Privacy notice
Last updated 2026-09-02. Written for the EU and UK General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies; the same protections apply to every visitor wherever they are.
The short version
TokenLens has no accounts and no sign-up. Your watchlist, portfolio, preferences, and consent choice live in your own browser. The server keeps nothing about you unless you turn on personal sync with your own token. No analytics or advertising script loads anywhere on this site until you say yes, and you can say no or change your mind at any time. You can export or erase everything from Settings, Your data.
Who is responsible (controller)
The controller for this deployment is the operator of this TokenLens instance. Contact for privacy matters: see the contact page. TokenLens is open source; anyone may run their own copy, and each operator is the controller for their copy.
What is processed, why, and on which legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Serving pages and the API | IP address, user agent, requested URL, timestamps (standard server and hosting logs) | Delivering the site, security, abuse prevention | Legitimate interest, Art. 6(1)(f) | Hosting provider log retention, typically days to a few weeks; not used to build profiles |
| API rate limiting | IP address (first hop of X-Forwarded-For), request count | Fair use of the public API | Legitimate interest, Art. 6(1)(f) | In memory only, dropped after the 60 second window |
| Your preferences | Watchlist, positions, asset tiers, scoring weights, risk profile, up to 12 saved reports | Making the app work for you | Not transmitted to us: stored in your browser (localStorage), under your control | Until you erase them or clear site data |
| Personal sync (optional) | The same watchlist, positions, and tiers, mirrored to a server store you unlock with a token | Sharing your state with the MCP connector on your instruction | Contract or your request, Art. 6(1)(b); you enable it explicitly | Until you erase it (Settings, Your data clears the server copy too) |
| Onchain analytics gate | The site owner's configured email address and a one-time code hash | Protecting the operator's paid data quota | Legitimate interest, Art. 6(1)(f); only the operator's own address is used | Code hashes expire after 5 minutes; sessions after 10 |
| BDCC landing page lead form | Name, phone, email, chosen track, marketing consent | Letting you contact the college | Not processed by us: submitting opens a draft in your own mail client and only you decide to send it | Nothing is stored on this site |
| Analytics and advertising (BDCC pages only, if configured) | Cookies and identifiers set by Google, Meta, or X, page views, conversion events | Measuring and advertising the college's courses | Consent, Art. 6(1)(a) and ePrivacy; nothing loads until you accept | Per the provider's policy; withdrawing consent expires their first-party cookies here |
TokenLens scores and scenarios describe crypto assets, not you. There is no profiling and no automated decision-making about people (Art. 22). The site is not directed at children under 16 and knowingly collects nothing from them.
Cookies and browser storage
| Name | Kind | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| tl_otp_session | Cookie (httpOnly, strict same-site, secure) | TokenLens, only after the owner verifies an email code | Onchain analytics session; strictly necessary for that feature | 10 minutes |
| tokenlens:v1:* | localStorage | TokenLens | Your preferences, watchlist, positions, saved reports, optional sync token; strictly necessary for the features you use | Until erased |
| bdcc-ad-consent | localStorage | TokenLens | Records your consent choice with a timestamp and policy version so we can prove it and not ask again | Until erased or the consent text changes |
| tl-chunk-reload-at | sessionStorage | TokenLens | Prevents a reload loop after a deployment; technical | Browser tab |
| Offline cache | Service worker Cache Storage | TokenLens | Offline fallback page and static assets; contains no personal data | Until erased or the app version changes |
| _ga, _gid, _gcl_*, _fbp, _fbc, _twclid and similar | Cookies | Google, Meta, X | Analytics and advertising on the BDCC landing pages | Only after consent; expired on withdrawal |
Strictly necessary storage does not need consent under ePrivacy Art. 5(3). Everything else is off by default. Declining keeps the site fully functional.
Consent: how it works and how to withdraw it
On the BDCC landing pages a banner asks before any Google, Meta, or X script is loaded. Accept and decline are equally easy, one click each, and no script is loaded while you have not chosen. Your choice is stored with the date and the version of the text you saw. To review or withdraw it, use the "cookie settings" link in the page footer: withdrawing expires the tags' first-party cookies and reloads the page without them. Withdrawal does not affect processing that happened while consent was in force (Art. 7(3)). If the consent text changes, you will be asked again.
Third parties and international transfers
- Hosting: the site is served by a hosting platform (Vercel on the reference deployment) that processes request logs as our processor under its data processing terms, with standard contractual clauses for transfers outside the EEA.
- Market data: CoinGecko, DeFiLlama, and alternative.me are called server-side. Your browser never contacts them, and none of your data is sent to them.
- Personal sync storage (only if the operator configured it): Supabase or Upstash hold the synced document as processors; the operator chooses the region.
- Email codes: Resend delivers one-time codes to the operator's own address only.
- Video: the BDCC pages embed a Vimeo player with the Do Not Track flag, so Vimeo does not track viewing sessions. Loading the player still sends your IP address to Vimeo, which is necessary to play the video.
- Analytics and advertising (Google, Meta, X): only after consent, and only on the BDCC pages. These providers may transfer data to the United States under the EU-US Data Privacy Framework or standard contractual clauses; their own notices describe the details.
- Images: gallery pictures are served through this site's own image optimizer, so your browser does not request them from the original host.
We never sell personal data and there is no cross-site tracking outside the consented tags.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and to withdraw consent at any time. Because your data lives in your browser, you can exercise most of these yourself, instantly:
- Access and portability: Settings, Your data, Export downloads everything as a machine-readable JSON file.
- Erasure: the Erase button on the same page removes all local data, the synced server copy if you configured a token, and the offline cache.
- Rectification: edit your watchlist, positions, and settings directly in the app.
- Consent: the cookie settings link in the BDCC page footer.
For anything that needs the operator (for example server log questions) write to the contact above. We answer within one month. Identity checks are proportionate: since we hold no account, we may ask what you need us to look for. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, workplace, or the alleged infringement; the European Data Protection Board lists them. In the UK that is the Information Commissioner's Office.
Security
All traffic is HTTPS with HSTS. Secrets stay server-side and are never exposed to the browser. The sync token is compared in constant time, one-time codes are stored only as salted hashes, and the sync store is locked down so only the server can reach it. The full source is public for review.
Changes
Changes to this notice are published here with a new date. A change that widens what consent covers bumps the consent version, which makes the banner ask again.