Privacy Policy

Last updated: September 25, 2026

CryptoSage AI (“the app”, “we”, “us”) is an iOS app for tracking a crypto portfolio, reading market data and asking an AI about both. This policy describes exactly what data the app touches, what stays on your iPhone, and names the companies that receive any of it. The short version: we do not sell your data, the app shows no ads, and an account is optional.

1. What stays on your device

• Exchange API keys and secrets are stored in the iOS Keychain on your iPhone — the same system that protects your saved passwords. The app does not upload your exchange credentials to our servers.
• AI provider API keys you add yourself (see section 3) are also stored in the iOS Keychain.
• Your app-lock PIN and biometric setting never leave the device.
• Manually entered holdings, preferences and cached market data live on the device. If you never create an account, everything in section 2 stays on the device too.

We never ask for, receive or store exchange passwords, seed phrases or private keys. Wallets are tracked by public address only.

2. If you create an account (optional)

You can use CryptoSage without an account. If you sign in — with Apple, Google or an email address and password — sign-in is handled by Google Firebase Authentication, so Google processes the sign-in and we receive your email address, a display name and an account ID. Using AI chat without an account can create an anonymous Firebase sign-in (a random account ID with no email or name) so our backend can rate-limit requests.

With an account, app data syncs to Google Cloud Firestore so it follows you between devices. That synced data includes:

• your watchlist and favorites,
• your price alerts, and the device push token needed to deliver them (section 7),
• your AI chat conversations,
• your paper-trading balances and simulated trade history,
• your AI prediction-tracking history, and
• your profile fields — display name, bio, phone number and avatar image — plus any AI memory or personalization you set up.

Your portfolio holdings, transactions and exchange connections do not sync. They stay on this device, and the exchange keys themselves stay in the iOS Keychain — they are never written to our servers, with or without an account.

3. AI questions go to AI companies

Starting with version 1.3.8, CryptoSage asks for explicit AI Data Sharing permission and names the recipients before a personal AI request leaves your device. Declining keeps these requests off. Markets, charts and local portfolio tools remain available.

The AI features are not computed on your iPhone. With permission, an AI chat question is sent with your recent conversation since your last sharing change, your saved AI profile, memories and watchlist, your paper-trading activity, your price alerts, and your app settings (plan, display currency, region, local time and time zone, and trading-pair preferences such as favorite and recent pairs and preferred exchanges). Real holdings, balances, transactions and profit/loss are added only when you separately turn on portfolio sharing (below). These services receive it:

• OpenAI — powers our built-in AI chat (including its second-opinion check on questions about a coin), AI portfolio insights and screenshot reading. In this built-in service, apart from web research below, your question, conversation, AI profile and memories, watchlist, paper trades, price alerts, app settings and, only with portfolio sharing on, your portfolio go to OpenAI only, through our backend (Google Firebase Cloud Functions). Saved personal API keys can use a different route, as explained below.
• DeepSeek, OpenRouter or OpenAI — our backend uses DeepSeek first, with OpenRouter and OpenAI as backups, for shared market features: sentiment summaries, coin insights, price predictions, trading signals and Fear & Greed commentary. These backend requests contain public market figures only — never your question, conversation, profile, watchlist, paper trades, price alerts, app settings or portfolio — and the same result is shown to every user. Within our built-in service, DeepSeek and OpenRouter receive none of your personal data.
• Tavily — built-in web research. When server web search is on, the text of a research question, or a search phrase the AI writes from it, is sent through our backend to Tavily to find current web results. Web search stays switched off on our servers unless Tavily has agreed in writing to use that text only to answer the search and not to train on it.
• Your own API key — this App Store version has no setting for adding one. If a key saved by an earlier version is still on this iPhone, requests can fall back to that provider directly from this device under your own account. Depending on the saved key, OpenAI, DeepSeek, xAI (Grok) or OpenRouter can receive your question, conversation and permitted context; a saved Tavily key can send a web-research query directly to Tavily. The permission screen names these recipients before anything is sent. These direct requests use your provider account and its terms, rather than our built-in OpenAI-only route or server web-search switch.

Real-portfolio sharing is a separate, optional choice and is off until you explicitly enable it. Holdings, balances, transactions and profit/loss are included in portfolio context and AI portfolio insights only when this option is on. An older default-on setting does not grant permission. Paper and demo data do not need the real-portfolio option, but sending simulated data to an AI provider still requires general AI permission.

Change or revoke permission in Settings › Privacy & Analytics. Each sharing change starts a new outgoing history window: older messages stay visible in your conversation but are not sent again as history. Turning off portfolio sharing stops AI portfolio insights and excludes real-portfolio context from new requests. Revocation stops future sharing; it cannot recall data already sent or delete existing local or synced conversations.

Screenshots in the AI chat. If you attach screenshots or photos to a chat message and give separate screenshot-sharing permission, they are sent with that one message through our backend (Google Firebase Cloud Functions) to OpenAI so the assistant can read them. We do not store them on our servers, and they are not sent again with later messages. The copy in your chat history stays on your iPhone: when your conversations sync, the image itself is not uploaded, only its file name.

