Privacy Policy

1. Information We Collect

We Don't Ask Who You Are

We don't ask for information that identifies you, and we never store your IP address. No names, no emails (unless you contact us first), no accounts, no profiles, no cookies, no tracking across websites. We don't know who you are, and we don't want to. One honest limit: like every website, ours receives your IP address with each request. Where our workers need to tell visitors apart, they turn it into a short code that changes every UTC day (see “How the same-day codes work”), and none of the codes they store lasts more than a day. Under the GDPR such a code is pseudonymous data during its day, so we don't call it anonymous.

What We Do Collect (Minimal Usage Data)

We use Cloudflare Web Analytics and limited first-party telemetry to understand how the site is used and whether core features are working:

• Visitor counts, page views, referrers, browsers and devices, counted by Cloudflare Web Analytics (no cookies, and no fingerprinting for its analytics, in Cloudflare's own words)
• Views of education pages, as a total per page
• Article votes and section reads, as totals per article and per section, and one total of /swap Compare presses. To count each visitor once a day (people who share an IP address count as one), the worker keeps a same-day code until UTC midnight; a vote's direction, tag and time stay with that code for up to 45 minutes, while you can change it.
• In Cloudflare Analytics Engine, with no IP address and no code: an event for each counted vote, vote change, read and Compare press (what, which page, when), for each site search (whether it found results and how long the query was, never the query), and for each dashboard data request (which data)
• The live visitor count and the Orange Pages visits line: random numbers your browser tab makes, sent every 30 seconds while the tab is open (the visits line only while the tab is visible; see section 10)

This data stays minimal and is used to improve the site and keep it working, never for advertising.

Direct Email Communication (User-Initiated)

If you choose to email us directly at addresses we provide (e.g., [email protected]), you are voluntarily sharing your email address and message content. This is standard email communication — not data collection via our website.

---

2. How We Use Your Information

We use limited usage data to operate the site responsibly. Here's what that means in practice:

• Analytics: Aggregated data from Cloudflare Web Analytics helps us understand traffic patterns and improve the site (for example, which pages are useful and where people drop off).
• Product Signals: We count article votes and swap comparison activity in aggregate so we can improve content and tool quality. We do not count clicks on Orange Pages listing links (we stopped on October 2, 2026).
• Operational Telemetry: Temporary live-visitor heartbeats and technical request data help us keep features working, understand load, and limit abuse.
• Direct Emails: If you email us, we'll respond to your inquiry. We won't add you to mailing lists without permission.
• No Personal-Data Sales: We do not sell personal data or build advertising profiles from site usage.

---

3. Third-Party Services

Fonts

All fonts (JetBrains Mono, IBM Plex Mono) are hosted locally on our own servers. No third-party font services are used. Your browser makes zero external requests for typography — no IP addresses are shared with font providers.

Swap Provider APIs (8 providers)

When you compare swap rates, your browser asks our worker for each provider's quote, one request per provider. The worker asks that provider (ChangeNOW, SimpleSwap, FixedFloat, Exolix, SideShift, Godex, ChangeHero, n.exchange) and sends back its quote. Providers see our worker's Cloudflare address, never your IP: the worker sends them only the swap details (coin and amount) and, for some, our own API key; no header, cookie or address from your browser's request. We do not custody funds or process swaps. If you click a swap provider link, you leave our site and are subject to their privacy policies.

What our worker does with your IP. It turns your IP into a same-day code (see “How the same-day codes work”) and counts your requests under it, to stop floods: 60 a minute. Each counter is deleted 60 seconds after your last request. Your IP itself is never written to storage or logs, and never sent to a provider. Workers Logs (“Observability”) is off on this worker.

What Cloudflare sees at the edge. Your IP reaches Cloudflare's network with every request; a site hosted on Cloudflare cannot avoid that. Cloudflare's own services (DDoS protection, firewall) process it under Cloudflare's own privacy policy, and Cloudflare's dashboard can show the IP of a blocked or challenged request in its security events. Our Analytics Engine events never contain it.

