CoinBelieveThis policy governs personal data processing in full adherence to the Digital Personal Data Protection Act, 2023 (DPDP, India), the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and the California Consumer Privacy Act (CCPA/CPRA).
1. Data Categories & Purpose Mapping
| Category | Elements Collected | Processing Purpose | Legal Basis |
|---|---|---|---|
| Identity | Email address, username, display name, avatar URL, bio | Authentication, author attribution, account recovery, security | Contractual Necessity |
| OAuth 2.0 Scope | App client ID, authorization codes, consent records | Third-party identity verification, federated sign-in | Explicit User Consent |
| E2EE Messaging | Client public keys, encrypted ciphertext payloads | Encrypted message routing and storage (Zero-Knowledge) | Contractual Necessity |
| Telemetry | IP address, client user-agent, device trust token | Sybil prevention, DDoS mitigation, 2FA authorization | Legitimate Interest |
| Geolocation | Country code, city-level coordinate approximation | Enforcement of creator geo-restrictions & local compliance | Legitimate Interest |
| Ledger Activity | Internal wallet balances, CBX transactions, burn records | Proof-of-burn verification, reward calculation, payout audit | Contractual Necessity |
| Web Push | VAPID browser subscription endpoint & auth keys | Opt-in research intelligence and market alerts | Explicit Consent |
2. OAuth 2.0 Identity Provider & Third-Party Applications
CoinBelieve functions as an OAuth 2.0 identity provider, enabling authenticated users to sign in to registered third-party applications (such as portfolio trackers, profile aggregators, and partner tools):
- Granular Consent Screen: When authenticating via CoinBelieve OAuth, you are presented with an explicit consent screen detailing the exact third-party application name, registered domain, and requested permissions (e.g., basic profile, username, avatar, bio, website).
- Strict Data Isolation: Third-party applications NEVER receive your account password, two-factor authentication secrets, private cryptographic messaging keys, unencrypted draft articles, or financial ledger credentials.
- Single-Use Authorization Codes: Authorization codes issued during the OAuth handshake are cryptographically randomized, time-restricted (expiring within 10 minutes), and single-use. Codes are permanently consumed immediately upon exchange to prevent replay attacks.
- Revocation of Access: Users maintain the right to review and revoke third-party application authorizations at any time through their security settings.
3. End-to-End Encrypted (E2EE) Messaging & Zero-Knowledge Architecture
CoinBelieve integrates client-side End-to-End Encryption (E2EE) for direct peer-to-peer communications:
- Client-Side Key Generation: Cryptographic key pairs (public and private keys) are derived locally in your browser environment. Your private key is stored exclusively on your device and is never transmitted to our servers.
- Public Key Directory: Only your public key is published on the network to enable other authenticated users to establish an encrypted session with your profile.
- Zero-Knowledge Relay & Storage: Messages in transit and at rest on our server clusters are stored purely as encrypted ciphertext envelopes. CoinBelieve administrators, operators, and automated services have zero technical means to decrypt, inspect, or intercept the plaintext contents of your private communications.
4. Device Verification, Security Telemetry & Session Management
To defend user accounts against unauthorized access, credential stuffing, and session hijacking, we enforce layered defensive telemetry:
- Cryptographic Password Hashing: Account passwords are salted and hashed utilizing memory-hard algorithms (Argon2id and Bcrypt). Plaintext passwords are never logged or stored.
- Two-Factor Authentication (2FA): Time-based One-Time Password (TOTP) protocols complying with RFC 6238. Trusted device tokens expire automatically after 30 days.
- Session Isolation: Sessions are bound to encrypted HTTP-only cookie identifiers with strict SameSite attributes, protected against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
5. Research Telemetry, Collaborative Attribution & Regional Access Logging
When you publish, edit, or interact with technical research on the platform:
- Author Attribution: Public research articles, co-authorship acknowledgments, and published commentary are permanently linked to your public username and profile display.
- Revision Provenance: Revision timestamps and editor logs are maintained to preserve the historical integrity of technical deep dives.
- Edge Geolocation Verification: Country-level IP lookups are performed dynamically at the network edge solely to honor an author's custom geo-fencing rules. These lookups do not compile persistent GPS tracking histories.
6. Artificial Intelligence & Automated Processing Disclosures
CoinBelieve utilizes artificial intelligence and neural machine translation technologies to improve reader accessibility:
- AI Research Synthesis (Google Gemini): Publicly posted technical research may be synthesized by Google Gemini models to generate executive summaries and key bullet points. No private personal identifiable information (PII), private messages, or unreleased drafts are transmitted to generative models.
- Multilingual Neural Translation: Articles and author bios are dynamically translated for global readers via neural translation pipelines. Cached translations are maintained in system tables for rapid localized access.
7. Two-Tier Account Deletion & Data Rights
In fulfillment of GDPR Article 17 (Right to Erasure) and DPDP guidelines, CoinBelieve provides an automated, self-service account termination suite accessible directly via the user dashboard at /delete/account/:
Option 1: Standard Deactivation (Reversible Soft Deletion)
Instantly hides user profile, follower associations, and published articles from public visibility (is_hidden = 1). Account credentials and historical ledger claims are preserved in a dormant state for reactivation upon verified request.
Option 2: Full GDPR Data Wipe (Permanent Irrevocable Purge)
Permanently executes hard cascading deletion from active database clusters. User email, passwords, cryptographic profile links, and draft intellectual property are eradicated immediately. Verified by UTC time-restricted email authorization codes.
8. Third-Party Service Providers
Personal data is never sold or rented. We exchange data only with vetted enterprise infrastructure providers bound by rigorous Data Processing Agreements (DPAs):
- Cloudflare Inc. (USA/Global): Edge network caching, DDoS mitigation, TLS 1.3 encryption, and Web Application Firewall (WAF).
- Google LLC (USA): Gemini AI processing, Google Neural Translation, and Google AdSense ad impression auditing.
- MaxMind & ProxyCheck: IP-based city-level geolocation and VPN/proxy reputation checks to enforce creator geo-fencing.
- TradingView Inc. & Binance: Delivery of live cryptocurrency spot rates and interactive market charting widgets.
9. Your Rights
Depending on where you live, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to receive a copy of your personal data in a structured, portable format, to withdraw consent at any time, and to lodge a complaint with your supervisory data protection authority. We do not sell personal data. To exercise any of these rights, email [email protected]. We honor Global Privacy Control (GPC) signals.
10. Retention, Children & Changes
We retain account data while your account is active and remove it as described in section 7 when you request deletion. Records we must maintain by law are kept for the statutory period required. CoinBelieve is strictly not for anyone under 18 years of age. If material changes are made to this policy, we will update the date at the top of this page.