Privacy Policy
1. Data controller
The data controller is Coyote Finance, operator of the website coyote.finance ("Coyote", "we"), based in Milan, Italy. For any request about your personal data write to privacy@coyote.finance.
2. What Coyote does
Coyote is a free web application with three parts: What If (a market cap comparison and expected multiple calculator), the Journal (a personal trading journal with statistics and an optional written review generated by an AI model) and Learn. You can use What If without an account. The Journal and saved portfolios require an account.
3. Data we process, purposes and legal basis
| Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Board data without an account: coins, targets, probabilities, token amounts | Run the calculator. This data stays in your browser's local storage and is not sent to our servers. | Not processed by us |
| Account data: email address, password (stored hashed), sign-in timestamps | Create and secure your account, let you sign in from any device, send account emails (confirmation, password reset) | Performance of a contract (Art. 6.1.b) |
| Board, saved portfolios and journal: coins, targets, probabilities, holdings, trades (coin, side, leverage, prices, dates, margin), your thesis and result notes, setup, state of mind, confidence | Store your content and show it back to you across devices; compute your statistics | Performance of a contract (Art. 6.1.b) |
| AI review of the journal (only when you press "Ask Claude to read my journal"): your closed trades and notes, and the text produced | Produce and keep the written review you asked for | Performance of a contract (Art. 6.1.b) |
| X (Twitter) connection (only if you connect it): your X user id and username, and the access tokens X issues to us; the text of each post you publish through Coyote | Publish posts on your X account when you ask, and keep a record of what was posted | Consent, given when you authorise the connection (Art. 6.1.a); you can withdraw it at any time by disconnecting X in Settings |
| Anonymous checks: coin, target market cap, probability, day | Show aggregate statistics ("Crowd") and understand how the product is used. No account id, IP address or device identifier is attached, so these rows cannot be linked to you. | Not personal data |
| Usage analytics (if enabled on the site): pages viewed, sections opened, events such as "coin added" or "trade saved", browser type, approximate country derived from IP, a random identifier kept in your browser | Understand which features are used and fix problems | Legitimate interest in improving the service (Art. 6.1.f). No advertising, no cross-site tracking, no cookies. |
| Technical logs: IP address, request time, user agent, errors | Security, abuse prevention, debugging | Legitimate interest (Art. 6.1.f) |
Providing account data is necessary to use the Journal and saved portfolios; without it those features are not available. All other data is optional.
4. Market data
Prices and market caps are requested by your browser directly from our market data provider (CoinGecko). That request carries your IP address and browser information to the provider, as with any website you visit. We do not send the provider anything about you or your board.
5. Processors and recipients
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, server functions | EU (Frankfurt, Germany) |
| Netlify Inc. | Website hosting and content delivery | EU and USA (global CDN) |
| Anthropic PBC | Generates the AI review of your journal, only on your request. Anthropic does not use API data to train its models. | USA |
| PostHog Inc. (EU cloud), if analytics is enabled | Usage analytics | EU (Frankfurt, Germany) |
| X Corp., only if you connect your X account | Publishes posts on your behalf; X processes them under its own privacy policy | USA |
| Email delivery provider | Sends account emails (confirmation, password reset) | EU or USA depending on the provider |
These providers act as processors under Article 28 GDPR, except X Corp. and CoinGecko, which are independent controllers. We do not sell personal data and we do not share it with advertisers.
6. Transfers outside the European Economic Area
Where a provider processes data in the United States, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR), together with additional safeguards where needed.
7. Retention
- Account, board, portfolios, journal, AI reviews, X connection: for as long as your account exists. When you delete your account, everything linked to it is deleted immediately from the live database; backups are overwritten within 30 days.
- Anonymous checks: kept indefinitely, since they are not personal data.
- Analytics: 12 months.
- Technical logs: up to 30 days.
8. Cookies and local storage
Coyote does not use profiling or advertising cookies. It uses your browser's local storage for what is strictly necessary to work: your board when you are not signed in, your session when you are, and your interface preferences. If analytics is enabled, a random identifier is kept in local storage to count returning visitors; it is not shared with third parties and it identifies a browser, not a person. Under Article 122 of the Italian Privacy Code and the Italian Data Protection Authority's guidelines of 10 June 2021, strictly necessary storage does not require consent. You can clear local storage at any time from your browser settings.
9. Your rights
Under Articles 15 to 22 GDPR you can, at any time: access your data; obtain a copy in a portable format; correct it; delete it; restrict or object to its processing; withdraw consent where processing is based on consent, without affecting what was done before. Most of this you can do yourself: edit or delete any trade or portfolio in the app, disconnect X in Settings, and delete your whole account in Settings. For anything else write to privacy@coyote.finance; we answer within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it) or with the supervisory authority of the EU country where you live.
10. Minors
Coyote is a tool about leveraged trading and is not intended for people under 18. We do not knowingly collect data from minors; if you believe a minor has created an account, write to us and we will delete it.
11. Security
Data is encrypted in transit (TLS) and at rest. Access to your rows is enforced by database-level rules so that only your account can read them. Access tokens for X are stored server-side and never sent to the browser. No system is perfectly secure; if a breach affects your data we will notify you and the authority as required by Articles 33 and 34 GDPR.
12. Automated decisions
Coyote makes no automated decisions with legal or similarly significant effects on you. The statistics and the AI review are information for your own reflection; they are not advice and nothing in the service acts on them.
13. Changes
We may update this notice when the service changes. The date at the top tells you the current version; material changes will be announced in the app.