Privacy Policy
Version 1 · in force since
This Privacy Policy explains what personal data Bluckcoin collects, why, how we protect it, and the choices and rights you have. We collect only what we need to run a secure, regulated service, and we never sell your data.
1. Who we are
The controller of your personal data is Bluckcoin, 2717 Roeding Rd Apt 46, Ceres, CA 95307, United States. For anything about your data, email bluckcoin@gmail.com.
2. Data we collect
When you create an account
- Email address.
- Password. We store only a secure one-way hash; we never see or store your actual password.
- Full name, username, country and timezone.
- Gender, which is optional. You can choose "prefer not to say".
Identity verification (KYC)
- Images of an identity document: your passport photo page, or both sides of your national ID card or driving licence, and the details on it.
Money and activity
- Deposit proof screenshots you upload.
- Payout wallet addresses you save.
- Trades, positions, balances, Piggy savings, referrals and a ledger of every movement on your account.
Support
- Support tickets, messages and any attachments you send us.
Security and legal records
- For each sign-in: IP address, browser and device information (user agent) and time. You can see your own session history at Security.
- Records of when you accepted our legal documents: which version, the time, your IP address and browser.
- Technical request and error logs, kept briefly to keep the service running and secure.
3. How we use your email address
We use your email address only to run your account. The emails we send are transactional:
- sign-in codes, signup verification codes and password-reset codes;
- withdrawal confirmation codes;
- notices about your deposits, withdrawals, identity verification, balance adjustments and security changes such as a password change.
We make these commitments about your email address:
- We do not sell, rent, trade or share it with anyone for their own marketing.
- We do not buy or use purchased, rented or scraped email lists. We only email people who signed up with us themselves.
- We do not send marketing emails unless you have opted in. Any such email would include an unsubscribe link that works in one click.
- When an email bounces or a recipient marks our email as spam, we automatically stop sending to that address.
The full list is on Emails we send.
4. Why we use your data (legal bases)
| Purpose | Legal basis |
|---|---|
| Creating and running your account, processing trades, deposits, withdrawals and Piggy, sending account emails, answering support | Performance of our contract with you |
| Identity verification, anti-money-laundering and sanctions checks, keeping financial records, responding to lawful requests | Legal obligation |
| Keeping accounts secure, detecting fraud and abuse, enforcing our Terms, keeping logs | Our legitimate interests in a safe, fair service |
| Optional items such as gender, or any marketing email you opt into | Your consent, which you can withdraw at any time |
We do not use your data for automated decisions that have legal or similarly significant effects without human review. Identity checks, deposits and withdrawals are reviewed by people.
5. Who we share data with
We share data only with service providers who process it on our behalf, under contract, and only for the purposes above:
- Amazon Web Services: Amazon Simple Email Service (SES) sends our emails, and AWS provides hosting infrastructure.
- Cloudflare: network security and content delivery, and private object storage for uploaded files such as identity documents, deposit proofs and support attachments.
- Our hosting provider: runs our servers and database.
We may also disclose data where the law requires it, for example to a regulator, law-enforcement agency or court, or to protect the rights and safety of our users and the service. If our business is sold or reorganised, data may pass to the new owner under the same protections.
We do not use any analytics, advertising or tracking services, and no third party tracks you across our site.
6. International transfers
Our providers may process data in countries other than your own. Where data leaves your country, we rely on appropriate safeguards, such as adequacy decisions or standard contractual clauses approved by the relevant authorities, together with the providers' own security commitments. You can ask us for details at bluckcoin@gmail.com.
7. How long we keep data
| Data | How long |
|---|---|
| Account, identity, transaction and ledger records | For the life of your account, then 5 years after the account is closed, or longer where the law requires (for example, under anti-money-laundering rules) |
| Request and error logs | 14 days |
| Sign-in sessions | Expire after at most 90 days, or sooner when you sign out or end them |
| Email delivery records (sent, bounced, complained) | As long as needed to handle bounces and complaints and to keep suppressed addresses from being emailed again |
| Support tickets | For the life of your account, then with your account records |
When the retention period ends we delete or anonymise the data.
8. How we protect your data
- All traffic to Bluckcoin is encrypted in transit using HTTPS.
- Passwords and one-time codes are stored only as secure hashes. Codes expire quickly and allow a limited number of attempts.
- Identity documents and other uploads are kept in private storage that is never publicly accessible. Identity documents can be viewed only by our compliance team.
- Staff access is limited to what each role needs, and administrative actions are logged.
- Large money movements and large market resolutions need approval from two separate people.
- Every sign-in needs both your password and a code sent to your email, and you can end any session from Security.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities where the law requires.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data. We will delete what we can, but we must keep some records for the legal retention period above;
- object to or ask us to restrict certain processing, including processing based on legitimate interests;
- portability: receive data you gave us in a common, machine-readable format;
- withdraw consent for anything based on consent, at any time;
- complain to your local data-protection supervisory authority.
To use any of these rights, email bluckcoin@gmail.com from the address on your account. We may ask you to confirm your identity, and we will reply within one month (or the period your local law sets).
10. Cookies and local storage
We use only strictly necessary cookies, which the site needs to work. We do not use advertising or analytics cookies, so we do not need to ask for cookie consent.
| Name | Purpose | Duration |
|---|---|---|
__Host-bc_session | Keeps you signed in securely | Up to 30 days, or until you close your browser if "remember me" is off |
__Host-bc_refresh_hint | Tells the site when to refresh your session | 60 seconds |
We also use your browser's local storage to remember your theme (light or dark) and which prompts you have dismissed. This stays on your device and is not sent to us for tracking.
11. California residents (CCPA/CPRA)
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. In the last 12 months we have collected these categories of personal information, from you and from your device, for the purposes in section 4:
- Identifiers: name, username, email address, IP address.
- Customer records and financial information: payout wallet addresses, deposit proofs, balances and transaction records.
- Characteristics of protected classifications: gender, only if you choose to give it.
- Commercial information: trades, positions and Piggy savings.
- Internet activity: sign-in history, browser and device information.
- Sensitive personal information: government identity documents, and your account sign-in details. We use these only to verify your identity, meet legal obligations and secure your account, never to infer anything about you.
We disclose these categories only to the service providers in section 5, for business purposes. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months, and we do not knowingly sell or share the data of anyone under 16.
You have the right to:
- know what personal information we have collected about you, where it came from, why we use it and who we disclose it to, and to get a copy;
- delete personal information, subject to legal exceptions such as our record-keeping obligations;
- correct inaccurate personal information;
- non-discrimination: we will not treat you differently for using any of these rights.
To make a request, email bluckcoin@gmail.com from the address on your account. We will confirm your identity before acting, and reply within 45 days (we may extend this once by a further 45 days, and will tell you if we do). You can use an authorised agent, who must show us your signed permission.
12. Children
Bluckcoin is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact bluckcoin@gmail.com and we will close it.
13. Changes to this policy
We will update this policy when our practices change. When we publish a new version you will be asked to review it the next time you visit.
14. Contact
Bluckcoin, 2717 Roeding Rd Apt 46, Ceres, CA 95307, United States
Privacy questions and requests: bluckcoin@gmail.com
Questions about this? Ask support.