (hashed addresses) | Up to 2 days |
| Account, profile, photo and settings | Until you delete your Account |
| Watchlist, portfolio and wallets | Until you remove them or delete your Account |
| Posts, replies, reactions, follows, blocks, votes and your reports | Until you delete or withdraw them or delete your Account; a post others replied to stays as a “deleted” marker without its words |
| Articles, drafts and their review history | Until you delete them or your Account |
| Moderation records | With the post they concern, and deleted with it or with your Account |
| Notifications | 90 days once read, and no more than one year |
| Device and price alerts | Until you delete the alert or it fires; the device until the push service reports it gone |
| Apple sign-in token | Until you delete your Account, when it is revoked |
| Assistant questions and answers | Up to 30 days, then deleted automatically |
| Assistant limit counters | A few days |
| API key records and API request records | Life of the key and 12 months after |
| Orders, payments and invoices | 7 years, as accounting law requires, also after Account deletion |
| Newsletter subscription | Until you unsubscribe; the address then stays on a do-not-send list so we never write again |
| Form messages and correspondence | Up to 2 years after the matter closes |
| Visit statistics (section 3.14) | Up to 25 months; the secret behind each day’s visitor codes is deleted at the end of that day |
| Google Analytics data, where you allowed it | Up to 14 months |
| Database backups | Overwritten within 30 days |
We may keep data longer where the law requires it or where it is needed to establish, exercise or defend a legal claim, and only for as long as that lasts. Counts that name no one, such as daily totals, may be kept longer.
9. Deleting your account
You can delete your Account at any time, in any of three ways:
- on the website, in your Account settings, with Delete Account;
- in the App, on the Account screen, with Delete Account;
- without the website or the App, by writing to support@cantoncap.cc from the email address on your Account, with the subject “Delete my account”. We may ask you to confirm that the Account is yours.
Deletion is immediate and cannot be undone. It removes your profile and photo, your settings, your watchlist, portfolio and wallets, your posts, replies, reactions, votes, follows, blocks and reports, your articles and drafts, your notifications, your questions to the assistant, and your sign-in. If you signed in with Apple, we revoke your Apple sign-in first. Replies that other members wrote under your posts are removed with them. Orders, payments and invoices are kept for as long as accounting law requires, no longer linked to an Account. A phone you used stays registered for its price alerts, no longer linked to an Account, until you delete them or the App. A newsletter subscription is separate: unsubscribe with the link in any issue, or ask us. Backups that still contain your data are overwritten within 30 days.
10. Your rights
Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests, and at any time to processing for direct marketing), to receive it in a portable form, and to withdraw a consent at any time without affecting what was done before.
Much of this you can do yourself: edit your profile and its privacy settings, delete posts and articles, remove stars, delete your Account, unsubscribe from the newsletter, change your notification and cookie settings, and turn notifications off in your phone’s settings. For anything else, write to support@cantoncap.cc, from your Account’s email address if the request is about an Account. We may need to confirm your identity first. We answer within one month, which the law allows us to extend by two months for complex requests, and we do not charge for it.
You also have the right to complain to a data-protection authority, in particular where you live or work: in the European Economic Area, your national supervisory authority; in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner; in the British Virgin Islands, the Information Commissioner appointed under the Data Protection Act, 2021. We would appreciate the chance to resolve your concern first.
11. Notice for residents of US states
If you live in California or another US state with a consumer privacy law, and that law applies to us, this section adds to the rest of the policy. In the last twelve months we have collected these categories of personal information, from you, from your device and from the sign-in and payment providers you choose, for the purposes in section 3: identifiers (such as your name, username, email address, IP address, Account and device identifiers); commercial information (your plans and purchases); internet activity (your use of the Services, our visit statistics, and analytics where you allow it); approximate location derived from your IP address; the content you write and the questions you ask; and account login credentials, which we use only to sign you in.
We disclose these categories only for business purposes, to the service providers in section 6. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have not done so in the last twelve months, so there is nothing to opt out of. We do not knowingly sell or share the personal information of anyone under 16. Subject to your state’s law, you have the right to know what we collect and disclose, to access it, to correct it and to have it deleted, and we will not discriminate against you for exercising these rights. Write to support@cantoncap.cc. You may use an authorised agent, in which case we may ask for proof of the authorisation and confirm your identity with you directly. If we decline a request, you may appeal by replying to our answer, and we will tell you the outcome and how to contact your state’s attorney general.
12. Children
The Services are intended for adults and are not directed at children. You must be 18 or over to open an Account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
13. Security
The Services are served only over encrypted connections. Every table in our database carries row-level rules that decide who may read and change each row, so private data is readable only by the member it belongs to and by the staff who need it. API key secrets are stored encrypted, and device secrets only as hashes. Access to production systems and to our staff console is limited to the people who operate them and requires a company account. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
14. Changes to this policy
We may revise this policy. The date at the top records the current revision. We announce material changes on the Services before they take effect and, to Members, by email. Where a change needs your consent, we ask for it.
15. Contact
For anything about this policy or your personal data:
Titan Limited3rd Floor Ritter House, P.O. Box 3189
Tortola VG1110
British Virgin Islands
support@cantoncap.cc