Privacy Policy

Effective Date: June 21, 2026 Last Updated: June 21, 2026

TokenBot ("we," "us," "our") operates the TokenBot platform (the "Platform") — a command-line ("CLI") tool, supporting websites at tokenbot.com, and the backend services that power them. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform and related services.

1. Information We Collect

1.1 Information You Provide

Identity & Account Information: When you run tokenbot init, the CLI generates a cryptographic keypair and registers your public key with us, typically alongside an email address and a label. Your private key never leaves your device — it is encrypted locally with a passphrase that we never receive. If you use account-management features that require a password, that password is handled by our authentication service; we never store it in plaintext.
Identity Verification: Where required, government-issued identification, proof of address, date of birth, and other documents for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance.
Financial Information: Cryptocurrency wallet addresses, exchange API keys, trading preferences, and portfolio data. Exchange API keys follow a hybrid model — see Section 5.2.
Communications: Support requests, feedback, and any other content you send to us.

1.2 Information Collected Automatically

CLI & API Usage: When the CLI or an integration makes signed requests to our backend, we log request metadata (such as your public key, timestamps, operations performed, and error events) to operate and secure the service.
Website Usage Data (websites only): For our websites (e.g. the marketing site, status page, and documentation), pages visited, features used, and session information.
Device Information: IP address; for website visits, also browser type and version and operating system.
Log Data: Server logs including access times, error logs, and referral URLs.
Cookies & Tracking (websites only): Information collected via cookies and similar technologies on our websites (see our Cookie Policy). The CLI does not use cookies.

1.3 Information From Third Parties

Cryptocurrency Exchanges: Trading data, balances, and transaction history obtained through exchange API connections you authorize.
Blockchain Data: Publicly available on-chain transaction data associated with wallet addresses you connect.
Analytics Providers: Aggregated usage and performance data from third-party analytics services.

2. How We Use Your Information

We use the information we collect to:

Provide Services: Operate the Platform, synchronize and execute trades across your connected exchange accounts, run automated trading and market-making engines you enable, manage your account, and deliver the TBOT token ecosystem features.
Replicate Trades: Execute trades on your Copier accounts based on activity in your Strategy account, and compute the performance metrics you request.
Verify Identity: Conduct KYC/AML checks where required by applicable regulations.
Improve the Platform: Analyze usage patterns, diagnose technical issues, and develop new features.
Communicate: Send service updates, security alerts, trading notifications, and (with your consent) marketing communications.
Ensure Security: Detect and prevent fraud, unauthorized access, and other malicious activity.
Comply with Law: Meet legal obligations, respond to lawful requests, and enforce our Terms & Conditions.

3. Legal Basis for Processing

Where applicable (e.g., under GDPR), we process your personal data on the following bases:

Basis

Examples

Contract Performance

Operating your account, executing and replicating trades, processing transactions

Legal Obligation

KYC/AML verification, tax reporting, responding to regulatory requests

Legitimate Interest

Platform security, fraud prevention, analytics, product improvement

Consent

Marketing emails, optional cookies, sharing your trading profile publicly

You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell your personal data. We may share information with:

Service Providers: Cloud hosting, analytics, KYC verification, customer support, and email delivery providers who process data on our behalf under strict contractual obligations.
Cryptocurrency Exchanges: Only the API credentials and trade instructions necessary to execute trades on exchanges you have connected (and only for accounts you register server-side — see Section 5.2).
Other Users: If you mark a strategy as public, limited, non-sensitive metadata about that strategy may be visible to other Platform users. TokenBot is not a social copy-trading marketplace.
Legal & Regulatory: Law enforcement, regulators, or government authorities when required by law or to protect our legal rights.
Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

5. Cryptocurrency & Blockchain Data

5.1 On-Chain Transparency

Blockchain transactions are publicly visible and immutable. When you execute trades through TokenBot, the resulting on-chain transactions are permanently recorded on the relevant blockchain and cannot be deleted or modified by us.

5.2 API Key Security

Exchange API keys follow a hybrid model:

Local keys added with tokenbot keys add are encrypted and stored only on your own device (~/.tokenbot/keys.json). They are never transmitted to us and are used solely by local commands on your machine.
Server-side keys that you register with tokenbot exchange add are sent to us only when you choose to enable server-side automation. They are encrypted at rest (in AWS Secrets Manager) and in transit, and are used only by the automated engines you enable.

We use read-only and trade-only API permissions where possible and never request withdrawal permissions.

5.3 TBOT Token

If you interact with the TBOT token, your wallet address and transaction history on the relevant blockchain are publicly accessible. TokenBot does not control or have the ability to alter blockchain records.

6. Data Retention

We retain your personal data for as long as necessary to:

Maintain your active account and provide services.
Comply with legal, regulatory, and tax obligations (typically 5–7 years after account closure).
Resolve disputes and enforce agreements.

After the applicable retention period, data is securely deleted or anonymized. Blockchain data cannot be deleted due to the immutable nature of distributed ledgers.

7. Data Security

We implement industry-standard security measures including:

Request signing: CLI and integration requests are authenticated with a per-user secp256k1 keypair; each request is signed and protected against replay.
Encryption at rest: AES-256 for data at rest; server-side exchange credentials are stored in AWS Secrets Manager.
Encryption in transit: TLS 1.2+ for data in transit.
Local encryption: Your CLI private key and any locally stored exchange keys are encrypted on your device using scrypt-derived keys and authenticated encryption (NaCl secretbox / XSalsa20-Poly1305).
Account protection: Multi-factor authentication (MFA) support for account-management features.
Regular security reviews and penetration testing.
Role-based access controls and least-privilege principles.

No system is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable measures.

7.1 Local Data (`~/.tokenbot`)

The CLI stores your encrypted identity and (optionally) your encrypted exchange keys on your own device under ~/.tokenbot. This data stays on your machine; you can remove it at any time with tokenbot logout. Because your passphrase is never sent to us, we cannot recover it for you — keep it safe.

8. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence. When we transfer data internationally, we ensure adequate protection through:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Adequacy decisions where applicable.
Other legally recognized transfer mechanisms.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

Right

Description

Access

Request a copy of the personal data we hold about you

Rectification

Correct inaccurate or incomplete data

Erasure

Request deletion of your data (subject to legal retention requirements)

Restriction

Limit how we process your data

Portability

Receive your data in a structured, machine-readable format

Objection

Object to processing based on legitimate interests

Withdraw Consent

Revoke previously given consent at any time

To exercise your rights, contact us at privacy@tokenbot.com. We will respond within 30 days (or as required by applicable law).

10. Children's Privacy

TokenBot is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

11. Third-Party Links

The Platform may contain links to third-party websites, exchanges, or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

A prominent notice on the Platform.
Email notification to registered users.

Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related inquiries or to exercise your data rights:

Email: privacy@tokenbot.com
General Legal: legal@tokenbot.com
Website: tokenbot.com

PreviousOverview NextTerms & Conditions

Last updated 1 month ago

Was this helpful?

Table of Contents