Privacy policy

Effective 24 October 2026

This policy covers trenchscanner.app, its API, the TrenchScanner phone app, the Telegram bot and the Trench Overlay browser extension (which also has its own short policy). "We" means the people who run TrenchScanner.

In short: your account is a Solana wallet address, which is public on the blockchain anyway. We don't run ads, analytics or tracking, and we don't sell or share your data for marketing.

What we collect, and why

• Your wallet address. It is your account. Signing in proves you hold the wallet with a signed message. We never see your own wallet's private key.
• Email, Google or X sign-in. If you sign in this way, Privy handles the sign-in and holds the wallet it makes for you, under its own terms and privacy policy. We keep only Privy's user ID and that wallet's address.
• Your settings and the things you make. Filters, alert and display preferences, followed models, watchlist, hidden tokens, tracked wallets, linked Telegram chats, push notification subscriptions and paper-trading strategies. We use them to run the features you set up.
• Access and payments. Your subscription dates, and the on-chain burn transactions that paid for access or credits. Those transactions are public on the blockchain.
• Security. Two-factor settings and passkeys (public keys only), linked phones (with the device description your phone reported), and keys you create for the API, Model Alerts and the browser extension. We store keys only as one-way digests.
• Trading records. If you trade through TrenchScanner, the orders, positions and transaction signatures, so we can show your history. Trades you sign with your own wallet stay under your control. If you use a trading wallet that TrenchScanner holds for you, where offered, its private key is encrypted with a key managed in AWS Key Management Service, and withdrawals only go to the wallet you signed in with.
• Reports you send us. A bug report or suggestion holds your message, an optional contact detail and an optional screenshot. We delete the screenshot a week after the report is dealt with. Error reports from the site hold the page and the error, and are logged rather than stored.
• Technical data. Your IP address and browser details reach our servers with every request. We use them to limit abuse (rate limits, and a one-way digest of the IP for anonymous reports) and they can appear in short-lived server logs at our hosting provider.

Cookies and storage in your browser

We set one cookie: your sign-in session. It's needed for signing in, and it isn't used for tracking. The site also keeps preferences and a cache of recent data in your browser's local storage so pages load fast. No advertising or analytics cookies are used.

Who else handles data

• Render hosts the site, the API and the database. An S3-compatible cloud storage service holds database backups.
• Privy, for email, Google and X sign-in.
• AWS Key Management Service, for the keys of server-held trading wallets.
• Your browser's push service (for example Google, Apple or Mozilla) delivers push notifications, and Telegram delivers alerts to chats you link.
• Solana RPC providers (such as Helius) and market data services (such as DexScreener, Pump.fun, RugCheck and CoinGecko) receive token and wallet addresses when we look up public on-chain data. Trades are sent to the Solana network, where they are public.
• AI models review public token data. Your personal data isn't sent to them.

We share data with others only as listed here, when the law requires it, or to protect the service.

How long we keep it

We keep account data while your account is in use. Bug report screenshots go a week after the report is dealt with, and server logs roll over at our host. Data written to the blockchain can't be deleted by anyone.

Your choices and rights

• You can change or delete your filters, settings, keys, linked chats and devices in the app.
• Signing out signs you out everywhere and revokes linked phones and extension keys.
• You can ask for a copy of your data, a correction, or deletion of your account by messaging @trench__scanner on X or using the bug button on any screen of the site. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA. We'll respond within the time those laws set.

Security

Connections are encrypted, keys are stored as digests, and server-held wallet keys are encrypted with AWS KMS. No system is perfectly secure, so keep your own wallet's keys safe and never share them.

Children

TrenchScanner is for adults. It isn't meant for anyone under 18.

Changes

If we change what we collect or how we use it, we update this page first and change the date above.

Contact

Questions or requests: message @trench__scanner on X, or use the bug button on any screen of the site.