Privacy Policy

1. What we do not collect

To create and use a TronDealer account we do not ask for or store:

• Email address or phone number.
• Personal name, date of birth, or identity documents.
• Card or bank account details.
• Passwords (authentication uses an API key we generate for you).
• Device location, contacts, or advertising identifiers.
• Behavioral analytics or usage profiles, on the website or in the mobile app.

There is no email field in our database. In the mobile app, the API key is stored only in the device secure storage (Keychain on iOS, Keystore on Android) and is never sent to any other service.

2. What we do store, and why

• Account name. A name you choose to identify your business or integration. It can be any text; we do not verify that it matches a real person or company.
• API key. Generated by us at registration. It is your only credential. It is shown once and used to authenticate API calls and the dashboard.
• Payout addresses. The wallet addresses where you want us to send your funds, one per network. These are public blockchain addresses.
• QvaPay account or Zelle contact. Only if you choose one of those payout methods. Used exclusively to execute the payout.
• Webhook URL and secret. To notify your own server when a payment is detected or confirmed. Notifications are signed with the secret you configure.
• On-chain transactions. Transaction hashes, wallet addresses, asset, amount, block number, and timestamps of deposits received at the addresses we assign to you. This data is already public on the blockchain; we keep it to detect, confirm, and settle your payments and to show you your history.
• Deposit wallets. We generate deposit addresses for your account. The corresponding private keys are stored encrypted (AES-256-GCM) and are only decrypted at the moment funds are moved to your payout address.
• Push notification log. If you enable notifications in the mobile app, we record which transactions we have already notified you about so we never send duplicates. These records are deleted automatically after 7 days.

3. Technical security data

Like any internet service, our infrastructure records IP addresses in server and proxy (Cloudflare) access logs to detect abuse, attacks, and errors. These logs are rotated, are not linked to accounts, and are not used to build profiles. Account registration is limited to one request per IP address per hour; that counter lives only in server memory and disappears on restart. Public registration uses Cloudflare Turnstile to tell humans from bots; Turnstile is governed by the Cloudflare privacy policy.

4. Cookies

The web dashboard uses a single cookie, td_session, strictly necessary to keep you signed in. It contains your account identifier and a signature and expires after 30 days. We use no tracking, advertising, or third-party cookies. The mobile app uses no cookies.

5. Push notifications (mobile app)

Push notifications are optional. If you enable them, the OneSignal service registers your device push token and associates it with your account identifier so we can alert you when a deposit is detected or confirmed. The push token is held by OneSignal, not in our database. You can disable notifications at any time from your device settings; signing out or uninstalling the app removes the association.

6. Who data is shared with

We do not sell data or share it with advertisers or data brokers. We only use providers required to operate the service:

• Supabase — database, encrypted at rest.
• Cloudflare — proxy, attack protection, and bot verification (Turnstile).
• OneSignal — push notification delivery, only if you enable notifications in the mobile app.
• Blockchain node providers — receive only on-chain addresses and transactions, which are already public.
• QvaPay or Zelle — only if you choose them as your payout method, and only the data needed to execute the payout.
• CoinGecko — market prices; receives no data about you.
• Your own server — if you configure a webhook, we send your transaction data to the URL you specify.

We may also disclose data when required by a valid law or court order.

7. The blockchain is public

Transactions processed by TronDealer are recorded on public blockchains. They are permanent, visible to anyone, and cannot be modified or deleted, by us or by you. Any right to erasure applies only to the copy we keep in our systems, never to the chain.

8. Sanctions compliance

Before sending funds to an address, we check it against public sanctions lists (such as the OFAC SDN list). This processing operates only on blockchain addresses, not personal data, and is necessary to comply with applicable regulations.

9. Retention and deletion

• Account data (name, key, addresses, webhook): for as long as the account exists. You can delete your account yourself at any time, from the mobile app’s Settings or through the API; doing so immediately erases the name, settlement addresses and webhook details, and invalidates the API key.
• Transaction history: for as long as the account exists; on-chain data remains public afterwards.
• Session cookie: 30 days.
• Push notification log: 7 days, deleted automatically.
• Deposit wallets with no activity: deactivated automatically after 120 days.
• Technical access logs: rotated periodically.

10. Your rights

Depending on your jurisdiction, you may have the right to access the data we hold about your account, correct it, request its deletion, or object to certain processing. All your account data is visible and editable from the dashboard, and account deletion is self-serve: it is in the mobile app’s Settings and available through the API, with no need to write to us. For any other inquiry, or if you have lost access to the account, write to [email protected]. Since we hold neither your email nor your identity, we will ask you to prove control of the account (for example, by signing with your API key).

11. Children

The service is not directed to individuals under 18 and we do not knowingly collect data from minors.

12. International transfers

Our providers may process data on servers outside your country. All of them apply industry-standard security measures and encryption in transit.

13. Changes to this policy

If we change this policy, we will update the effective date on this page. If a change expands the data we collect, we will announce it in the dashboard before it takes effect.

14. Contact

For any privacy question: [email protected].