Skip to content
TidePerp
Checking sources……

Privacy policy

Effective 7 November 2026. TidePerp stores the minimum needed to run accounts, alerts and rate limits.

Visitors without an account

Public pages and the public API need no account. The API enforces rate limits per network address; the web server forwards your address to the API for that purpose only. Server logs keep request identifiers, paths, status codes and timings for operations and are rotated.

Account holders

  • Email address and a password hash (Argon2id). Passwords are never stored or logged in clear.
  • Session records: a hash of the session token, creation and expiry times, a hash of the address and the user agent string, used to let you revoke sessions.
  • Sign-in attempts (hashed email and address, success flag) for 15 minutes, to throttle credential guessing.
  • Watchlists, alerts, saved research, notification channels and preferences you create.
  • API keys as a prefix plus a peppered hash; the full key is shown once and cannot be recovered. Usage counts per endpoint are kept for 90 days for your usage page and for abuse prevention.
  • Notification history: what was sent, where and whether delivery succeeded.

Cookies

One first-party, HttpOnly session cookie (tp_session) after you sign in. No advertising or cross-site tracking cookies. No third-party analytics scripts run in the terminal.

Third parties

Email alerts are delivered through a transactional email provider that receives your address and the message. Webhook, Discord and Telegram alerts go to the destinations you configure. Market data comes from exchange and chain endpoints; those operators see the platform’s requests, not yours.

Retention and deletion

Account data is kept while the account exists. Deleting your account from Settings removes personal data and revokes keys and sessions; aggregated, non-identifying usage statistics may be retained. Market and chain observations are not personal data.

Your rights and contact

You can view and change your data in Settings and export it through the API with your own key. For access, correction or deletion requests, use the contact address published on the deployment’s status page or repository.