What this site collects.

Hirantha Sandaruwan Lakshan, Colombo, Sri Lanka, runs this site and decides what it collects. To ask anything about it, use the contact page.

The tools run in your browser. The files you open in them are processed on your device and are not sent to this server.

The store's front page, join page, glossary and legal pages are open to everyone and collect nothing beyond the visit counting described below. The market pages are for members: you sign in with Google (see Accounts) and pay a membership by bank transfer in Sri Lankan rupees. The site never sees card details, because it takes no card payments.

When you join, the site stores your order: a reference such as HM-ABC123, your account identifier and display name, the plan, the number of months, the amount, its status and the times, the note you add about your transfer (up to 300 characters), and, if a payment is rejected, the reason given. The bank slip you upload (an image or PDF of up to 5 MB, with its file name) is kept in the site's database and only I can open it. Once a payment is approved, the start and end of your membership are stored. Your watchlist of coins is stored with your account and only you see it.

When you upload a slip, I get an email (sent through the email service Resend) and a notification on my own devices with the reference, the amount, your display name and your note, so I can check the payment. Nothing in the store is deleted automatically yet. Payment records are kept as long as tax law requires; to have the rest deleted, write to me via the contact page.

On the members' market pages your browser connects directly to Binance's public market data stream (fstream.binance.com) for live prices while the page is open and on screen. Binance then sees your IP address and your browser, as any site you connect to would, and handles them under its own privacy policy. Price snapshots and past charts come from this site's server, which fetches them from Binance itself.

The site is served through Cloudflare, which handles the request (including your IP address) to deliver the page and to filter abusive traffic. Cloudflare has its own privacy policy.

The site itself writes a security log entry (the time, your IP address, the path requested and a short note) only when a request looks like an attack, hits a rate limit or leads to a block. Ordinary page views are not written to that log. There is no automatic deletion of the security log yet; entries are kept until I delete them. The log is used to detect and stop abuse and nothing else.

The site uses Google Analytics 4 to count visits and see which pages are read. It records things like the page, the referring site, the type of device and browser, and an approximate location, and sets Google Analytics cookies. Google processes this data. It also notes when a tool is used, when a message is sent through a form and when an API key is made: only that it happened, never what you typed, picked or uploaded.

If you visit from the European Economic Area, the United Kingdom or Switzerland, analytics stays off until you choose "Allow analytics" on the banner, and you can choose "No thanks". Elsewhere it is on by default. Google offers a browser add-on to opt out.

The site also keeps its own simple count of visits, without cookies and without storing anything in your browser. When a page opens, it records the page, the site you came from, the country Cloudflare reports, the kind of device, browser and operating system, and how long the page stayed open. To tell visitors apart for one day it uses a code made from your IP address, your browser's user agent and a random value that changes every day and is deleted after two days, so the code cannot be turned back into your address or used to recognise you on another day. Your IP address itself is not stored. These records are kept for about 13 months and are not shared with anyone.

You can sign in with Google to get keys for the free data API (see the developers page) or to join the members' store (above). Signing in stores an identifier Google gives the site (not an email address), your display name and the times you signed in. For each API key it stores a fingerprint of the key (not the key itself), the name you gave it and how many requests it made. Commenting, liking and saving are switched off.

People who signed in before 25 October 2026 may also have old comments, likes and saved tools stored; none of it is shown on the site while those features are off. To have your account and everything linked to it deleted, write to me via the contact page with the display name on the account.

Settings such as the light or dark theme are kept in your browser's local storage and are not sent to the server. You can clear them in your browser at any time.

I keep what you send and my replies for as long as I need them to deal with your message, and do not pass them to anyone else.

Nothing collected here is sold. It is processed by the services named above (Cloudflare, Google) to provide the site. I aim to handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as its provisions come into force, and I update this page when what the site collects changes.

Last checked: 28 October 2026.