Privacy Policy

BlockPhi is a macro-crypto analytics firm operating the Services. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), BlockPhi acts as the data controller of personal data processed through the Services, except where a third party acts as an independent controller under its own privacy policy.

For any question about this Privacy Policy or about your personal data, contact contact@blockphi.com.

This Privacy Policy applies to the BlockPhi website, terminal, analytics dashboard, newsletter, member access, and related communications. It does not replace the privacy policies of third-party services such as Whop, Substack, or Discord that you choose to use. Those parties may process personal data for their own purposes under their own terms and privacy policies.

3.1 Information you provide directly

• Email address — provided when you sign up for the newsletter or terminal access. This is the only directly identifying personal data we collect at signup, unless you sign up with Google (below).
• Google account details — if you choose to sign in or sign up with Google, Google gives us your Google account’s email address, name, and profile picture link, which our sign-in provider stores with your account. We use the email address to find or create your account.
• Newsletter consent preference — a value indicating whether you opted in to receive our newsletter. This is recorded as an explicit, affirmative action; the opt-in is unchecked by default.
• Membership and account data — where you purchase premium access, your Whop account identifiers, membership tier, and membership status. Whop and its payment providers handle payment-card details; BlockPhi does not receive or store payment-card details.
• Community data — if you join our community on Discord, your Discord identifier and activity are processed by Discord under its own policy.
• Correspondence and feedback — the content of any message, support request, testimonial, or feedback you choose to send us.

3.2 Information collected automatically

• Hashed IP address — at newsletter signup your IP address is irreversibly hashed using SHA-256 before storage. We do not store your raw IP address. The hash is retained solely for abuse prevention and compliance record-keeping.
• Source attribution — which part of the site you signed up from (for example, a modal or the footer). This is non-identifying and used to understand how people reach us.
• Referral code — if you joined through an analyst’s or partner’s link, that link’s code, linked to your Whop user ID. It credits the analyst or partner whose link it was, and the analytics terminal’s Home page uses it to show that analyst’s latest video and post. You can choose another analyst, or none, under Customize on Home.
• Technical and security data — standard server-log information such as IP address, user-agent, requested URL, referrer, and timestamps, processed transiently by our hosting provider for security, reliability, and abuse prevention.
• Authentication data — if you use premium features, short-lived session tokens stored in secure, httpOnly cookies (see Section 6).
• Aggregate visitor statistics — Vercel Web Analytics records page views, how long each page stays in view, and a few named actions, such as opening the Premium checkout, completing a free sign-up, or completing a Premium purchase, with the referring site, approximate location, browser, operating system, and device type. It sets no cookies: Vercel tells visitors apart by a hash of the request that it discards after 24 hours, and we see only aggregated counts, never an individual’s visit.
• Page-speed measurements — Vercel Speed Insights records how quickly each page loads and responds, with the page address, browser, operating system, device type, network speed, and country. The measurements are anonymous, set no cookies, and are not linked to any visitor.
• Member usage — if you are signed in, free or paid, which pages of the terminal you open and how long each stays in view, totalled per day and linked to your Whop user ID, not your name or email. We use it to understand which features members rely on and whether the Services remain useful to them. It uses no cookies beyond the authentication cookies below.

We do not use advertising pixels, cross-site tracking, or third-party analytics cookies on the Services, and we do not fingerprint devices. To prevent payment fraud, the Whop checkout on our join page reads technical details of your browser and device and sends them to Whop (Section 6).

• Provide and administer the Services, including managing newsletter signups and, for premium members, verifying membership through Whop and granting access to gated features.
• Send the newsletter containing market insights and product updates, only if you have explicitly opted in.
• Security and abuse prevention, including detecting and preventing fraudulent or abusive signups and protecting the Services.
• Improve the Services based on aggregate, non-identifying signup and usage patterns, and on how signed-in members use the terminal (Section 3.2).
• Communicate with you, including responding to enquiries and sending service or security notices relating to your account.
• Legal and business administration, including complying with legal, tax, and regulatory obligations and protecting legal rights.

