Privacy Policy

Last updated: November 2026

This Privacy Policy describes how ExchangeRank.com ("we", "us", or "our") collects, uses, and protects information when you visit exchangerank.com (the "Site"). By using the Site, you agree to the practices described in this policy.

1. Data Controller

The data controller for personal data collected through this Site is ExchangeRank.com. For any privacy-related inquiries, contact us via the contact form.

2. Data We Collect

We collect the following categories of data:

Usage Data

Pages visited, time spent on pages, referrer URL, browser type, operating system, and screen resolution. Collected automatically via our analytics system.

IP Address

Your IP address is logged when you click outbound links to cryptocurrency exchanges. We use it to derive approximate country-level geolocation (not precise location). IP addresses are not stored in association with personal identity.

We use session cookies for authentication (if you log in) and analytics cookies to understand aggregate traffic patterns. See Section 5 for details.

Account Data

If you create an account, we store your username, email address, and hashed password. We do not store payment information.

3. How We Use Your Data

To operate and improve the Site and its ranking algorithms

To detect and prevent abuse, fraud, and wash-trading manipulation

To analyze aggregate traffic patterns and understand which exchanges attract the most interest

To send transactional emails (account confirmation, password reset) if you have an account

To comply with legal obligations

4. Legal Basis for Processing (GDPR)

Legitimate Interest (Art. 6(1)(f))

Analytics, security monitoring, and improving ranking quality.

Contract Performance (Art. 6(1)(b))

Processing account data to provide the service you signed up for.

Legal Obligation (Art. 6(1)(c))

Retaining records as required by applicable law.

Consent (Art. 6(1)(a))

Non-essential analytics cookies — you may withdraw consent at any time via your browser settings.

5. Cookie Policy

We use the following categories of cookies:

Cookie	Type	Purpose	Expiry
session	Essential	Authentication session token	Session
_umami_*	Analytics	Anonymous page view tracking (Umami — self-hosted, no third-party sharing)	1 year

You can disable cookies at any time through your browser settings. Disabling essential cookies may prevent you from logging in. Our analytics system (Umami) is self-hosted and does not share data with third parties.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share data in the following limited circumstances:

Service providers: Hosting and infrastructure providers who process data on our behalf under data processing agreements.

Legal requirements: If required by law, court order, or to protect the rights and safety of our users.

Referral links: When you click an exchange referral link, the exchange may set its own cookies. We are not responsible for third-party privacy practices.

7. Data Retention

Click event logs (IP address, country, exchange visited) are retained for 90 days and then automatically deleted. Page view analytics are retained in aggregate form indefinitely. Account data is retained until you delete your account. You may request deletion at any time by contacting us.

8. Your Rights (GDPR)

Right of Access: Request a copy of the personal data we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure: Request deletion of your personal data ('right to be forgotten').

Right to Restriction: Request that we restrict processing of your data in certain circumstances.

Right to Data Portability: Receive your data in a structured, machine-readable format.

Right to Object: Object to processing based on legitimate interests.

Right to Withdraw Consent: Withdraw consent for analytics cookies at any time via browser settings.

To exercise any of these rights, contact us via the contact form. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We implement industry-standard security measures including HTTPS encryption, hashed passwords (bcrypt), and access controls. No system is 100% secure; if you discover a vulnerability, please disclose it responsibly via our contact form.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page. Continued use of the Site after changes constitutes acceptance of the updated policy.

Contact

For privacy-related requests or questions:

Contact Form →