> For the complete documentation index, see [llms.txt](https://docs.tokenbot.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tokenbot.com/home/legal-information/privacy-policy.md). # Privacy Policy **Effective Date:** June 21, 2026 **Last Updated:** June 21, 2026 TokenBot ("we," "us," "our") operates the TokenBot platform (the "Platform") — a command-line ("CLI") tool, supporting websites at [tokenbot.com](https://tokenbot.com), and the backend services that power them. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform and related services. *** ## Table of Contents 1. [Information We Collect](#1-information-we-collect) 2. [How We Use Your Information](#2-how-we-use-your-information) 3. [Legal Basis for Processing](#3-legal-basis-for-processing) 4. [Sharing of Information](#4-sharing-of-information) 5. [Cryptocurrency & Blockchain Data](#5-cryptocurrency--blockchain-data) 6. [Data Retention](#6-data-retention) 7. [Data Security](#7-data-security) 8. [International Data Transfers](#8-international-data-transfers) 9. [Your Rights](#9-your-rights) 10. [Children's Privacy](#10-childrens-privacy) 11. [Third-Party Links](#11-third-party-links) 12. [Changes to This Policy](#12-changes-to-this-policy) 13. [Contact Us](#13-contact-us) *** ## 1. Information We Collect ### 1.1 Information You Provide * **Identity & Account Information:** When you run `tokenbot init`, the CLI generates a cryptographic keypair and registers your **public key** with us, typically alongside an **email address** and a label. Your **private key never leaves your device** — it is encrypted locally with a passphrase that we never receive. If you use account-management features that require a password, that password is handled by our authentication service; we never store it in plaintext. * **Identity Verification:** Where required, government-issued identification, proof of address, date of birth, and other documents for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance. * **Financial Information:** Cryptocurrency wallet addresses, exchange API keys, trading preferences, and portfolio data. Exchange API keys follow a hybrid model — see [Section 5.2](#52-api-key-security). * **Communications:** Support requests, feedback, and any other content you send to us. ### 1.2 Information Collected Automatically * **CLI & API Usage:** When the CLI or an integration makes signed requests to our backend, we log request metadata (such as your public key, timestamps, operations performed, and error events) to operate and secure the service. * **Website Usage Data (websites only):** For our websites (e.g. the marketing site, status page, and documentation), pages visited, features used, and session information. * **Device Information:** IP address; for website visits, also browser type and version and operating system. * **Log Data:** Server logs including access times, error logs, and referral URLs. * **Cookies & Tracking (websites only):** Information collected via cookies and similar technologies on our **websites** (see our [Cookie Policy](/home/legal-information/cookie-policy.md)). The CLI does not use cookies. ### 1.3 Information From Third Parties * **Cryptocurrency Exchanges:** Trading data, balances, and transaction history obtained through exchange API connections you authorize. * **Blockchain Data:** Publicly available on-chain transaction data associated with wallet addresses you connect. * **Analytics Providers:** Aggregated usage and performance data from third-party analytics services. *** ## 2. How We Use Your Information We use the information we collect to: * **Provide Services:** Operate the Platform, synchronize and execute trades across your connected exchange accounts, run automated trading and market-making engines you enable, manage your account, and deliver the TBOT token ecosystem features. * **Replicate Trades:** Execute trades on your Copier accounts based on activity in your Strategy account, and compute the performance metrics you request. * **Verify Identity:** Conduct KYC/AML checks where required by applicable regulations. * **Improve the Platform:** Analyze usage patterns, diagnose technical issues, and develop new features. * **Communicate:** Send service updates, security alerts, trading notifications, and (with your consent) marketing communications. * **Ensure Security:** Detect and prevent fraud, unauthorized access, and other malicious activity. * **Comply with Law:** Meet legal obligations, respond to lawful requests, and enforce our Terms & Conditions. *** ## 3. Legal Basis for Processing Where applicable (e.g., under GDPR), we process your personal data on the following bases: | Basis | Examples | | ------------------------ | --------------------------------------------------------------------------------- | | **Contract Performance** | Operating your account, executing and replicating trades, processing transactions | | **Legal Obligation** | KYC/AML verification, tax reporting, responding to regulatory requests | | **Legitimate Interest** | Platform security, fraud prevention, analytics, product improvement | | **Consent** | Marketing emails, optional cookies, sharing your trading profile publicly | You may withdraw consent at any time without affecting the lawfulness of prior processing. *** ## 4. Sharing of Information We do **not** sell your personal data. We may share information with: * **Service Providers:** Cloud hosting, analytics, KYC verification, customer support, and email delivery providers who process data on our behalf under strict