apacrypto APAC markets

Privacy Policy

Last updated: 19 October 2026 Effective: 19 October 2026

This Privacy Policy describes what data we collect, how we use it, and what choices you have. By using Apacrypto you agree to the practices described below.

Summary in plain English

  • We collect the minimum data needed to run the site.
  • We use one privacy-respecting analytics tool (Vercel Web Analytics) that counts page views and measures performance — it does not set cookies and does not collect personal data.
  • We do not run advertising, third-party trackers, remarketing pixels, or data-broker integrations.
  • Your watchlist and theme preference live in your browser by default. They sync to our servers only if you sign in.
  • If you sign in, we store your email and a hashed session token. We never share your email with anyone.
  • You can delete your account and all associated data at any time by emailing support@apacrypto.com.

What we collect

Information you give us

  • Email address — only if you choose to sign in via magic link. Used to deliver the one-time sign-in link and to identify your account thereafter. Stored as plaintext in the users table.

Information we generate

  • Session token — a random 32-byte value set as apacrypto_session when you sign in. Stored only as a SHA-256 hash server-side.
  • Display-currency preference — set via the fiat switcher. Stored as a non-personal cookie (apacrypto_fiat, e.g. MYR).
  • Theme preference — light or dark. Stored in your browser's localStorage under apacrypto_theme.
  • Watchlist — the list of Coinlore coin IDs you have saved. Stored in localStorage under apacrypto:watchlist. If you sign in, this list is mirrored to our database so it follows you across devices.

Information collected automatically

  • Server logs — Vercel records the standard request metadata (IP address, user-agent, request path, response code) for every request that reaches our edge. Logs are retained by Vercel per their data-retention policy and used by us only as needed for security and debugging.
  • Cache telemetry — the number of upstream API calls we make (to Coinlore and Frankfurter) is recorded per day in our database. This counts requests, not users.

What we do NOT collect

  • No advertising or remarketing pixels
  • No third-party advertising or tracking cookies
  • No fingerprinting
  • No data broker integrations
  • No cross-site tracking

Analytics

We use Vercel Web Analytics to count page views and measure aggregate site performance (web vitals). Vercel Analytics is privacy-friendly by design:

  • It sets no cookies.
  • It does not collect personal data such as name, email, IP address (in the privacy-strict configuration), or device fingerprint.
  • It does not track users across other sites.
  • It is GDPR-compliant and does not require a consent banner.
  • It is disabled in local development.

Analytics data is aggregated and used solely to understand which pages get used so we can prioritise improvements. We do not use analytics to profile individual users.

How we use the data

  • Email — to send you the magic-link sign-in email, identify your account, and associate your watchlist with you.
  • Session token — to authenticate your browser on subsequent requests.
  • Preferences — to remember your display currency and theme.
  • Watchlist — to render your saved-coin page and keep it in sync across devices.
  • Logs and telemetry — to operate the service, monitor abuse, and debug issues.

We never sell, rent, lease, or otherwise commercially share your personal data with third parties. We will only disclose it when compelled by valid legal process.

Third-party services we rely on

  • Coinlore — cryptocurrency market data. Receives no personal data from us; we request public market feeds.
  • Frankfurter — foreign-exchange rates (ECB-backed). Receives no personal data.
  • Resend — transactional email delivery. Receives your email address solely for the purpose of delivering the magic-link sign-in email.
  • Neon — serverless Postgres hosting. Stores our database, including the users table.
  • Vercel — application hosting, edge network, and Web Analytics. Stores server logs and aggregate analytics.

Cookies

Apacrypto sets two strictly functional cookies. We do not use any tracking or advertising cookies.

  • apacrypto_session — HttpOnly, SameSite=Lax, Secure (in production). Set when you sign in. Expires 30 days after the last sign-in. Used to keep you signed in.
  • apacrypto_fiat — non-HttpOnly, SameSite=Lax. Stores your selected display currency. Persists for one year.

Your rights

You can at any time:

  • Access the personal data we hold about you (your email and your watchlist).
  • Delete your account, which removes your email and your watchlist from our database.
  • Export your watchlist in a portable format.

To exercise any of these rights, email support@apacrypto.com from the address associated with your account. We will action verified requests within 30 days.

Data retention

  • Account email — kept until you delete your account.
  • Session tokens — kept until the cookie expires (30 days) or you sign out. Expired tokens are reaped automatically.
  • Magic-link tokens — consumed or expire 15 minutes after issue.
  • Cache entries — kept per the TTL of the underlying API endpoint (60s for live data, 1h for static metadata). Older entries are rolled over.
  • Server logs — retained per Vercel's policy.

Security

We take reasonable measures to keep your data secure:

  • Sessions and magic-link tokens are stored only as SHA-256 hashes — a database leak alone does not grant access.
  • The session cookie is HttpOnly and Secure in production.
  • The database connection is TLS-only and the connection string is held server-side, never exposed to the browser.
  • Production deployment uses nodejs22.x on Vercel, a pinned region (Singapore), and standard security headers.

No system is perfectly secure. If you discover a vulnerability, please report it to security@apacrypto.com.

Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact support@apacrypto.com for deletion.

Changes to this policy

We may revise this policy. Material changes will be reflected in the "Last updated" date above and, where appropriate, announced on the dashboard or via email.

Contact

Questions, concerns, or requests: support@apacrypto.com.

Questions? Email support@apacrypto.com.