Privacy Policy

This Privacy Policy explains what personal data Plumbline (the website at plumbline.watch, its dashboard, and its Telegram alert service — the "Platform"), operated by the developer of Plumbline ("we", "us"), collects, why, and your choices. It forms part of, and uses the same definitions as, our Terms of Service. The Platform is not offered to persons in the Excluded Jurisdictions (the USA, UK, and EU/EEA, and sanctioned persons — see the Terms).

We take a data-minimal approach: we collect only what is needed to run the Platform, we do not sell personal data, and we use no third-party advertising or analytics trackers.

1 · Who we are

The Platform is operated by the developer of Plumbline. For any privacy request, contact us at the address in Section 11. (The operator's legal identity will be updated here if and when the project is incorporated.)

2 · What we collect

• Email address — required for Free access: Free access is issued one per email address, and the code is shown on the signup page and optionally emailed to you. We store a salted hash of your email (to check "one Free signup per address" without keeping it in plain text for that check) and, separately, an encrypted copy (so support can look up which address a code belongs to if you need help) — we do not store your email in plain text anywhere.
• Telegram chat ID & alert preferences (Pro) — if you subscribe to Pro and enable alerts, so the bot can message you with the levels you chose (e.g. "Red only" / "Yellow + Red").
• Pro purchase data (planned) — Plumbline does not yet offer a paid Pro tier. Once it does, paying for Pro will involve an on-chain payment transaction (which is public on the blockchain) and a License Key we issue, to activate and verify access; this Privacy Policy will apply to that data the same way it applies to Free access today.
• Acceptance record — when you accept the Terms / confirm you are not an Excluded Person, we record the fact, the version of the Terms, and a timestamp.
• Technical & security data — IP address, browser user-agent, and a dashboard access credential (session cookie), used to serve the site, keep it secure, prevent abuse, and apply the jurisdictional access restrictions in the Terms; and an anonymized device/session identifier, used to apply the device limit on your account (one (1) device on Free, up to five (5) on Pro). See Section 8 for how long this is kept.
• Interface settings — your own preferences (e.g. sort order, manual-vs- auto refresh) — stored only in your browser (see Section 5).
• Basic usage events — we record first-party events on our own server (for example, that a Free sign-up or a Telegram subscription happened, with a timestamp and, if the page you were on carried a campaign link, the campaign tag from that page's own address). Nothing is stored on your device for this — see Section 5. These events are not linked to your IP address, browser, or identity, and no third-party analytics or advertising service is involved.

What we do NOT collect or do: we do not connect to, control, or custody your wallet or funds; we do not ask for your name, address, or government ID; we do not run third-party ad/analytics trackers; and we do not sell or rent your personal data to anyone.

3 · Why we use it (purposes)

• to operate the Platform and show you risk signals;
• to deliver the Pro Telegram alerts you subscribed to;
• to issue and verify Free access, and (once launched) Pro access and License Keys;
• to secure the Platform, prevent abuse, and debug problems;
• to apply our access restrictions and comply with sanctions and other legal obligations;
• to keep a record that you accepted the Terms;
• to understand, in aggregate, which campaigns bring visitors who actually sign up or subscribe — not to identify you individually.

4 · On-chain payments are public (planned)

Once the Pro tier launches, Pro will be paid on-chain. Blockchain transactions are public, permanent, and outside our control: the paying address, amount, and time are visible to anyone, and we cannot edit or delete on-chain records. When you pay for Pro and give us an email for your License Key, we may be able to associate that payment with your email/Key. Consider this before paying from an address you wish to keep unlinked.

5 · Cookies & local storage

Everything the Platform stores in your browser falls into two categories:

• Strictly-necessary cookies. A session_id cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax, kept up to 30 days — see Section 8), and, for the operator only, a separate admin_tok cookie scoped to the admin area (HttpOnly, Secure, SameSite=Strict, 8-hour lifetime). Neither is readable by JavaScript, carries tracking, or is shared with third parties.
• Functional local storage. Your own display choices (e.g. manual-vs-auto refresh) and the Telegram chat ID you type into the subscribe form, kept only in your browser so the interface remembers how you left it.

We do not store anything on your device for campaign attribution or analytics. If a sign-up or Telegram subscription is credited to a marketing campaign, that is read by our server, at that moment, from the campaign tag already present in the address of the page you were on when you acted (the standard "Referer" information a browser sends with every request) — nothing is written to your browser for this, and if the page you acted from had no campaign tag in its own address, the event is simply recorded with no campaign attached.

We do not place any third-party cookies, and we run no third-party analytics or advertising trackers. Because everything above is either strictly necessary or stored only at your own request (your interface preferences), and the Platform already excludes EU/EEA/UK visitors under the Terms, we do not display a cookie-consent banner. You can clear any of this at any time in your browser settings: clearing local storage resets your display preferences, and clearing cookies signs you out.

6 · Who we share it with

We do not sell your data. We share the minimum necessary with the service providers that make the Platform work, who process it on our behalf or as independent controllers under their own policies:

• Telegram — to deliver alerts (your interaction with the bot is also governed by Telegram's own privacy policy);
• Resend — to email your Free access code, if you ask us to email it;
• Render — our hosting / infrastructure provider, which runs the website and database (see Section 7);
• Blockchain data & RPC providers — e.g. the public RPC, indexer, and market-data services the Platform reads from (these receive technical request data, not your identity).

We may also disclose data where required by law, to comply with sanctions, or to protect the Platform's or others' rights and security.

7 · Where your data is processed

The Platform's website and database are hosted with Render, in its Frankfurt, Germany region, and the operator is based outside the Excluded Jurisdictions. By using the Platform you understand your data may be processed in the locations where those providers operate. (Hosting infrastructure being located in the EU does not change who may use the Platform — see the Terms' Excluded Jurisdictions.)

8 · How long we keep it

• Telegram chat ID & preferences — until you unsubscribe (or ask us to delete them), plus a short period to action the removal.
• Email & License Key — for as long as your access is active, and a reasonable period afterwards for records and support.
• Acceptance records — kept as long as needed to evidence your agreement to the Terms.
• Technical/security data (incl. IP) — a dashboard session is deleted once it has been idle for 30 days (the same window as the session cookie's own lifetime); IP/user-agent data recorded at Free signup is cleared 30 days after signup.
• Usage events & campaign attribution — kept indefinitely in aggregate (event name, timestamp, campaign tag if any) for funnel reporting; never linked to your IP, browser, or identity in the first place (Section 2), so there is nothing to re-identify later.
• On-chain payment data — permanent on the blockchain and outside our control (Section 4).

9 · Your choices & rights

• Alerts: you can unsubscribe at any time via the bot; this stops messages and lets us remove your chat ID.
• Access / correction / deletion: contact us (Section 11) and we will action reasonable requests about the data we hold, subject to records we must keep and to data that cannot be deleted (on-chain records — Section 4).
• Where mandatory data-protection law gives you additional rights despite the Platform not being offered in your jurisdiction, we will honour those that apply.

We will not discriminate against you for exercising any of these choices.

10 · Security & children

We apply reasonable technical measures to protect the Platform and the limited data we hold, but no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for safeguarding your own Telegram account and your access code/License Key.

The Platform is not intended for anyone under 18, and we do not knowingly collect data from minors.

11 · Contact & changes

Questions or privacy requests: stabletabledefi@gmail.com · X: @stabletabledefi

We may update this Privacy Policy from time to time; changes take effect when posted, with an updated "Last updated" date above. Material changes will be indicated by updating that date.