Privacy policy

2. What data we process, why, and on what legal basis

• Visits and security. Whenever you visit, our hosting and security provider Cloudflare processes technical data such as your IP address, browser type and the page you request, in order to deliver the site and protect it against attacks. To do so, Cloudflare also runs a brief check in your browser on every page to detect bots. To curb misuse of forms and counters, we also use your IP address as a counter for no more than one minute; we do not store it. Legal basis: legitimate interest in a secure, working site (Art. 6(1)(f) GDPR).
• Click statistics. Only if you consent to affiliate tracking do we record your click on an outgoing link, such as an offer or partner link: which link and link text, on which page (with that page’s full web address) and which edition of the site, the domain of the site you came from, the country (derived from your IP address, which we do not keep ourselves), the type of device and your cookie choice. We do not link this data to you or to a device identifier. This shows us which offers and links are used and lets us verify partner commissions. Without your consent we record nothing; the links work exactly the same. Legal basis: consent (Art. 6(1)(a) GDPR).
• Your cookie choice. We store your choice in the cookie banner in your browser. If you give consent, we also keep the following in our database as proof: your choice, a random code your browser generates when you make it, your browser type (user agent) and the page on which you made the choice. If you decline, your choice stays in your browser only. Legal basis: the legal obligation to be able to demonstrate consent (Art. 7(1) and Art. 6(1)(c) GDPR).
• Contact and partner form. Your name, your email address and your message. We store the message in our database and forward it to our Google (Gmail) mailbox so we can reply. Legal basis: legitimate interest in answering questions (Art. 6(1)(f) GDPR) and, where a possible partnership is concerned, steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Newsletter. Your email address, when you signed up and whether you have confirmed your subscription. We only send you anything once you have clicked the confirmation link (double opt-in); at present the only email we send is that confirmation email. Legal basis: consent (Art. 6(1)(a) GDPR). If you unsubscribe via the link in an email, we delete your subscription and keep only an unsubscribe record, so that you never receive a newsletter from us again (Art. 6(1)(c) and (f) GDPR). If an email cannot be delivered or you mark it as spam, we also add your address to that list. If you later want to hear from us again after all, just email us and we will remove your address from it.
• Sending emails. For every email we send, we keep a delivery log: the recipient address, the type of email and whether delivery succeeded. This lets us investigate delivery problems and misuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Solo mining pools. If you connect mining hardware to pool.cryptocodes.eu, the pool server processes your IP address, the payout address and worker name you enter as your username, and your hashrate and submitted shares. This is necessary to hand out work, count shares and credit a block that is found to your address. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Please note: statistics per payout address can be looked up by anyone via our pool pages, and a block that is found remains permanently on the public blockchain together with your address. So do not use a name or email address as your worker name. Even if you only view our pool pages, your browser fetches the live statistics directly from the pool server, which then sees your IP address, just like any website.
• Telegram and social media. If you ask a question via Telegram or respond on X or Instagram, we see your username and what you send, and that platform processes your data under its own privacy policy. From Instagram we only receive anonymised statistics about visitors to our profile; Meta and we are jointly responsible for those. Legal basis: legitimate interest in staying in touch with readers (Art. 6(1)(f) GDPR).
• Administration. The editorial team manages the site through restricted access; visitors do not need an account. If the editorial team uses an account with an email address for this, we process only that address and the login session, for as long as the account exists. Legal basis: legitimate interest in secure administration (Art. 6(1)(f) GDPR).

You are not obliged to give us any data. Without an email address, however, we cannot reply to you or send you the newsletter, and without a payout address the pool cannot credit a block you find to you.

We do not make decisions about you based solely on automated processing, and we do not create profiles. The site is intended for people aged 18 and over.

3. What stays in your own browser

Some settings are stored only in your own browser: your language, light or dark theme, notices you have dismissed and the pool address you enter on the statistics page. This data does not reach us, with one exception: the pool address you look up is sent to the pool server to fetch the statistics. The full overview is in our cookie policy.

4. External services your browser contacts directly

On some pages your browser fetches content directly from another party. That party then receives your IP address and browser data. We do not pass on any other data. Legal basis: legitimate interest in showing images and up-to-date prices (Art. 6(1)(f) GDPR).