One thing no code can switch off: whoever has access to our Cloudflare account can watch requests live as they arrive (Cloudflare's “wrangler tail”), and that view shows each request's IP. Cloudflare does not store that view, and we never save it. We use it only filtered to our own IP.

GDPR Art. 13(1)(e) disclosure: recipients of your swap-comparison request are (1) YouBuyBitcoin's worker as a processor; (2) Cloudflare as our infrastructure sub-processor; (3) the 8 swap providers, each receiving only the worker's egress IP and the requested swap parameters. The providers are independent data controllers for the data they receive.

Auto-refresh behavior (every 10, 20 or 30 seconds)

What it does. After you click Compare Rates at least once, we re-fetch quotes from all 8 providers every 30 seconds (or every 10 or 20, if you pick it) so the rates you see stay current. Swap rates drift in seconds — a 5-minute-old quote can be meaningfully wrong. The rolling refresh keeps the comparison honest while you deliberate.

When it pauses. The refresh pauses automatically when the /swap tab is hidden, when you've been idle for 15 minutes, or when you click OFF next to “Auto-refresh every 30s”. It resumes when you return to the tab unless you've explicitly switched it off.

Same data flow as the initial Compare. Each refresh (every 10, 20 or 30 seconds, as you choose) uses the same worker path, the same rate-limit code and the same rule that your IP is never stored, as described above. Auto-refresh does not collect any additional data, contact any additional services, or change the GDPR recipient list.

How to disable it. Click OFF next to the timer on the /swap page. Your preference is stored in your browser's localStorage (key ybb-swap-auto-refresh) and remembered on future visits. If you'd rather never auto-refresh, toggle it off once; the site will respect that across sessions.

How the sanity check works

What “sanity check” means here. When at least 3 live swap quotes land in the results table, we compute a peer median across them. That median is the comparison reference behind the outlier filter, and so behind the “Best Rate” badge, which needs at least 4 live quotes. The footer line at the bottom of the results (“Sanity check: …”) shows you the inputs we used to rank this particular comparison.

Peer median N BTC. The middle value of all live quotes, sorted. Half the quotes fall above it, half below. Using the median (not the average) means one outlier — a provider momentarily returning a wildly wrong rate — doesn't skew the reference. The median stays stable even when one quote goes haywire.

Reference <source> within X%. We also fetch a separate BTC/USD price from an external feed (CoinGecko primary, CoinLore fallback, Kraken fallback) and compare the peer median against it. If the two agree within 5%, the reference line renders in green (“within 1.2%”) — that's a positive confirmation that our peer consensus tracks the broader market.

Reference <source> diverges X%. Same comparison, but the peer median and external reference disagree by more than 5%. One of them is stale or wrong, and we can't tell which without more signal. Amber coloring flags the uncertainty. The comparison still ranks providers, but you should verify the final rate on the provider page before swapping.

“Best Rate” badge rules. The badge goes to the highest live quote whose rate stays within peer-median tolerance (±10%). A provider returning an unusually generous quote that's 15% above the peer median gets excluded from the badge — their quote looks good on paper but is likely a glitch that won't hold at execution time. We'd rather badge the honest #2 than the possibly-broken #1.

What updates this. At each refresh while the /swap tab is visible and auto-refresh is on (see the section above), we re-run the full pipeline: fresh quotes, fresh peer median, fresh reference delta, fresh badge. Numbers drift slightly as provider quotes and BTC/USD drift — that's normal market motion, not instability.

The Orange Pages (External Listings)

When you visit an Orange Pages listing website, you leave YouBuyBitcoin.com and are subject to that third-party's privacy policy. We curate and verify listings, but we do not control or monitor external websites. Some listings may include affiliate links — these are always disclosed.

Cloudflare Web Analytics

As mentioned above, we use Cloudflare's cookieless analytics. In Cloudflare's own words, it uses no “client-side state, such as cookies or localStorage”, and does not fingerprint individuals for the analytics it shows. Cloudflare still receives your IP with each request, as this section explains above. Learn more about Cloudflare Web Analytics.

