Privacy Policy

BitMe is operated by the BitMe Team. For any question about this policy or to exercise your rights, contact us at contact@bitme.trade.

• Account data — email address, hashed password, registration date.
• Security data — multi-factor authentication (TOTP) setup, WebAuthn/passkey public keys, recovery codes (stored hashed), session identifiers.
• Exchange API credentials — API keys and secrets you provide for Bybit/OKX/BloFin, encrypted at rest (libsodium, AES-256-based) and never displayed again once saved, including to BitMe staff.
• Trading data — positions and trade history synced from the exchanges you connect, used to power the dashboard, journal and reports.
• Telegram data — your Telegram chat ID, used solely to deliver alerts to you.
• Technical data — IP address (used transiently for rate-limiting and abuse prevention), browser/device information from standard server logs.
• Contact form data — name, email and message content if you use the contact form.

• To provide the Service (account data, exchange credentials, trading data, Telegram ID) — necessary for performance of the contract with you (Art. 6(1)(b) GDPR).
• Security and abuse prevention (IP-based rate-limiting, session/MFA data) — our legitimate interest in keeping the Service and your account secure (Art. 6(1)(f) GDPR).
• Analytics (Google Analytics 4) — only with your consent, given via the cookie banner (Art. 6(1)(a) GDPR); disabled by default until you accept.
• Responding to your enquiries (contact form) — necessary to take steps at your request prior to / in relation to a contract (Art. 6(1)(b) GDPR).

We do not sell your personal data. We share data only where necessary to provide the Service:

• The exchanges you connect (Bybit, OKX, BloFin) — your API key is used to call their API directly on your behalf; we do not send your credentials to any party other than that exchange.
• Telegram (Telegram Bot API) — to deliver your alerts.
• Google (Google Analytics 4) — only if you accept analytics cookies; used in cookieless/aggregated form until consent is given.
• Our hosting provider — to operate the infrastructure the Service runs on.

Google Analytics may process data outside the European Economic Area. Where this occurs, Google relies on the EU Standard Contractual Clauses or an equivalent safeguard recognized under GDPR. This only applies if you have consented to analytics cookies.

We keep your account and trading data for as long as your account is active. If you request deletion, we delete or anonymize your personal data and encrypted API credentials within a reasonable time, except where we are required to retain certain records by law. Contact form messages are kept only as long as needed to handle your enquiry.

Exchange API secrets are encrypted at rest and never returned through the interface once saved — not even to BitMe administrators. Accounts can be protected with multi-factor authentication (TOTP) and WebAuthn/passkeys. Sessions use secure, HttpOnly cookies. Access to production data is limited to what is necessary to operate the Service.

Under GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; request restriction of processing; request a copy of your data in a portable format; and object to processing based on legitimate interest. Account deletion is currently handled manually — email contact@bitme.trade and we will action your request within a reasonable time.

• Session cookie — strictly necessary to keep you logged in (HttpOnly, Secure, SameSite=Strict). No consent required.
• localStorage — stores your theme preference (dark/light) and your cookie-consent decision on this device. No consent required; not sent to any server.
• Google Analytics 4 — optional, only active after you accept via the cookie banner. Runs in cookieless mode (no analytics cookies, aggregated pings only) until you accept; you can change your choice at any time by clearing this site's data in your browser.

We may update this Privacy Policy from time to time; the "last updated" date above reflects the latest revision. Material changes will be announced on this site.