What we collect about you

  • Account data: username, email address, and a hash of your password. We never store the password itself.
  • What you write: forum topics and replies, reviews, scam reports, private messages, and images you attach to posts. Everything but the private messages is public — see our Terms, section 3.
  • If you own a claimed channel: the text you write for its paid page section or its Promo banner, including versions we did not approve, together with the moderation decision on each and the reason for it.
  • Read-only exchange API keys you choose to connect, encrypted before storage, plus everything we read with them: closed positions, order history, periodic balance snapshots, and deposit/withdrawal records. The Security page sets out exactly what we read and why.
  • Payment records: which plan, the amount, the network, the wallet address the payment arrived from, and the blockchain transaction hash. We take crypto directly — there is no card processor in this, and no card details exist to store.
  • Technical data: the IP address of a failed login attempt, kept for 48 hours to throttle password guessing and then deleted; your session cookie; your light/dark theme choice.

Data about traders and channels

ChainRated calculates ratings from publicly available information — public Telegram channel messages and public or read-only exchange data. The source channels and trading accounts we analyse are public by nature or connected voluntarily by their owners.

Two consequences are worth stating plainly, because they touch people who never signed up here. Channels and copy traders we list carry a public rename history, so a record stays findable under every name it was published under; and a signal is kept as first published even if the original message is later edited or deleted. Both exist so that a bad record cannot be made to disappear by relabelling it. If you are the subject of a listing and something on it is wrong, write to us and we check it against the raw data.

Who else your data reaches

We sell nothing to anybody, and the only advertising on this site is a channel buying space for itself — there is no ad network here and no third-party ad tag. These are the services that necessarily see something, and what they see:

  • Anthropic — our automated moderation sends the text of forum posts from new accounts, and the text of a private conversation once one of its participants reports it, to a language model for a verdict. No other content is sent, and we do not send account details with it.
  • Cloudflare — sits in front of this site, so it sees the traffic. Its Turnstile anti-bot check additionally receives your IP address when you submit a protected form.
  • Google Analytics — page views only, with storage consent denied by default, so the tag sets no analytics cookies and sends aggregated pings without personal data. Staff visits are not counted at all.
  • Resend — delivers our email, so it handles your address and the message body.
  • Telegram — if you link your Telegram account, notifications reach you through the Bot API.
  • Bybit and Binance — receive a signed read request carrying your own API key whenever we sync your connected account.

How long we keep things

Most of what we hold has no automatic expiry, which is a deliberate choice for records and an honest admission for everything else:

  • Failed-login IP addresses: 48 hours, then deleted automatically.
  • Trade history read from a connected key: kept while the account exists. A verified track with a hole in it proves nothing, so we do not thin it out. Disconnecting a key stops the sync; it does not erase what was already read.
  • Forum posts, reviews and scam reports: kept. You can delete your own post within 15 minutes of writing it.
  • Private messages: kept until an account in the conversation is deleted. There is no self-service message delete today.
  • Owner-written paid content — a channel’s page section and its banner line — is kept while the channel page exists, including versions that were rejected: a moderation decision nobody can look up afterwards is not a decision anyone can contest.
  • The event journals — track events, publication history, ownership changes, renames — are append-only by design and are never trimmed.

Your rights, and what we can actually do

There is no export or delete button in your account settings today. Building one is on our list; until it exists, saying it exists would be the kind of claim this whole site is against. Write to [email protected] and a person does it by hand.

  • We will delete: your account and email address, your private messages, any exchange key you connected and everything synced with it, and images you uploaded.
  • We will export, on request, the data we hold that is yours: your account details, your posts and reviews, and your synced trading history.
  • Forum posts and reviews stay by default — removing them would gut conversations other people took part in — and they still carry the username you wrote them under. Tell us which ones you want taken down and we will go through them with you.
  • Payment records stay. They are our accounting trail, and the transaction itself is on a public blockchain we could not erase in any case.
  • One thing to know before you ask: deleting your account also deletes your private conversations for the other person in them.
Security

We only ever request read-only API keys, and the exchange enforces that on its side. ChainRated cannot place trades or withdraw funds on your behalf.

Email we send, and how to stop it

We run no newsletter and sell your address to nobody. What we send falls into exactly two kinds, and only one of them is optional.

  • Notifications: someone mentioned you on the forum, a thread you follow got a reply, a private message arrived. Every one of these carries an unsubscribe link that works without logging in, and the same switch sits in your account settings.
  • Account email: payment confirmations and renewal notices, the link that verifies your address, password resets, and a notice if your posting is suspended. These are the record of what happened to your account and cannot be switched off — a site that lets you hide the notice that you were suspended is hiding it, not respecting a choice.

Opting out stops the email and nothing else: notifications still appear on the site, and a linked Telegram account keeps receiving copies until you disconnect it in your settings.

Cookies

We use a session cookie to keep you logged in, and we remember your light/dark theme choice in your browser rather than on our servers. Analytics runs with storage consent denied by default, so it sets no cookies of its own.

The Promo banner counts how often it was rendered and how often its link was followed. Those are two running totals on the campaign’s own row: no cookie, no identifier, nothing recorded about who saw or clicked it, and so nothing to reconstruct later. The totals include bots and crawlers, and the advertiser’s dashboard says so.

We do not run a consent-management banner. No cookie here is set for advertising, and there is currently nothing to consent to that a banner would meaningfully change — if that stops being true, this section changes with it.