First-Party Site APIs

Article votes and reads, /swap Compare presses, site search, the live visitor count, the Orange Pages visits line and the dashboard data all reach one of our seven Cloudflare Workers. None of them stores your IP address. Where a worker needs to tell visitors apart, it uses a same-day code instead:

• Rate limits (stopping floods): a counter per code. Counters in storage are deleted within 60 seconds of your last request. Counters in memory (every limit of the live data, mempool and live counter workers, and the feedback worker's limit on reading counts) are dropped on the first request after their minute, or when that copy of the worker stops. The three memory-only workers use a key each copy makes every UTC day and never stores.
• One vote per article per day: a lock that ends at UTC midnight, and your vote (up or down, tag, time) for up to 45 minutes while you can change it, ending at midnight. KV keeps any record at least 60 seconds, so one written in the day's last minute lives that long.
• One read per section, and one Compare press, per day: a mark that ends at UTC midnight (the same 60-second minimum applies).

Workers Logs (“Observability”) is off on all seven workers. We do not build advertising profiles or sell personal data.

How the same-day codes work

Where a worker needs to tell visitors apart, it does not keep your IP. It makes a short code from it: an HMAC-SHA256 of the IP under a key of 32 random bytes made for that UTC day, cut to 5 hexadecimal characters (20 bits).

• Short on purpose. There are about a million possible codes and about 4.3 billion IPv4 addresses, so each code is shared by about 4,096 of them. A stored code alone never points to one address.
• Gone with the day. Each worker makes a new key every UTC day. The four workers that store theirs (feedback, swap, search, admin) delete it 5 minutes after midnight; the other three keep theirs in memory only and replace it on their first request of the new day. Once the key is gone, nobody, us included, can tell which IP made a code. Every stored record made from a code is deleted by midnight (a record written in the day's last minute lives its 60-second minimum).
• Shared addresses. People behind one IP address (a home, an office, a mobile network) get the same code, so they count as one visitor; one person on two networks counts twice.
• The limit, stated plainly. During the day, whoever holds that day's key could check whether a given IP made a given code (a wrong match about one time in a million), and several codes the same IP left under different labels narrow it further. That is why we call the codes pseudonymous, not anonymous, until the key is gone.

Gates in our code check every change that none of our seven workers stores an IP, that every key made from a code expires in time, and that codes stay at 20 bits.

Site Search (Cloudflare Workers AI)

When you use the site search feature, your search query is sent to our Cloudflare Worker which uses Cloudflare Workers AI to generate a semantic embedding for matching against our content index. Query text is processed in real time and is not stored, logged, or shared with any third party. The AI model runs entirely within our Cloudflare account — no data leaves Cloudflare’s infrastructure. Search results may be cached for up to 1 hour, ending at UTC midnight (an entry written in the day's last minute lives 60 seconds). The cache entry is filed under a code made from the query with that day's key, not under the query text, so once the day's key is deleted (5 minutes after midnight) nothing in the cache can confirm which queries were asked. We record whether a search found results and how long the query was, never the query. The limit (30 searches a minute) counts under a same-day code made from your IP, deleted within 60 seconds of your last search.

AI Content Assistance Tools

We use AI tools including Claude (by Anthropic) and Perplexity to assist with content writing, research, code generation, and fact-checking. These tools are used by the operator in an offline capacity only. No visitor data, search queries, or personal information is shared with these AI services. All AI-assisted content is reviewed, fact-checked, and approved by the site founder before publication.

Donations

The donate page loads nothing beyond what every page loads: the addresses and QR codes are part of the page itself. If you pay the Lightning Address, your wallet contacts the service behind it, and that service can see your IP address; this happens between your wallet and that service, not through our site. We receive no name, email or other personal data from a donation.

Donor thank-you list. If you ask to be thanked on our donate page, we publish only the name or handle you choose and the month of your donation. We use your transaction ID or payment hash only to check the donation is yours, and never publish it. Your email stays in our inbox. Ask us any time and we remove your name.

---

4. Data Controller

The data controller for this website is:

• Name: Marius Madar (known as: Marius, The Master Of Disaster)
• Location: Oradea, Bihor, Romania
• Email: [email protected]
• Supervisory Authority: ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal) — dataprotection.ro

For full operator details, see our Impressum / Legal Information page.

