When you visit the website

• Google Analytics: every page loads Google Analytics 4. It records page views, device and browser type, approximate location and a random identifier stored in Google’s cookies, so we can see which pages are used. Google receives your IP address to provide this service.
• Referral clicks: when you click a “Register” or referral link we record the exchange, the time, the page you came from, a campaign tag, your country (as reported by our CDN), whether the request looks like a browser or a bot, and hashes calculated from your IP address and the date. We do not store the IP address itself; the hashes let us group repeat clicks on the same day and filter automated traffic.
• Access logs: our web server keeps standard access logs (IP address, requested address, time, referring page and browser user agent) for about 15 days for security and troubleshooting. Our CDN, Cloudflare, processes the same information to deliver and protect the site.
• Visits from AI assistants: if you open our site from an AI assistant’s answer, we count the visit by page and referring service without storing an identifier. When AI crawlers fetch our machine-readable pages (/llms.txt, /for-agents), we record the crawler’s user agent, the page, its country and a hash of its IP address.

If you create an account (optional)

• Every lookup works without an account. If you register we store your email address, a bcrypt-hashed password, an optional display name, an account number we generate and who invited you, if anyone. Comments and likes are stored with your account; comments are shown publicly with your display name and avatar, never your email address.
• Rebate claims: if you submit an exchange account ID (UID), we store the exchange, the UID, the referral code you tell us you used and the review status. For Binance UIDs we ask Binance’s affiliate service about accounts referred through our code and store what it returns: registration date, identity-verification (KYC) completion date, first trade date, VIP level and trading volume. We use this only to confirm rebate attribution.
• Password resets: we store your email address, a hashed one-time code and a hashed network identifier. Automatic reset email is not set up yet, so a reset request sends your email address and the code to our administrator on Telegram, who then sends you the code.
• A login cookie keeps you signed in for up to 30 days.

The AI chat assistant on the website

Messages you type into the chat assistant, together with up to 10 earlier messages from the same conversation and your language setting, are sent to our AI provider (currently DeepSeek) to generate a reply. We do not store chat conversations on our servers. Please do not type personal or sensitive information into the chat.

Our open API, MCP server and the ChatGPT plugin

• When an AI assistant calls our tools (for example through the CoinRebate plugin in ChatGPT), we receive the tool call and its parameters plus standard technical request information from the calling service. We do not receive your account with the assistant, your name, your email address or the rest of your conversation. Requests made through ChatGPT come from OpenAI’s servers, so the network information we see belongs to OpenAI, not to you.
• For each call we record the hour (UTC), the tool or method, whether it was answered and if not why, a response-time bracket, coarse parameters (country code, product type, exchange, and a trading-volume bracket instead of the exact amount), the country of the request as reported by our CDN, whether the caller looks like a browser or a bot, and a source identifier calculated from the IP address with a random value that is replaced every day, so calls cannot be linked across days. For guide searches we keep the search phrase after removing email addresses, links, wallet addresses, handles and long numbers; for checks of links on domains we do not recognise we keep only the domain name.
• These per-call records are deleted after 30 days. Daily totals are kept for 180 days; they include up to the 50 most common search phrases and unrecognised domains for each day.
• When the recommendation tool is used we also keep a quote log: the time, country, product type, volume bracket, the recommendation and its reasons. It contains no identifier of the caller.
• The IP address of a call is used only in memory for rate limiting and is not written to these records (our web server’s access logs, described above, still record it).

When you contact us

If you email us or message us on Telegram, we keep the correspondence so we can reply.

We never ask for exchange passwords, API keys, private keys, seed phrases, payment card numbers or identity documents.

• x-country: your country code as reported by our CDN, kept for 1 hour so we can show the exchanges available where you are.
• Login and security cookies (only if you sign in): up to 30 days.
• Google Analytics cookies (_ga, _ga_…): set by Google, for up to 2 years.
• cr_internal: set only on our own team’s browsers (for 1 year) to keep their visits out of the statistics.

You can block or delete cookies in your browser settings; blocking Google Analytics cookies does not stop the site from working.

• Cloudflare (CDN and security): all traffic to the site and the API.
• Alibaba Cloud (hosting; servers in Singapore): stores the data described in this policy.
• Google (Google Analytics): page views on the website.
• DeepSeek (AI provider for the website chat): the messages you send in the chat.
• Telegram: password-reset requests (see above) and messages you send us there.
• Binance: a Binance UID you submit for rebate verification.
• Exchanges: when you follow a referral link you go to the exchange’s own site, which receives the referral code in the link and handles your registration under its own privacy policy. We do not send exchanges your personal data. When an AI assistant asks us to check an exchange link, we fetch that link ourselves, without your IP address.

These providers may process data outside your country, including in the United States (Google, Cloudflare) and China (DeepSeek). We do not sell personal data or share it for advertising.

• Per-call API / MCP records: 30 days; daily totals: 180 days.
• Web server access logs: about 15 days.
• Account data, comments, likes and rebate claims: until you ask us to delete your account.
• Password-reset records: until your account is deleted.
• Referral-click records, the recommendation quote log and AI-crawler visit records: kept for statistics with no fixed deletion date; they contain no names, email addresses or raw IP addresses.
• Backups: database backups are kept for 30 days on our server and for up to 90 days in an off-site copy, so deleted data can remain in backups until they expire.
• Google Analytics: according to our Google Analytics retention setting, at most 14 months for event data.

• Use every lookup and comparison without an account.
• Email support@coinrebate.vip to access, correct or delete your account data (email address, display name, comments, likes, rebate claims and password-reset records); we reply within 30 days. There is no self-service delete button yet.
• Block or delete cookies in your browser, or install Google’s Analytics opt-out browser add-on.
• In ChatGPT you decide whether to connect the CoinRebate plugin, and you can disconnect it at any time.

CoinRebate is not intended for anyone under 18.

The site and the API use HTTPS throughout. Passwords are stored as bcrypt hashes. Only our own team can sign in to our servers.

When this policy changes, we update the date at the top of this page.

If you have any questions about this policy, email support@coinrebate.vip or message @coinrebate on Telegram.