Privacy Policy
The short version.
- We keep the minimum needed to run your account: your email, your username and a scrambled copy of your password.
- Payments are handled by Stripe. We never see or store your card number.
- The Guard extension checks tokens from your own browser. We don't receive the tokens you look at or your wallet.
- We don't sell your data, we don't run ads, and we don't use tracking or advertising cookies.
- You can ask for a copy of your data, or for it to be deleted, at any time.
1. Who we are
Spectra (spectra.gripe), including the Guard browser extension and the Spectra desktop app, is run by Tinoosh Simpkins in the United Kingdom. For this policy we are the "controller" of your personal data under the UK GDPR and the Data Protection Act 2018.
Contact us about anything in this policy at privacy@spectra.gripe.
2. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Email address, username, password (stored only as a salted scrypt hash) | To create and secure your account and let you sign in | Contract |
| One-time email codes (stored hashed, expire within minutes) | To verify your email and reset your password | Contract |
Session cookie sp_session | To keep you signed in. It's strictly necessary, so it needs no consent | Contract |
| Profile and settings you choose to save (for example your rule switches, display currency, leaderboard choice) | To give you the same Spectra on every device | Contract |
| Your trading survey: how long you've traded, whether you've used DEXs, what kind of money you trade with, and your three acknowledgements, with the date | To decide which community rooms are for you (for example #new-traders), to set your rule switches, and to keep a record that you understood the risks | Contract and legitimate interests |
| Community messages, likes and direct messages | To run the community rooms and direct messages. Room messages are visible to members who can read that room; direct messages only to you and the other person. Deleted messages are hidden at once | Contract |
| Plan, Stripe customer and subscription IDs, subscription status | To provide Premium and manage billing | Contract |
| Learn with Spectra waitlist email | To send one email when Learn opens | Consent (you can withdraw it any time) |
| Account activity log (sign-ups, sign-ins, plan changes) and error reports | To keep the service secure, fix problems and prevent abuse | Legitimate interests |
| Your IP address, briefly and in memory only | Rate limiting, to stop password guessing and spam | Legitimate interests |
We don't collect your name, address, date of birth, wallet addresses, private keys or seed phrases. Never type a seed phrase into anything that asks for it, including anything that claims to be Spectra.
3. The Guard extension and desktop app
When you open a token page, Guard reads the token's address from the page and looks it up directly from your browser with these public data providers: DexScreener, RugCheck, GoPlus Security, GeckoTerminal, Coinbase (exchange rates) and a public Solana RPC node (or one you set yourself). Those providers receive the token address and your IP address, under their own privacy policies. Spectra's servers are not involved in these lookups and don't log them.
To unlock Premium extras, Guard asks spectra.gripe whether you're signed in and which plan you're on, using the sign-in you already have on spectra.gripe in the same browser. spectra.gripe answers with your account details, and Guard keeps only your username and plan, in memory. The request doesn't include the tokens you look at.
Your Guard settings are stored with Chrome's sync storage, so they follow your Chrome profile. The extension doesn't read pages other than the trading sites it supports, and only reads what it needs to find the token.
The desktop app opens spectra.gripe in its own window, so the website sections of this policy apply to it.
4. Who we share data with
We use a small number of service providers ("processors") who act on our instructions:
- Render: hosts the website and account database.
- Stripe: takes payments and runs the subscription portal. Stripe collects your card details directly and is a separate controller for its own fraud and compliance checks.
- Resend: sends account emails, such as verification codes.
- Cloudflare: domain name service, email forwarding and the download server.
- CoinGecko: supplies the live coin prices. Our server fetches them; no personal data is sent.
Some of these providers process data outside the UK, mainly in the United States. Where they do, they're covered by the UK–US data bridge or by standard contractual clauses.
We'll disclose data if the law requires it, or to protect people from fraud or harm. We never sell personal data or share it for advertising.
5. What other people can see
Your username is public in the community rooms if you post there. You appear on the leaderboard only if you switch that on, and you can switch it off again at any time. Your email is never shown to other users.
6. How long we keep it
- Account data: while your account is open. When you delete your account, we delete it within 30 days.
- Sessions: up to 30 days, or until you sign out.
- Billing records: Stripe and we keep what UK tax law requires, usually six years.
- Waitlist emails: until Learn launches and we've sent the one email, or until you ask us to remove you.
- Activity logs and error reports: up to 12 months.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. Email privacy@spectra.gripe from the address on your account, and we'll reply within one month. Where we rely on consent, you can withdraw it at any time.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.
8. Security
Passwords are hashed with scrypt, and sessions use random tokens that are stored only as hashes. All traffic uses HTTPS. Sign-in, sign-up and code checks are rate limited. No system is perfectly secure. If something goes wrong that affects your data, we'll tell you and the ICO where the law requires it.
9. Children
Spectra is for adults. You must be 18 or over to make an account, and we don't knowingly collect data from anyone younger.
10. Changes
If we change this policy in a way that matters, we'll update the date above and tell signed-in users before the change takes effect.