Records of Processing Activities (Art. 30): As a small natural-person operator with no employees and only minimal-risk processing, this site falls under the Art. 30(5) exemption from mandatory ANSPDCP notification. We nevertheless maintain an internal Record of Processing Activities documenting purposes, categories of data, retention periods, and recipients consistent with Art. 30(1).

Data Protection Officer (Art. 37): Not appointed. As a natural person processing only minimal, non-sensitive, aggregated data without large-scale systematic monitoring of data subjects, appointment of a DPO is not required under GDPR Art. 37(1). Privacy questions are handled directly by the data controller at [email protected].

---

5. Purposes of Processing

We process limited technical and communication data for specific operational purposes. Each purpose names its legal basis under Art. 6(1) inline so the mapping is explicit per Art. 13(1)(c-d):

• Analytics: Understanding page demand, traffic patterns, and product usage at an aggregate level. Basis: Art. 6(1)(f) — legitimate interest in measuring and improving educational content quality and site reliability.
• Feedback totals: Counting article votes and feedback signals so we can improve content quality. Basis: Art. 6(1)(f) — legitimate interest in editorial quality measurement.
• Swap activity: Counting Compare presses (one total, each visitor once a day) and serving quotes, needed to operate the swap tool responsibly. Basis: Art. 6(1)(f) — legitimate interest in operating and improving the swap rate aggregation tool.
• Live visitor heartbeats: Estimating how many visitors are active on the site right now and keeping that feature reliable. Basis: Art. 6(1)(f) — legitimate interest in providing a live-activity signal to readers and operational monitoring.
• Semantic search: Processing search queries so the site can return relevant results. Basis: Art. 6(1)(f) — legitimate interest in providing search functionality.
• Direct email correspondence: Responding when you contact us by email. Basis: Art. 6(1)(b) — performance of a contract or pre-contract steps initiated by you.
• Security and abuse prevention: Rate limiting, reliability monitoring, and basic technical fraud/abuse controls. Basis: Art. 6(1)(f) — legitimate interest in site security and abuse prevention.

---

6. Legal Bases for Processing

Where the GDPR applies, we rely primarily on the following legal bases:

• Legitimate interests (Art. 6(1)(f)): The specific legitimate interests pursued are named per purpose in Section 5 above — namely measuring and improving content quality, evaluating directory usefulness, operating the swap rate aggregation tool, providing a live-activity signal, providing search functionality, and maintaining site security and abuse prevention. We have balanced each interest against your rights and freedoms (see the balancing test below).
• Performance of a contract / pre-contract steps (Art. 6(1)(b)): When you email us with a question, we process your message to respond to you at your request — a pre-contract step initiated by you.
• Legal obligation (Art. 6(1)(c)) or legitimate interests where applicable: Recordkeeping, dispute handling, and compliance with applicable law.

Balancing test for legitimate interests: Where we rely on Art. 6(1)(f), we have balanced our interests against your rights and freedoms. In concrete terms, the data minimization is purpose-specific: live-visitor heartbeats use random session identifiers kept for 90 seconds after the last beat, and the Orange Pages visits line uses random tab numbers kept until 06:00 UTC the next day, neither made from your IP; votes, reads and Compare presses are kept as totals, and the only per-visitor records are same-day codes (a vote lock and read and Compare marks until midnight, a vote for up to 45 minutes while it can be changed); and rate limits use same-day codes, never the raw IP: stored counters are deleted within 60 seconds of your last request, counters in memory on the first request after their minute. Codes are 20 bits, so a stored code alone never points to one IP, and once the day's key is gone nobody can link a code to an IP. Because each purpose is met with the least data that still makes the feature work, we consider the residual privacy impact negligible — the minimal, temporary, and non-sensitive nature of the processing means our legitimate interest is not overridden by your interests, rights, or freedoms. You can object to processing under Art. 6(1)(f) at any time (Art. 21).

We do not rely on advertising consent banners because we do not use advertising cookies or behavioral advertising trackers.

