Privacy policy
MyCryptoLog · last updated: 08/11/2026
This policy explains what data the MyCryptoLog application (Android application and web version) collects, why, how long it keeps it and how to exercise your rights. It supplements the terms of use and the legal notice.
1. Data controller
Bruno PIERRE-JUSTIN, publisher of the application, 33185 Le Haillan, France.
Contact: mcl-support@mycryptolog.com
2. Data collected
MyCryptoLog is a tracking (“logs”) application: it stores no private key, no recovery phrase, no wallet address and no access to your exchange accounts. No name, postal address or telephone number is requested.
| Category | Data |
|---|---|
| Account | Email address, password (stored only as an Argon2id hash, never in clear), language, currency, theme and options chosen, dates of creation, modification and last access, last IP address and last browser used. |
| Data you enter | Tracked and favourite assets, transactions and notes, price alerts, history of the value of your wallet and sales reports calculated from your transactions. |
| Sign-in and security | Sign-in sessions (device, browser, IP addresses at creation and at last use, dates), counters of sign-in attempts (irreversible fingerprints of the IP address and of the email address), technical logs (email address, IP address, information about the device and the screen viewed). |
| Notifications | Notification identifier of the device or browser (with the manufacturer and model of the device), copies of the emails and notifications sent. |
| Advertising | Advertising identifier of the Android device and consent choices (Google AdMob, Android application, non-Premium accounts); history of the ads displayed and of the ad blocking detected (type, date, technical response from Google AdMob). |
| Premium subscription | Plan, Google Play order number and purchase token, status, expiry date and renewal of the subscription. No bank details: payment is processed by Google. |
| Premium trial offer | Irreversible fingerprint of the email address, only after the deletion of an account whose Premium trial has ended. |
3. Purposes and legal bases
- Providing the service (account, wallet, statistics, alerts, weekly report, export): performance of the contract, i.e. the terms of use.
- Managing your Premium subscription (checking the purchase with Google Play, renewals, cancellation): performance of the contract.
- Granting the Premium trial offer only once per email address (irreversible fingerprint of the email address, kept after the deletion of an account whose trial has ended): legitimate interest in preventing abuse of the trial offer.
- Securing the application (sessions, limiting sign-in attempts, notification of a sign-in from a web browser, anti-bot protection of the sign-up form, technical logs): legitimate interest.
- Contacting you (sign-up confirmation, password reset, security alerts, messages you enable in the settings): performance of the contract.
- Displaying advertising (Android application, non-Premium accounts): your consent, collected on first launch through Google’s form where the regulations require it. Free use of the Android application requires accepting advertising; if you refuse it, a Premium account lets you use the application without advertising. You can change your choice at any time from the Settings (“Privacy options”).
4. Recipients and providers
Your data is neither sold nor rented. It is processed by the publisher and by the following technical providers, each for its own task only:
- OVH (France): hosting of the application and its data, sending of emails;
- Google Firebase Cloud Messaging: push notifications;
- Google AdMob: advertising in the Android application;
- Google reCAPTCHA: protection of the sign-up form against bots;
- Google Charts and Font Awesome: display of charts and icons, loaded from their servers (which receive your IP address);
- Google Play: distribution of the Android application and payment of Premium subscriptions.
Prices and market data come from CoinGecko, exchange rates from currencyapi and the automatic translations of the help pages from Google Translate: no personal data is sent to them.
5. Transfers outside the European Union
Your data is hosted by OVH in a data centre located in Beauharnois (Quebec, Canada), a country recognised by the European Commission as providing an adequate level of protection for personal data for commercial organisations (adequacy decision). Some providers (Google) may process data outside the European Union. These transfers are covered by the safeguards provided for by the GDPR, in particular the European Commission’s standard contractual clauses.
6. Retention periods
| Data | Period |
|---|---|
| Account and data you enter | For as long as the account exists. |
| Sign-in sessions | 12 hours, or 30 days renewed at each use (90 days at most) with “Remember me”; deleted 7 days after they expire or are closed. |
| Sign-in attempt counters | 24 hours. |
| Technical logs | 12 months at most; those linked to the account are erased when it is deleted. |
| Copies of emails and notifications | For as long as the account exists. |
| Premium subscription | For as long as the account exists. |
| Ad history | For as long as the account exists. |
| Fingerprint of the email address (account deleted after its Premium trial) | 2 years after the account is deleted. |
7. Emptying or deleting your account
Emptying the account (application settings, confirmation by email) erases your tracked assets, transactions, value history and sales reports; the account, its options and its alerts are kept.
Deleting the account (application settings, confirmation by email) permanently erases the account, its options, its wallet, its transactions, its alerts, its notifications and their copies, its sessions, its notification identifiers, its reports, its purchases, its ad history and the technical logs linked to its email address. It does not cancel the Google Play subscription: cancel it in Google Play.
If the account’s Premium trial has ended, an irreversible fingerprint of its email address is kept for 2 years after deletion: it is used only to avoid granting the trial offer a second time to that address.
8. Your rights
In accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act No. 78-17 of 6 January 1978, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to withdraw your consent at any time.
- Portability: the export of your transactions (CSV file) is available in the application settings.
- Erasure: deletion of the account in the application settings.
- Any other request: mcl-support@mycryptolog.com.
You may also lodge a complaint with the French data protection authority (CNIL, www.cnil.fr).
9. Security
Exchanges with the server are encrypted (HTTPS). Passwords are stored as a hash (Argon2id) and session tokens are also stored as a hash. Repeated sign-in attempts are limited, every action is checked against a session, and a notification is sent to your devices each time someone signs in from a web browser. As no measure can guarantee absolute security, the publisher undertakes to fix promptly any flaw brought to its attention.
Fingerprint login (mobile app, optional, can be turned on and off in the settings): the check is done by the phone. No biometric data is sent to or kept by MyCryptoLog; only the session token is stored, encrypted, in the phone’s secure keystore.
10. Local storage and cookies
The application keeps on your device your session token (in local storage with “Remember me”, otherwise until the tab or the application is closed), your language and cached data to speed up display. Neither the application nor this site uses audience measurement cookies. In the Android application, the Google AdMob SDK stores your consent choices on the device.
11. Changes
This policy may change. The date of the last update appears at the top of the page; in the event of a significant change, users are informed in the application.