CoinSpectrum is read without an account. It runs no analytics service, no advertising scripts and no tracking pixels, and it does not sell or share data about its readers. This page lists what it does keep, where, and for how long.
Updated 26 October 2026.
The web server writes one line per request to its access log: the time, the page or file requested, the response code and size, the referring page, and the browser's user-agent string. The IP address is shortened before it is written. For IPv4 the last of its four numbers is replaced with 0; for IPv6 only the first two groups are kept. The log is rotated daily and deleted after 31 days. It is used to keep the site running and to see which pages are read, and is not combined with any other data.
The server also runs a firewall that screens requests for abuse, scraping floods and automated attacks. Its records can include the full IP address of a request it blocks or challenges. They are used for that purpose only.
No cookies are set for reading. There is no cookie banner because there is nothing for one to ask about.
Preferences are saved in the browser's local storage, under keys that start with
cs.: the theme and colour skin, the display currency, table filters and sort order,
the page of the ranking last viewed, converter amounts and favourites. The portfolio is kept the
same way. None of it is sent to the server unless the reader signs in. Clearing the site's data
in the browser removes it.
The site can be installed as an app. Its service worker keeps a copy of pages and data files in the browser so the site still opens on a poor connection. That cache lives on the reader's device, and clearing the site's data removes it too.
To show prices as they move, some pages ask third-party services directly from the reader's browser: the public price APIs of exchanges such as Binance, Coinbase, Kraken and Bybit, and CoinGecko. Network tools on the tools pages query public block explorers such as mempool.space. Coin icons are served by CoinSpectrum, and CoinGecko's image server is used only for an icon the site does not have yet.
Like any website, those services see the reader's IP address and browser when they answer. They receive no identifier from CoinSpectrum, and their own privacy policies apply to what they keep.
An account exists only to sync a portfolio and preferences between devices. It is signed in with a seed phrase instead of an email address and password. The account key is derived on the device; the seed phrase is never sent. The account holds no funds and needs none, and nobody should sign in with a phrase that guards real savings.
For an account, the sync server keeps:
Backup. With the Backup setting on, the same encrypted record is also copied to Sia, a decentralised storage network, so it survives the loss of the server. It is just as unreadable there. Turning Backup off deletes the Sia copy.
Deleting an account. Delete account in the account panel removes the account record, the recovery-email entry and the Sia copy. The service's own log notes a shortened form of the public key when an account is deleted, moved to a new key or restored from backup. Request counts used to limit abuse are held in memory only and are gone when the service restarts.
Comments on asset pages and public nicknames are Nostr events. They are signed with the account's Nostr key and published to public relays run by others (relay.damus.io, nos.lol and relay.primal.net), where any Nostr app can read them. They are public by design, and CoinSpectrum cannot remove them from those relays. A private name set in the account panel is different: it is encrypted with the rest of the account record and only its holder sees it.
Signing in with a wallet through WizardConnect passes the pairing messages between the browser and the wallet through a public relay. They carry the connection, not the wallet's keys.
An application through the listing form stores what the applicant typed, including the contact details they chose to give, so the application can be answered. The sender's IP address is not stored; a keyed hash of it is kept for 180 days to stop repeated spam, then deleted. When an application arrives, the operator receives a short notification with its reference, kind, project name, ticker and website.
The site is mirrored to Sia and can be read as coinspectrum.x. A reader who opens it
through a Sia gateway is served by that gateway, under its operator's own terms.
Write on X or Telegram (see Contact). The site's code for accounts runs in the reader's browser and can be read there; a claim on this page that turns out to be wrong is a bug to report.