Privacy Policy

The data controller is Baltas Mazgas, registered in Lithuania, company code 307574335. Contact for anything in this policy: [email protected].

We only process data CTR needs to work, to keep accounts safe, and to meet our legal obligations.

We do not sell personal data, do not build advertising profiles, and do not use your transaction data for anything other than providing CTR to you.

Session cookie. A signed, HTTP-only cookie keeps you logged in. It is strictly necessary and set only when you sign in.

Preferences. Small settings such as your selected tax year, table columns and filter choices are kept in your browser’s local storage and never sent to us as tracking data.

Analytics and marketing. Google Analytics is on by default. On every page we load Google Tag Manager and use Google Analytics for usage and conversion measurement (pages visited, approximate location, device type and actions in the product), including while you are signed in: by creating an account and using CTR you accept that analytics and marketing cookies are enabled by default, before you have answered the cookie banner. No transaction history, names or email addresses are sent to it. You can turn it off at any time, and it is a real switch: open Cookie settings below, untick Analytics and save, and the tag stops running, the cookies it set are cleared and nothing further is sent. Marketing cookies are on by default in the same way. Google Ads uses conversion data for advertising attribution and personalization from your first page unless you turn it off, which you do exactly as above: open Cookie settings, untick Marketing and save. Google may set cookies and processes the data under its own terms. Your choice is stored in this browser for this website for 180 days, and if you are signed in when you make it we also record it on your account, so that we can show you what you selected and evidence it; the copy in this browser is what governs this browser. Withdrawing stops future tracking; it does not erase data already sent to Google.

We use a small number of service providers, each only for the purpose named:

• Hosting. CTR and its database run on a server we rent in a European Union data centre. Backups are kept on that server.
• Exchanges and blockchain data providers. When you connect an exchange or add a wallet, we send that exchange or a public blockchain explorer only what is needed to read your history (your API key, or the public address). They see the request come from us.
• Market price providers (for example CoinGecko and CoinMarketCap). We request prices for asset symbols and dates. No account or personal data is included in those requests.
• Google and Facebook, only if you choose to sign in with them. They learn that you used your account to sign in to CTR.
• Stripe. If you buy a plan, an additional feature or service credit, we send Stripe your email address, the purchase selected and the amount due. You enter payment-card details directly in Stripe's environment; we do not store the full card details. We retain payment-related Stripe identifiers, subscription status and invoice data.
• AI providers (OpenAI, Anthropic or Google Gemini), only when you use “Ask AI about this transaction”. That transaction's details are sent to the provider we currently use, on our own account with them — you no longer supply a key of your own — and are processed under that provider's terms. Nothing is sent unless you press the button, and each answer is paid from your account credit.
• Email delivery. Transactional emails (accountant invitations, security notices, newsletter) go through our SMTP provider.
• Google Analytics, as described in section 3.
• Your accountant, only through a read-only link you create yourself and can revoke at any time.

We disclose data to authorities only where the law requires it.

Your account and transaction data are stored in the EU. Some providers above, including Google, Facebook, Stripe, OpenAI, Anthropic, CoinGecko and CoinMarketCap, are established or process data in the United States. For transfers outside the European Economic Area, we rely on an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework for participating organisations, or the European Commission’s Standard Contractual Clauses. We send only the necessary data described above.

• Account and transaction data: for as long as your account exists. You can delete every transaction, disconnect every source and remove saved keys yourself at any time; when your account is closed the data is deleted.
• Subscription, payment and service-credit records: while your account exists. The payment provider may retain payment and invoice data for longer where required by its legal obligations.
• Bug reports and attached screenshots: while your account exists; they are deleted with the account when it is closed.
• Security and audit log: kept while the account exists so you and we can review activity on it, and for a reasonable period afterwards to investigate abuse.
• Login-attempt and rate-limit counters: a few hours to days, then deleted automatically.
• Upstream request monitoring (which of our providers we called, how fast, whether it failed): individual records for 7 days, hourly totals for 90 days. These contain no transaction data.
• Accountant links: until they expire (at most one year) or you revoke them; the record of when a link was used stays with the account.
• Newsletter address: until you unsubscribe.
• Backups: rotated on a short cycle, so deleted data leaves backups within a few weeks.

Under the GDPR you can ask us at any time to:

• access the personal data we hold about you;
• correct it (most of it you can edit yourself under Settings);
• delete it (close your account, or delete your transactions and connections yourself);
• receive a copy in a portable format — the Transactions page exports your full history as CSV, and your reports as PDF;
• restrict or object to processing based on our legitimate interests;
• withdraw consent where processing is based on it (the newsletter, and optional analytics and advertising cookies) without affecting what was done before.

Write to [email protected]; we answer within one month. You also have the right to complain to a supervisory authority — in Lithuania, the State Data Protection Inspectorate (VDAI, vdai.lrv.lt) — or to the authority in the EU country where you live.

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored only as bcrypt hashes; exchange API keys are encrypted at rest with AES-256-GCM.
• Exchange connections require read-only API keys; wallet imports use public addresses only — we never ask for a private key or seed phrase.
• Repeated failed logins lock the account and the source address temporarily; sensitive actions are rate-limited and logged; automated monitoring raises alerts on suspicious patterns.
• Changing your password signs you out on every device; a suspended account stops working within minutes.
• Accountant links are random 256-bit tokens of which only a hash is stored, and are read-only by construction.

CTR is for adults. We do not knowingly collect data from anyone under 18; if you believe a child has created an account, contact us and we will delete it.

We may update this policy as CTR changes. The effective date at the top shows the current version; for material changes we will notify registered users by email or an in-app notice.

Questions or requests about your data: [email protected].