---

7. Recipients / Processors

We keep the processor surface intentionally small. Depending on the feature you use, data may be processed by:

• Cloudflare: For Pages hosting, Workers, Web Analytics, Workers AI search, and supporting storage/caching infrastructure. Cloudflare’s Data Processing Addendum is available at cloudflare.com/cloudflare-customer-dpa.
• Microsoft 365 (Microsoft Corporation): Hosts the content of our email ([email protected] and [email protected]) for standard email communication if you contact us directly. Microsoft’s privacy documentation is available at privacy.microsoft.com.
• GoDaddy (GoDaddy.com, LLC): Provides domain registration and DNS/MX hosting for the youbuybitcoin.com email infrastructure that routes inbound mail to Microsoft 365. GoDaddy’s privacy documentation is available at godaddy.com/legal/agreements/privacy-policy.
• Market and chain data services: our workers fetch public data from these services, on a schedule or when a cached copy is out of date. They receive our worker's Cloudflare address and no data about you: Binance, CoinGecko, CoinLore and Kraken (prices), mempool.space (blocks, fees, mining and Lightning data), Bitnodes (node count), DefiLlama, CoinGlass and Bitbo (market data), Yahoo Finance (S&P 500), the U.S. SEC (company filings) and a public Google Sheets file (central bank digital currency list). They act as independent controllers for the request metadata they receive.
• Third-party swap providers and external listing websites: For details on these data flows, see Section 3: Third-Party Services above.

Cloudflare operates a global network. Data processed through Cloudflare Workers and analytics may transit through data centers outside the European Economic Area. Cloudflare maintains Standard Contractual Clauses (SCCs) and other safeguards compliant with GDPR Chapter V for international transfers.

We do not sell personal data, rent audience lists, or share personal data with advertising networks to build marketing profiles.

---

8. Your Rights

Under the GDPR, you may have the right to:

• Access (Article 15): Ask what personal data we hold about you, especially if you contacted us directly by email.
• Rectification (Article 16): Ask us to correct inaccurate personal data.
• Erasure (Article 17): Request deletion of personal data we control, such as email correspondence, subject to legal or operational retention needs.
• Restriction (Article 18): Ask us to limit certain processing in appropriate cases.
• Portability (Article 20): Request your personal data in a portable format where applicable.
• Objection (Article 21): Object to certain processing where legitimate interests are used as the legal basis.

Because much of our analytics and telemetry is aggregated or temporary, some rights may apply only to data that can reasonably be linked to you, such as direct email correspondence.

Automated Decision-Making (Article 22): We do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects on individuals.

---

9. Retention Periods

We aim to keep data only for as long as it is actually useful for the feature involved:

• Live visitor heartbeat identifiers: 90 seconds after the tab's last beat.
• Orange Pages visits tab numbers: until 06:00 UTC the next day; then only each day's total is kept.
• Search cache entries: up to 1 hour, ending at UTC midnight (one written in the day's last minute lives 60 seconds).
• Aggregate feedback, vote, and usage totals: Retained in aggregate form for product history and measurement, not as personal profiles. Listing click totals counted before October 2, 2026 are kept in aggregate only; no new clicks are counted.
• Rate-limit counters: deleted within 60 seconds of your last request; those kept in memory, on the first request after their minute or when that copy of the worker stops.
• Same-day codes made from your IP: a vote lock and the read and Compare marks until UTC midnight; a vote's direction, tag and time for up to 45 minutes, ending at midnight (KV keeps any record at least 60 seconds); for the operator's admin login only, a lockout of up to 15 minutes after a failed attempt. The stored day key (feedback, swap, search, admin) is deleted 5 minutes after midnight; the other three workers' keys are never stored and are replaced on their first request of each UTC day.
• Analytics Engine events (what was read, voted on, compared or searched, and which dashboard data was asked for; no IP, no code): three months, kept by Cloudflare.
• IP addresses and user agents (our workers): never stored. Your IP is turned into a same-day code where a worker needs one; user agents are not read. Neither is used for tracking, advertising or profiles.
• Cloudflare Web Analytics data: Retained by Cloudflare for up to 6 months per their data retention policy. See Cloudflare's privacy documentation for details.
• Email correspondence: Retained for up to 3 years from the date of last contact, unless longer retention is required by law, or deleted on request where appropriate.