Where the GDPR applies, we process personal data on one or more of the following legal bases:

• Consent — for newsletter communications. You provide explicit consent by checking the newsletter opt-in. You may withdraw this consent at any time without affecting the lawfulness of prior processing.
• Performance of a contract — for processing your email and Whop membership data to create and manage your access to the Services.
• Legitimate interests — for abuse prevention (hashed IP storage), security, service improvement (source attribution, aggregate usage, and member usage), and crediting referrals and showing on Home the analyst you joined through (referral code), provided those interests are not overridden by your rights and freedoms.
• Legal obligations — where processing is necessary to comply with tax, accounting, or other legal requirements.

We use only cookies and similar browser storage that are strictly necessary for the Services to function or that remember a choice you have made. We do not use tracking, analytics, or advertising cookies, so no cookie consent banner is required. Our visitor statistics (Section 3.2) work without cookies. TradingView’s widgets, which set TradingView’s own cookies, load only after you allow them (Section 8.2).

• Authentication cookies — secure, httpOnly session tokens (blockphi_access_token, blockphi_refresh_token, and their expiry/state) for signed-in members, free or paid. These are strictly necessary and do not require consent under the GDPR.
• Sign-in cookie (sb-jegiyfgynvpqpdgzwlrx-auth-token). When you sign in, we set one sign-in cookie on blockphi.com, shared by www.blockphi.com and analytics.blockphi.com. Supabase, our database and sign-in provider, issues it. Signing out removes it.
• OAuth state cookies — short-lived tokens used during the Whop login process for security (CSRF protection and the sign-in return path). These expire within minutes.
• Sign-up and sign-in checks (bp_join_bind, bp_google_nonce) — a random value that ties a free sign-up to the browser it was made in, so we can sign you straight in after it, and a one-time value that protects a sign-in with Google. They hold no personal data, are used once, and expire within an hour.
• Sign-up with Google (bp_join_google) — when you sign up for the free plan with Google, the sign-in token Google gives us (your Google name, email address and profile picture link), kept in your browser while you finish the sign-up so we can sign you in after it. It is used once and deleted then, and expires within an hour.
• Session status cookie (blockphi_session_hint) — a copy of your sign-in status, membership tier, and display name that the page can read, so it shows the right view as soon as it loads. It contains no login credentials, is set only after you sign in, and expires after 7 days.
• Logout marker (blockphi_logged_out) — records that you have logged out, so a session is not restored on either BlockPhi website.
• Checkout security cookie (_whop_ssk) — set by the Whop checkout on our join page: a random key for your checkout session, which Whop and its fraud-prevention provider use to check the payment. It expires after 20 minutes.
• Browser storage — your browser’s local or session storage remembers whether you have signed up (so the home page offers a log-in instead of a sign-up), the last chart you opened on the Chart Desk, and whether you dismissed an offer, and whether you allowed TradingView’s widgets (Section 8.2). These stay on your device and are not sent to us.

The Whop checkout and Google’s sign-in button run scripts from Whop and Google on our join and sign-in pages. Those scripts would also store long-term identifiers on our site: Whop’s visitor and device IDs, and Google’s memory of its sign-in prompt. We block them, so the checkout security cookie above is the only one that remains. To prevent payment fraud, the checkout reads technical details of your browser and device, such as its screen, language, and graphics, and sends them to Whop. Inside the checkout and the Google sign-in window themselves, Whop and Google may set their own cookies under their own privacy policies.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use the following third-party processors to operate the Services:

• Supabase — database hosting and sign-in (stores your email, newsletter consent preference, hashed IP, and, if you sign in, your sign-in session and member usage records).
• Vercel — website hosting, serverless functions, aggregate visitor statistics (Vercel Web Analytics), and page-speed measurements (Vercel Speed Insights).
• Whop — membership management, authentication, and payment processing for premium features.
• Substack — newsletter delivery, for users who opted in. Your email is shared with Substack via periodic manual export; there is no automated API connection.
• Discord — the community platform, if you choose to join.

We may also disclose personal data where required by law, court order, or lawful government request, or where reasonably necessary to protect the rights, safety, or property of BlockPhi, our users, or others; and in connection with a merger, acquisition, or sale of assets.

Whop, Google (if you sign in or sign up with Google), Substack, and Discord may act as independent controllers for the personal data they process under their own privacy policies and settings. BlockPhi is not responsible for the privacy practices of an independent third party.

