Privacy Policy

The short version

We store your email address, what you asked our servers for, and enough about your browser to tell visitors apart. We use it to run the service, bill it and keep it from being abused. We do not sell it. You can ask us to delete it, and we will.

What we collect

Your account

Your email address, from Google sign-in. Older accounts hold a Solana wallet address instead. We also store the time you last signed in, when each plan expires, and a random identifier that stands in for you in our analytics so your email never leaves our database for that purpose.

What you ask our servers for

For every API call: the method, the path, the query string, the response status, how long it took, your IP address, which API key was used and a request identifier. For every WebSocket stream: when it connected and disconnected, why it ended, your IP address and your browser or client user agent.

Payments

For a pay-per-call payment: the paying wallet address, the amount, the network, the transaction signature, whether it settled, and the IP address it came from. Subscription payments arrive as ordinary Solana transfers, which are public on the blockchain whether or not we record them.

Your visits to this website

A visitor identifier, a browser fingerprint and the browser properties it is computed from, your IP address, your user agent, when we first and last saw you, and how many times you have visited.

Connected apps

Which applications you approved, when each was connected and when it last made a call.

Trading wallets, only if you create one

The wallet's public key, its private key in encrypted form, and an audit record of sensitive actions such as exporting the key, which includes the IP address and user agent that performed them.

Lists you join

If you submitted your email address to an API waiting list, we keep that address.

Why we collect it

• to sign you in and know which plan you have;
• to count calls against your plan and your rate limit;
• to confirm payments and resolve disputes about them;
• to find and stop abuse, including one person using many accounts;
• to debug failures, which is what the request logs are for;
• to measure how the product is used, in aggregate.

Cookies we set ourselves

• _pump_key, your sign-in session. It is signed and encrypted, sent only over HTTPS, not readable by scripts, and lasts 7 days.
• _pump_visitor, the visitor identifier described above. It lasts 2 years.

Third parties that receive data

Loading a page on this website also loads code from these services, which set their own cookies and see your IP address:

• Google, for sign-in, and Google Analytics for usage measurement. We send Analytics a random identifier, never your email address.
• Microsoft Clarity, which records how pages are used so we can find broken layouts and dead ends.
• X, formerly Twitter, whose advertising pixel we use to count sign-ups from our ads. We report that a sign-up happened, not who signed up.
• YouTube, which serves the embedded videos on the learn page.

We also use ordinary infrastructure providers to host the servers and the database, and Solana RPC providers to read the blockchain. We do not sell your personal data and we do not share it with anyone else except where the law requires it.

What a connected app can see

When you approve an app, it receives a token for the single scope api:read. With it the app can read Cookin market data and spend the API calls on your account. It cannot trade, move funds, read your wallet keys, see your email address or change anything.

That token expires after one hour. The app renews it with a refresh token that is valid for 90 days and is replaced on every renewal; if an old one is ever presented again, we revoke the whole chain. Disconnecting the app on your API keys page kills both immediately.

How long we keep it

Account data is kept while your account exists. Request logs, payment records and visit records are kept for as long as they are useful for billing, abuse prevention and debugging. We do not delete them on a schedule today, so treat the answer as indefinitely until you ask us to remove them.

Deleting your data

Email dan@cookin.fun from the address on the account, or message us on Discord or X. We will delete your account and the personal data tied to it. Ask for a copy first if you want one.

Two things cannot be undone. Payments you made are Solana transactions and are public on the blockchain forever. If you funded a trading wallet, withdraw it first; deleting the account destroys the only copy of the encrypted private key.

How we protect it

The site and the API are served over HTTPS only. We never store your API key itself, only a hash of it, so a copy of our database does not hand anyone a working key. Trading wallet private keys are encrypted at rest. Sign-in sessions are signed and encrypted cookies.

No system is perfectly secure. If you find a weakness, tell us at dan@cookin.fun before telling anyone else.

Children

Cookin is not for anyone under 18. We do not knowingly collect data from children.

Changes and contact

We post changes on this page and update the date at the top. Questions about this policy go to dan@cookin.fun, Discord or X. See also our Terms of Service.