• Unsplash (United States): photos in articles and on the homepage.
• CoinGecko (Singapore): prices and coin logos, including on the converter and the market regime dashboard.
• alternative.me: the Fear & Greed Index on the market regime dashboard. This service does not disclose where its servers are located; assume they may be outside the EEA.

5. Partner links and cookies set by providers

Many outgoing links are affiliate or referral links. If you click one, the provider’s site opens via a link containing our partner code. This tells the provider that you came via CryptoCodes.eu, and we may receive a commission if you become a customer. We do not pass any personal data to the provider in the process.

Some partner links first pass through the server of an affiliate network. That network and the provider may set cookies on their own domain, under their own cookie and privacy policies; they also ask for your consent there themselves. You can decline affiliate tracking in your cookie preferences. The link then stays the same partner link, but we do not record your click. If you do not want to be recognised as coming from us at all, go directly to the provider’s site instead of using our link.

6. Processors and recipients

We do not sell personal data and do not share it with advertisers or partners. The following service providers process data on our behalf:

• Cloudflare (United States): hosting, network, security and DNS for the site, and forwarding of email sent to our address.
• Lovable Labs Sweden AB (Stockholm, Sweden) and the sub-processors Lovable uses: the platform the site is built on, including email delivery.
• Supabase, via Lovable, on Amazon Web Services servers in Ireland: our database (consent log, click statistics, forms, newsletter, delivery log). For some features your browser connects to it directly: recording your cookie choice, the pool and network statistics, and the best share checker.
• Google (Gmail): our mailbox. Messages sent through the contact or partner form and emails to us arrive there. Google also processes that email under its own terms.
• Anthropic (United States): an AI tool (Claude) we use to sort our mailbox, prepare replies and analyse the click and newsletter figures.
• McAfee (United States): checking suspicious emails for scams, only for mail that gives reason to do so.
• OVHcloud, server in Frankfurt (Germany): the server for the solo mining pools.

We may also disclose data where a legal obligation or court order requires it.

7. Transfers outside the European Economic Area

Cloudflare, Supabase, Google, Anthropic and McAfee are US companies, so data may be processed in the United States. This takes place on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. You can request a copy of these safeguards from us.

With the external services in section 4, your browser itself connects to a party outside the EEA. For Singapore, where CoinGecko is based, the European Commission has not adopted a decision finding that the level of protection there is adequate.

8. Retention periods

We do not keep data longer than necessary. A daily clean-up task automatically deletes whatever has reached the end of its retention period:

• Cookie choice (database): 12 months.
• Click statistics: 24 months.
• Contact and partner messages: 24 months.
• Email delivery log: 12 months.
• Newsletter: until you unsubscribe; a subscription you do not confirm is deleted after 30 days. We keep the unsubscribe record for as long as necessary to make sure we no longer email you.
• Mining pool data: for as long as necessary to run the pool and show the statistics. A block that is found remains permanently on the blockchain; we cannot delete it.
• Server logs at Cloudflare: in accordance with Cloudflare’s own retention periods.

9. Security

The website and the pool statistics are served over HTTPS. The connection between your miner and the pool (the stratum protocol) is, as with most pools, not encrypted; so do not enter a secret password in your miner. Access to the database is restricted per table, only the editorial team can access the administration, and forms and counters are protected against large-scale abuse.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. Where we process data on the basis of consent, you can withdraw it at any time; this does not affect processing carried out before the withdrawal.

• Right to object. Where we process your data on the basis of our legitimate interest, you can object to this at any time on grounds relating to your particular situation. We will then stop, unless we have compelling grounds that override your interests.

Email us at the address at the bottom of the page. We will respond within one month; for a complex or large request, this may be extended by two months, in which case we will let you know within the first month. To prevent someone else from requesting your data, we may ask you to show that the request is really from you.

You can also lodge a complaint with a supervisory authority: in the EU country where you live or work, or where the infringement took place. That is usually the data protection authority in your own EU country. Because we are established in the Netherlands, the Dutch Autoriteit Persoonsgegevens is our lead supervisory authority.

11. Changes

If anything changes in what we process, we will update this policy and the date at the top. The current version is always available on this page.