Same or equal protection. For our built-in service, OpenAI, Google (which runs our backend on Firebase and Google Cloud) and, whenever server web search is on, Tavily receive only the data they need to provide their part of CryptoSage, under API and data-processing terms that limit their use of it to providing that service and require confidentiality and security. OpenAI does not use API data to train its models and keeps it for up to 30 days to monitor abuse, unless the law requires longer. We confirm that they protect your data to the same or an equal standard as this policy describes and as Apple’s App Store Review Guidelines require. None of them may sell it or use it for advertising. Please still don’t type or attach anything you would not want an AI provider to process — crop out account numbers, API keys and balances you would rather keep private. The public services in section 4 are not our service providers: your device asks them directly for public prices, news and on-chain data, under their own policies.

4. Market data, news and blockchains

Prices, charts, news and on-chain balances are fetched by your device directly from the services that publish them, so those services see your IP address under their own privacy policies. The main ones are:

• Market data and charts: CoinGecko, Binance, Coinbase, Kraken, KuCoin, Bybit, OKX, Gemini and TradingView.
• News: the crypto publishers whose feeds the app reads directly (Cointelegraph, Decrypt, CoinDesk, The Defiant, The Block, CryptoSlate, Bitcoin Magazine, Bitcoin.com News, CryptoPotato, BeInCrypto and Crypto Briefing; their sites also serve the article images), plus CryptoCompare, Google News and Yahoo Finance.
• Blockchain data for wallet addresses you track: public services such as Etherscan, Solscan and Ankr RPC endpoints.
• Country check: ipapi.co, or ipwho.is as a fallback, sees your IP address when the app checks which country it is running in so it can apply regional rules; the app uses only the country code.
• Your connected exchanges receive read-only requests for your balances and holdings. Live orders and changes to exchange positions or leverage are disabled in this version.

5. Analytics and crash reports

We use Google Firebase Analytics for usage statistics (which screens and features are used, the coin symbols you open or trade inside the app, how many exchanges you have connected, device model, iOS version, session length) and Google Firebase Crashlytics for crash and stability reports. These events do not contain your portfolio contents, chat text, keys or credentials. The data is processed by Google under Google’s terms.

Both are on by default. You can turn analytics off in the app under Settings › Privacy & Analytics, and the app stops sending those events. Crash reporting has no separate switch in this build, so turning analytics off leaves Crashlytics running — we would rather say that than let the sentence above imply a control that is not there.

6. Advertising: none

The app shows no third-party ads and sends no data to advertising networks. Google’s Mobile Ads SDK and the advertising identifier were removed: the current build links no advertising SDK, requests no ads, and shows no App Tracking Transparency prompt. We do not track you across other companies’ apps or websites. If ads are ever introduced, this policy will be updated first.

7. Notifications and price alerts

Push notifications are optional and controlled by iOS. If you use price alerts while signed in, the alert definitions and your device’s push token are stored on our backend so alerts can fire while the app is closed. Notifications are delivered through Apple’s push service and Google’s Firebase Cloud Messaging.

8. Purchases

Subscriptions are bought through Apple. Apple handles the payment and shares no card details with us; our backend receives the App Store receipt only to confirm which plan is active. Refunds are handled by Apple — see the support page.

9. Security

• Exchange and AI credentials are stored in the iOS Keychain, not in app files.
• Network connections use HTTPS (TLS) encryption in transit.
• Exchange connections are for portfolio tracking; the app never asks for withdrawal or transfer permissions, and we recommend creating read-only API keys — a read-only key cannot place, close or modify anything on your account.
• Optional Face ID / Touch ID app lock, enforced on your device.

10. Deleting your data

• Disconnect an exchange or wallet at any time from Settings › Exchanges & Wallets; removing a connection removes its stored credentials from your device.
• Delete conversations from the AI chat screen to remove them from your iPhone. If a conversation had already synced while you were signed in, deleting it in the app does not delete the cloud copy — delete your account or email us and we will remove it.
• Delete your account from inside the app (Settings › your profile › Delete Account). This deletes your synced data on our servers (Firestore) and the sign-in record itself.
• Delete the app to remove its local data from your iPhone.
• Or email hypersageailabs@gmail.com and we will do it for you.

11. Your rights (California, EEA/UK and elsewhere)

Wherever you live, you can ask us what data we hold about you, ask for a copy, ask us to correct it, or ask us to delete it — the in-app tools above cover most of this instantly, and the email address below covers the rest. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. California residents may exercise CCPA rights, and EEA/UK residents GDPR rights (access, rectification, erasure, restriction, portability, objection), by emailing hypersageailabs@gmail.com with “Data Request” in the subject line.

12. Children

CryptoSage is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has provided us personal information, email us and we will delete it.

13. This website

This website (cryptosageai.io) is a separate surface from the app, and it does two things worth naming:

• It uses Google Analytics to count visits, which processes your IP address and browser information under Google’s terms.
• If you submit your email in the “Keep me posted” form at the bottom of the home page, that email address (with the time and your browser’s user-agent string) is stored in our Google Cloud Firestore database and used only to contact you about CryptoSage. Email hypersageailabs@gmail.com to be removed.

14. Changes to this policy

If we change what the app collects or who receives it, we will update this page and its date first. Significant changes will also be announced in the app.

15. Contact

Privacy questions and data requests: hypersageailabs@gmail.com. A real person reads every message.