Privacy Policy

FiraCrypto is operated by Fira Software Ltd, registered in England and Wales with company number 07700391, registered office 49 Station Road, Polegate, East Sussex, BN26 6EA, United Kingdom. Fira Software Ltd is the data controller for the personal data described here.

For any privacy question or request, email [email protected].

• Scan inputs: the token contract or wallet addresses and networks you submit. These are public blockchain identifiers, but we treat a wallet address you link to your email or account as personal data.
• ChatGPT plugin checks: if you use FiraCrypto in ChatGPT, ChatGPT sends us the public address and network you ask it to check. We return the result to ChatGPT. We do not receive your full conversation or your ChatGPT account details. We hold a request IP address in temporary server memory for up to one hour to limit abuse; hosting and network providers may also retain short-lived request logs.
• Email and lead details: your email address when you ask us to send scan results or follow up on a token. When you enter it after a free token scan, we email you one summary of that scan and keep a one-way hash of your IP address (never the address itself) to limit how many summaries can be requested.
• Daily scan allowance: to apply the daily scan limits, we count scans against your account ID, or a keyed hash of your IP address and browser that changes every day. Free scans also count against a keyed daily hash of your IP address alone. The hashes cannot be turned back into your IP address, and the counts are deleted after a few days.
• Freeze checks: the wallet address and network you enter in the USDT freeze checker. We send them to a public blockchain RPC provider (PublicNode, dRPC or TronGrid, or the network's own public endpoint) to read the issuer's contract.
• Exchange API keys: if you connect an exchange in your dashboard settings, the key details you enter pass through our server for that one request and are used only to fetch your balances from the exchange you chose. We do not store or log them. Balances you choose to import are saved in your browser's local storage, not on our servers.
• Account data: your email address, sign-in method (email and password, or Google), plan and account settings.
• Watchlist data: the tokens and addresses you save, their labels and the latest risk scores.
• Order details: the report you order, the addresses, exchanges or notes you give us, your email and the payment status. Card details are handled by Stripe and never reach us.
• How you found us: the first referring site, campaign tags and landing page recorded with sign-ups and orders.
• Referral clicks: if you follow a referral link, we record the referral code, a keyed hash of your IP address and your browser type.
• Usage data: request logs kept by our hosting and network providers and, only with your consent, Google Analytics statistics and Google Ads conversion measurement.

• To run the scans and checks you request, and to deliver reports you buy (contract).
• To operate your account, watchlist rescans and email alerts (contract).
• To take payments, manage subscriptions and keep accounting records (contract and legal obligation).
• To send the follow-up you asked for after a scan (consent, which you can withdraw at any time).
• To keep the service secure, prevent abuse and fix faults (legitimate interests).
• To understand how the website is used and which of our adverts lead to sign-ups and orders, only if you allow it in the cookie banner (consent).

We do not sell personal data, and we do not use it for automated decisions with legal or similarly significant effects.

We use these service providers, each only for the purpose shown:

• Vercel: Website hosting and server functions, including short-lived request logs.
• Cloudflare: Proxy and content delivery network in front of the website. It handles every request, including your IP address, to deliver the site and protect it from attacks.
• Supabase: Accounts, sign-in, watchlists, lead and order records. Data is stored in the EU (Frankfurt).
• Stripe: Card payments and subscription billing. Stripe collects your card details directly; we never see or store them.
• Resend: Sending report, order and alert emails.
• GoPlus Security: Receives the token contract or wallet address you submit for a scan, so it can return security data.
• CoinGecko: Provides prices and exchange data. We send it coin and exchange identifiers, not your personal details.
• Public blockchain RPC providers: PublicNode, dRPC and TronGrid, with the networks' own public endpoints as fallbacks, receive the wallet address you enter in the USDT freeze checker, so we can read the issuer's blacklist and the balance on-chain.
• Google Analytics: Website usage statistics, loaded only if you allow it in the cookie banner.
• Google Ads: Conversion measurement only: counting which of our adverts lead to sign-ups and orders. Loaded only if you allow it in the cookie banner, with ad personalisation and remarketing switched off.
• Telegram: Only if you message the FiraCrypto Telegram bot: Telegram processes the messages and we receive your chat ID and the addresses you send.

When you connect an exchange, the API key details you enter are used only to request your balances from that exchange.

Some providers process data outside the UK, including in the United States. Where they do, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or the UK-US data bridge, as applicable.

• Report orders and payment records: 6 years after the order, for UK tax and accounting records.
• Lead emails: until you ask us to delete them, and no longer than 24 months after our last contact.
• Account and watchlist data: while your account is open. When you ask us to close it, we delete it within 30 days, except records we must keep by law.
• Hosting request logs: short-lived, according to our hosting provider's retention.
• Google Analytics data (only with consent): no longer than 14 months.
• Daily scan allowance counts: a few days.

Essential cookies and browser storage keep you signed in, remember your cookie choice, count your free daily scans and hold portfolio entries you add in the dashboard. These are needed for the features you use and do not require consent.

Google Analytics cookies (names starting with _ga) and Google Ads conversion measurement cookies (names starting with _gcl, kept for up to 90 days) are set only if you choose "Allow all" in the cookie banner. We switch off ad personalisation and remarketing for the Google Ads tag. Until you choose, none of these cookies are set and no Google script loads. If you choose "Essential only", we remove any of these cookies already set. You can change your choice at any time.

Under UK data protection law you can ask to access, correct or delete your personal data, restrict or object to our use of it, and receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

Email [email protected] and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Data is sent over HTTPS, secrets stay on the server, and database access is restricted by role. Read more on our security page.

We will update this page when our data handling changes and show the new date at the top. Please also read our terms of service.