---

10. Cookies and Browser Storage

Local Storage (localStorage)

We use your browser's localStorage to cache site data locally for performance — for example, listing data, education reading progress, swap rate comparisons, and your last swap comparison selection (currency and amount, 24-hour cache). It also remembers which sections were already counted, the day of your last Compare press and your votes, so the site doesn't count you twice (a Compare press once a day). This data stays on your device and is never sent to our servers, except that a tag you add to a vote is sent with the direction of the vote it remembers. It can be cleared at any time through your browser settings. It is not used for tracking or advertising.

Live Visitor Counter

We display an anonymous count of active visitors to foster a sense of community. This uses a random, temporary session identifier stored in your browser tab only (sessionStorage, not cookies). It is operational telemetry, not advertising tracking. The identifier is automatically deleted when you close the tab and expires on our server within 90 seconds of inactivity.

Orange Pages Visits Line

The line under the count on The Orange Pages (“reading now · today · since”) counts browser tabs, not people. Each tab makes a random number for the UTC day, keeps it in the tab (sessionStorage), and sends it to our live counter every 30 seconds while the tab is visible. The counter keeps the number for 90 seconds after the tab's last beat (“reading now”) and once per day until 06:00 UTC the next day (“today”). After midnight it adds up the day's numbers into one total; only the daily totals are kept. The numbers are not made from your IP. The counter limits requests per visitor (30 a minute, and 5 new tab numbers a minute), counted in memory by each copy of the worker under a same-day code. Only pages on youbuybitcoin.com send the number; previews and test copies don't, unless a test switches it on.

---

11. Data Storage & Security

Our stack is intentionally lightweight, but it still uses limited storage and processing for core site operations:

• No user-account database: We do not operate account registration or personal user profiles.
• Limited browser storage: Some features may use temporary browser storage such as sessionStorage.
• Limited server-side processing: We use server-side infrastructure for cookieless analytics, feedback aggregation, rate limiting, semantic search, live-visitor heartbeats and the Orange Pages visits line.
• Standard email storage: If you email us, your message is stored in Microsoft 365 (our email provider, hosted via GoDaddy) as part of normal email infrastructure.

We use reasonable technical and organizational measures appropriate to the limited amount of data we handle, but no internet service can promise absolute security.

---

12. Children's Privacy

Our website is not directed at children, and we do not knowingly seek personal information from anyone under 18. If you're a parent or guardian and believe a child has shared personal data with us, contact us at [email protected].

---

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or for legal compliance. Updates will be posted on this page with a revised "Last Updated" date at the top. Significant changes will be announced on our homepage.

---

14. Data Breach Notification

In the unlikely event of a data breach affecting personal data, we will:

• Notify the relevant supervisory authority within 72 hours as required by GDPR Article 33
• Notify affected individuals without undue delay where the breach poses a high risk to their rights (GDPR Article 34)
• Document the breach, its effects, and remedial actions taken

Because we store no IP addresses, only same-day codes that last a day at most (with the day's key, deleted 5 minutes after midnight), random tab numbers and aggregate counters (plus the emails you send us, held by Microsoft 365), the realistic scope of any breach is extremely limited.

---

15. Contact and Complaints

This website is operated by Marius, The Master Of Disaster. For full legal operator details, see our Impressum / Legal Information page.

Questions about this Privacy Policy? Contact us:

• Email: [email protected]
• Response Time: We aim to respond within 48 hours, up to 30 days where GDPR rights requests apply.
• Supervisory authority (Romania): ANSPDCP — www.dataprotection.ro
• GDPR complaint right: You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
• EU consumer disputes: The EU Online Dispute Resolution platform closed on 20 July 2025; for consumer disputes, find a national alternative dispute resolution (ADR) body via consumer-redress.ec.europa.eu (for data-protection complaints, use the supervisory-authority routes above), or contact [email protected].