This page is maintained by the AxiPivot team and describes the app's current data-handling practices. It is not a certification or an independent audit.
Sign-in runs on Supabase Auth: Google, or a one-time code sent to your e-mail. There are no passwords at all — nothing to reuse from another site, nothing to leak, and no reset form to attack. The flip side is that your mailbox is the key: protect it, and put two-factor on it.
Two-factor authentication is available and optional: a code from an authenticator app, with the factor itself held by Supabase. Recovery codes are ours, and only their one-way hashes are stored — the codes themselves exist only on the screen that shows them once.
Access to each user's data is restricted at the database level with row-level security (RLS) policies: a user can only see and modify their own records.
Account credentials (e-mail and, if connected, a Telegram ID), portfolios and positions, the public wallet addresses you choose to track, notification settings, interface preferences, and payment records for subscriptions.
Card details are never collected: payment goes through a crypto provider and AxiPivot only records the invoice and its status.
Market quotes and macro indicators are pulled from public sources and are not tied to any specific user.
Data is stored in a managed PostgreSQL database on Supabase, hosted in London (AWS eu-west-2). The app itself runs on Vercel. Transfers between browser and server use HTTPS/TLS.
Server-side secrets (external API keys, the Telegram bot token) are kept in the server environment and never reach client-side code.
Only technical storage is used: the session, the chosen language, appearance settings and a request cache, all kept in your own browser. No third-party ad trackers are connected.
One item is optional and asked for separately: a referral code from an invitation link. Page visits are counted in aggregate — by our own counter and by Vercel Web Analytics, without cookies and without building a profile of an individual visitor.
AxiPivot relies on third-party services. Market and on-chain data: CoinGecko (prices, coin metadata and market-wide figures), the European Central Bank (published reference exchange rates, used to compute the dollar index), CoinGlass (derivatives and liquidations), Moralis (EVM and Solana balances), Blockstream and mempool.space (Bitcoin balances).
Infrastructure and delivery: Supabase (database and authentication), Vercel (hosting and anonymous visit statistics), Cloudflare (domain names, the network in front of the site, protection from automated sign-ups, and forwarding of mail sent to our address), Resend (sending our own e-mail), Telegram (notifications), Anthropic (AI analysis), NOWPayments (crypto payments).
Only a wallet address you add yourself is sent to the on-chain providers, and only the coin being analysed is sent to the AI provider. Neither receives your e-mail or the rest of your portfolio.
You can delete your account in the settings at any time: portfolios, trades, history and settings are erased, and deletion cannot be undone. Full terms are on the Terms of Service page.
Send security and privacy questions through the channels listed in the app's settings.