contractual obligations. * **Cryptocurrency Exchanges:** Only the API credentials and trade instructions necessary to execute trades on exchanges you have connected (and only for accounts you register server-side — see [Section 5.2](#52-api-key-security)). * **Other Users:** If you mark a strategy as public, limited, non-sensitive metadata about that strategy may be visible to other Platform users. TokenBot is not a social copy-trading marketplace. * **Legal & Regulatory:** Law enforcement, regulators, or government authorities when required by law or to protect our legal rights. * **Business Transfers:** In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. *** ## 5. Cryptocurrency & Blockchain Data ### 5.1 On-Chain Transparency Blockchain transactions are publicly visible and immutable. When you execute trades through TokenBot, the resulting on-chain transactions are permanently recorded on the relevant blockchain and cannot be deleted or modified by us. ### 5.2 API Key Security Exchange API keys follow a **hybrid model**: * **Local keys** added with `tokenbot keys add` are encrypted and stored only on your own device (`~/.tokenbot/keys.json`). They are **never transmitted to us** and are used solely by local commands on your machine. * **Server-side keys** that you register with `tokenbot exchange add` are sent to us only when you choose to enable server-side automation. They are encrypted at rest (in AWS Secrets Manager) and in transit, and are used only by the automated engines you enable. We use read-only and trade-only API permissions where possible and never request withdrawal permissions. ### 5.3 TBOT Token If you interact with the TBOT token, your wallet address and transaction history on the relevant blockchain are publicly accessible. TokenBot does not control or have the ability to alter blockchain records. *** ## 6. Data Retention We retain your personal data for as long as necessary to: * Maintain your active account and provide services. * Comply with legal, regulatory, and tax obligations (typically 5–7 years after account closure). * Resolve disputes and enforce agreements. After the applicable retention period, data is securely deleted or anonymized. Blockchain data cannot be deleted due to the immutable nature of distributed ledgers. *** ## 7. Data Security We implement industry-standard security measures including: * **Request signing:** CLI and integration requests are authenticated with a per-user secp256k1 keypair; each request is signed and protected against replay. * **Encryption at rest:** AES-256 for data at rest; server-side exchange credentials are stored in AWS Secrets Manager. * **Encryption in transit:** TLS 1.2+ for data in transit. * **Local encryption:** Your CLI private key and any locally stored exchange keys are encrypted on your device using scrypt-derived keys and authenticated encryption (NaCl secretbox / XSalsa20-Poly1305). * **Account protection:** Multi-factor authentication (MFA) support for account-management features. * Regular security reviews and penetration testing. * Role-based access controls and least-privilege principles. No system is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable measures. ### 7.1 Local Data (`~/.tokenbot`) The CLI stores your encrypted identity and (optionally) your encrypted exchange keys on your own device under `~/.tokenbot`. This data stays on your machine; you can remove it at any time with `tokenbot logout`. Because your passphrase is never sent to us, **we cannot recover it for you** — keep it safe. *** ## 8. International Data Transfers Your data may be processed in jurisdictions outside your country of residence. When we transfer data internationally, we ensure adequate protection through: * Standard Contractual Clauses (SCCs) approved by the European Commission. * Adequacy decisions where applicable. * Other legally recognized transfer mechanisms. *** ## 9. Your Rights Depending on your jurisdiction, you may have the right to: | Right | Description | | -------------------- | ----------------------------------------------------------------------- | | **Access** | Request a copy of the personal data we hold about you | | **Rectification** | Correct inaccurate or incomplete data | | **Erasure** | Request deletion of your data (subject to legal retention requirements) | | **Restriction** | Limit how we process your data | | **Portability** | Receive your data in a structured, machine-readable format | | **Objection** | Object to processing based on legitimate interests | | **Withdraw Consent** | Revoke previously given consent at any time | To exercise your rights, contact us at ****. We will respond within 30 days (or as required by applicable law). *** ## 10. Children's Privacy TokenBot is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately. *** ## 11. Third-Party Links The Platform may contain links to third-party websites, exchanges, or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data. *** ## 12. Changes to This Policy We may update this Privacy Policy from time to time. Material changes will be communicated via: * A prominent notice on the Platform. * Email notification to registered users. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy. *** ## 13. Contact Us For privacy-related inquiries or to exercise your data rights: * **Email:** * **General Legal:** * **Website:** [tokenbot.com](https://tokenbot.com) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.tokenbot.com/home/legal-information/privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.