Privacy Policy

General

This Policy describes what data Changezilla processes in the Telegram app and on the website changezilla.online. We collect the minimum data needed for the exchange and do not ask for your name, phone number, email or documents. If you write to support, we receive your email address and the text of your message.

What data we process

• In Telegram: your Telegram ID, interface language and permission for the bot to message you — from the launch data signed by Telegram. The launch data itself is not stored.
• On the website: there is no account and no Telegram ID. An exchange is linked to a random secret key created by your browser; the server stores only its hash, from which the key cannot be recovered.
• Exchange data (both channels): currencies and networks, amounts (estimate, expected and actual), recipient address and memo/tag, refund address and its memo/tag (if provided), deposit address, the exchange number at the exchange service, status and its changes, transaction hashes, creation and update time.
• IP address is not stored in the database. The server keeps it in memory (until restart) to limit request rates. Web server logs (IP address, time, request address) are kept for 14 days. Wallet addresses and secret keys do not get into them: they are sent in the request body or header, not in the address.

Analytics and marketing

• Ad visit. If you opened the app via an ad link, we store the campaign tag and the ad network's click ID and link them to your Telegram ID. If you came to the website via such a link, links from the website to Telegram pass this tag on.
• Steps in the Telegram app: opening, estimate, entering addresses, reviewing the exchange, creating it, deposit received, exchange finished — together with your Telegram ID, language, campaign tag and click ID (if there was an ad visit), without amounts or addresses.
• Messages to the ad network. On events after an ad visit (app opened, exchange created, deposit received, exchange finished) our server may send the ad network its click ID and the event name. Your Telegram ID, amounts, addresses and IP address are not sent.
• Steps on the website: page opened, calculator used, estimate received, checkout opened, exchange created, paid and finished — together with a random tab ID, the UTM tags of the link you came from, the page language, the type of the first page opened (for example, an exchange direction or a guide page) and the type of website you came from (for example, a search engine or an AI assistant) — without its address. The tags are also saved with the exchange. IP address, browser details, addresses, amounts and secret keys are not recorded.
• If your browser has Do Not Track or Global Privacy Control turned on, the website does not send steps and does not link the exchange to the visit.
• There are no cookies and no third-party counters or trackers on the website or in the app.

Storage in your browser

• Telegram app: the selected language and theme (localStorage). The Telegram script keeps launch parameters until the app is closed (sessionStorage).
• Website: language and theme; the list of your exchanges on this device — number, secret key, pair, amount and creation time, up to 20 exchanges (localStorage); while an exchange is being placed — the attempt data without wallet addresses. Until the tab is closed — a random tab ID, UTM tags and the ad link tag (sessionStorage).
• You can delete exchange data from the device with the "Remove my exchanges and data from this device" button on the website. On a shared or someone else's device, do it after the exchange.

Secret exchange link

• A website exchange link contains the secret key after the "#" sign. This part of the link is not sent to the server, and the page removes it from the address bar right away.
• Anyone who has the link can see the exchange: status, amounts, addresses and deposit details. Do not publish the link; it may remain in the browser history.

Why

• To create an exchange, complete it and show its status.
• To show "My exchanges" in Telegram and the exchange on the website via its link, and to send status notifications in Telegram.
• To find an exchange after a connection failure and to answer support requests.
• To see which ads work and where the Service is hard to use (in aggregated reports).
• For security and abuse prevention.

Data transfer

• To the cryptocurrency exchange service that performs the exchange — only the data needed for the exchange and address check: currencies, networks, amount, addresses and memo/tag; the exchange number in the Service may be included. Your Telegram ID, IP address and browser details are not sent. It processes the data under its own rules and may request identity verification itself (see the Terms).
• Telegram: the app runs inside Telegram; exchange notifications are sent via Telegram and contain the exchange number and status and may contain the amount, coin and network — no addresses.
• To the ad network — only its click ID and the event name (see "Analytics and marketing").
• To the hosting provider: the data is stored on a rented server.
• Our server downloads coin images itself and serves them from its own address: your device does not contact third-party servers for them.
• We do not sell data or share it with anyone else unless required by law.

Retention

• Completed exchanges (finished or refunded) are deleted 90 days after completion, rejected ones (no exchange took place) 90 days after the rejection, together with the exchange event log.
• Exchanges with no deposit received, as well as unfinished and disputed ones (under review, failed, unknown status) are not deleted automatically.
• Analytics and ad visit records are not deleted automatically yet.
• Web server logs — 14 days.
• Database backups are kept on the same server; data in them remains until the backup is deleted.
• Data in your browser is kept until you delete it; sessionStorage data until the tab is closed.

Data protection

Connections are encrypted (HTTPS). The database is on the Service's server; it is accessible to the Service and its administrators. Telegram launch data is verified by its signature; secret keys of website exchanges are stored only as a hash.

Changes and contact

We may update this Policy; the new version takes effect when published. Questions about your data — support@changezilla.online.