Privacy
onchain data bank · this edition: 17 August 2026
This page covers onchainbank.com and app.onchainbank.com. It is short because there is little to describe: the product is market data, its readers are analysts and machines, and neither the site nor the data behind it is built on knowing who you are.
The short version
- No advertising, no advertising networks, no third-party tracking scripts, no profiling.
- No account is needed to read the public pages, and no sign-up form exists on them.
- We do not store the IP address of a visit – see Traffic below.
- Nothing about you is sold, rented or shared for anyone else's marketing.
Cookies
Only what a page needs to work or what you yourself chose – which is why there is no consent banner here. Nothing below identifies a person or follows one across other sites.
| name | what it is for | how long |
|---|---|---|
| nav | which navigation the page should draw (public site or dashboard) | the browsing session |
| who | the initials and role shown in the corner when a session is signed in – empty and immediately expired for everyone else | the browsing session |
| theme | the light or dark theme you picked with the switcher, written only after you press it | one year |
| session | the signed-in session of the dashboard – set by the door, and only for people who have an account with us | until sign-out |
| __cf_bm and the like | Cloudflare's security cookies, set by the network in front of the site to tell a browser from an attack | minutes to a day |
Your browser also keeps a few choices locally (local storage): the Mono switch, the last window you were looking at, the size of a list. They never leave the browser and are not read by us.
Traffic
We count visits ourselves, on the server, because the readers that matter most here are machines: an AI agent runs no scripts, so a counter living in a browser cannot see it at all. Each request for a page or for one of the machine-readable files is recorded as one row:
| stored | what it is |
|---|---|
| host, path | which page was served |
| referrer | the page that linked here, when the browser sends one |
| country | two letters, as named by Cloudflare |
| user agent | what the client calls itself, cut to 200 characters, plus our reading of it: a person, a search crawler, an AI agent, another machine |
| languages | the list your browser sends with every request – used only inside the fingerprint below, never stored on its own |
| visitor | sixteen characters of a salted hash – see below |
| the two halves | the same hash taken apart – the network on its own, the browser on its own – so that two rows of one reader can be told from two readers behind one gateway |
| rendered | whether a browser actually drew the page |
We do not store the address of a visit, and we do not hash it either. What goes into the one-way hash is the network BLOCK your request came from (the last part of an IPv4 address is dropped, and rather more of an IPv6 one), the languages your browser asks pages in, the user agent, the current thirty-day window and a secret salt. We keep sixteen characters of the result. It cannot be turned back into an address, and when the window turns over the same reader becomes a new one. Rows are deleted after 90 days.
It is a pseudonymous measurement identifier, not an anonymous one. It exists in order to tell a returning reader from a new one, which is exactly what makes it capable, in principle, of relating to a person - and under the GDPR an online identifier of that kind is treated as personal data whether or not we can put a name to it. So we say what it is rather than calling it anonymous: it rotates every thirty days, it is not designed to reveal who you are, and nothing on our side joins it to anything else.
The network sees what a network must see. We keep no addresses in our own analytics, but the providers that deliver and protect this site - Cloudflare in front of it, Railway underneath - necessarily process the address of a connection in order to route it and to tell a browser from an attack. That processing is theirs and transient, and it is the same for every site on the internet.
The block is deliberately coarse - it is shared by a whole neighbourhood - so this is a count and not an identity, and it is wrong in both directions at once. Several readers behind one office or mobile gateway arrive as one. A phone or a laptop that rotates its IPv6 address, or steps from a home network to a cellular one, arrives as several. Without a cookie there is no fixing either, and we would rather keep the count crooked than set one.
Alongside it we use Cloudflare Web Analytics, which is cookieless and aggregate: page views, countries, referrers and loading speed, with no identifier of any kind.
If you have an account
Accounts exist only for the people who run this service. For them we keep a user name, a password hash and the times of sign-in – nothing else, and nothing derived from what they look at.
Who processes what for us
- Cloudflare – the network in front of both hosts: protection, caching and the cookieless analytics named above.
- Railway – where the services and the database run.
The market data itself comes from public exchange feeds and commercial data providers, including on-chain, ETF and macro data, and the model opinions published on this site are generated from that data. None of it contains anything about the people who read it.
Your rights
Under the GDPR you may ask what we hold about you, ask for a copy, ask for it to be corrected or deleted, and object to processing. What we hold is described above and it is little: a pseudonymous identifier that rotates every thirty days and the rows of the visits behind it. We cannot look you up by name, so a request has to bring something we can match on - and we will say plainly what we found rather than sending a form back.
Write to [email protected]. You may also complain to your national data protection authority.
Changes
The date at the top is the edition. The day this page has to say something new – a new tool, a new kind of data – it will say it here, and the date will move with it.