8.1 YouTube API Services

The analytics terminal’s Home page uses YouTube API Services to show the latest video of the analyst it features. Our server asks YouTube for that channel’s latest public uploads and keeps the answer (the video’s title, address and date) for up to an hour; it sends YouTube nothing about you, and we do not access, store or share any YouTube or Google account data. When the page shows the video’s preview image, your browser loads it from YouTube’s servers, which receive your IP address; opening the video takes you to YouTube. Google’s handling of that data is governed by the Google Privacy Policy, and YouTube’s by the YouTube Terms of Service.

8.2 TradingView widgets

Some parts of the analytics terminal, such as the top stories on the Home page, are free widgets from TradingView. Nothing of TradingView’s loads until you click the button in its place (“Show top stories”, for example); your browser then remembers that choice for every TradingView widget. Once a widget loads, your browser fetches it from TradingView’s servers, so TradingView receives the address of the page and your IP address, and it may set its own cookies, such as its analytics cookie sp, which lasts one year. TradingView acts as an independent controller of that data under the TradingView Privacy Policy.

BlockPhi operates from the European Union, but some service providers process data in the United States or other countries outside the European Economic Area, the United Kingdom, or Switzerland. Where required, international transfers are based on an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may contact us for further information about the safeguards relevant to a transfer of your personal data.

• Email and consent data are retained for as long as your account or subscription is active. If you request deletion, we will remove your data within 30 days.
• Hashed IP data is retained for up to 12 months for abuse prevention, after which it is purged.
• Member usage records are retained for up to 3 years, so that usage can be compared across years.
• Membership records may be retained for the period needed to meet tax, accounting, and legal obligations.
• Server and security logs are retained by our hosting provider for a limited period for security and reliability.

We may retain anonymised or aggregated information that can no longer reasonably identify you for longer periods, and may use or share it for any purpose, including commercially.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you and obtain information about its processing.
• Rectification of inaccurate or incomplete personal data.
• Erasure of your personal data (“right to be forgotten”).
• Restriction of certain processing.
• Object to processing based on legitimate interests and to direct marketing. Where you object to direct marketing, we will stop using your personal data for that purpose.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Complain to your local Data Protection Authority or the supervisory authority in the country of your habitual residence, place of work, or the place of the alleged infringement.

To exercise any of these rights, contact contact@blockphi.com. We will respond within the period required by applicable law — under the GDPR, generally within one month.

Where applicable United States privacy law, including the California Consumer Privacy Act as amended, applies to BlockPhi, residents may have rights to know or access personal information, request deletion or correction, and receive equal service when exercising privacy rights. BlockPhi does not sell personal information and does not share it for cross-context behavioural advertising. To submit a request, email contact@blockphi.com.

We send the newsletter only where you have opted in. You can unsubscribe using the link in any newsletter email or by emailing contact@blockphi.com. We may still send non-marketing communications necessary to administer your account, access, or security.

The Services are intended only for persons aged 18 or older. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, contact contact@blockphi.com and we will take appropriate steps to investigate and delete the information where required.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), SHA-256 hashing of IP addresses, httpOnly cookie flags, server-side secret management, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal-data breach occurs, we will assess the risk and make any notification to supervisory authorities or affected individuals required by applicable law. Where the GDPR applies and a breach is likely to result in a risk to individuals’ rights and freedoms, the competent supervisory authority will be notified without undue delay and, where feasible, within 72 hours after we become aware of it.

BlockPhi does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Certain access-control functions are automated, such as verifying your Whop membership status, but these do not have such effects.

The Services may link to or embed third-party content, such as the Whop checkout, the Substack newsletter, our Discord community, or external videos and articles. When you follow a link or use an embedded feature, that third party may collect personal data under its own privacy policy. Review the relevant third-party policy before providing information or using the feature.

All content on the Services is educational and informational only. Nothing is financial, investment, legal, or tax advice. Past performance is not indicative of future results. Do your own research and consult a qualified professional before making investment decisions. See our Terms of Service for the investment-risk disclosures.

We may update this Privacy Policy from time to time. Changes become effective when posted, with a new “Last updated” date. If we make material changes to how we handle personal data, we will notify affected users by email where possible.

For privacy-related enquiries, data-access requests, or to exercise your GDPR rights, email contact@blockphi.com.