DRAFT, pending counsel review. This policy is not in effect until counsel reviews it and it is published. The bracketed contact lines are placeholders.

Privacy Policy

Updated 26 October 2026.

Effective: [Effective date: set when published]

Virtus Blockchain Labs LLC, a New York limited liability company ("we", "us"), runs Terminal at terminal.tokensmarketcap.com. This policy says what personal information we collect, why we collect it, who receives it, how long we keep it, and how you can delete it or ask for a copy.

This policy is written for people in the United States, including New York and California. Later sections speak to residents of states with their own privacy laws, and to people in the European Economic Area, the United Kingdom, and Switzerland. The Cookies notice and the Subprocessors list are part of this policy. We handle information as this policy describes once the policy is published. Agreeing to the terms is not the only reason we are allowed to use information. The reasons are listed below.

Information we collect

We collect the following categories of personal information:

Identifiers. Name, email address, account id, and the id a sign-in provider gives us (Google or GitHub).
Account security data. A hash of your password if you use a password. We do not store the password itself. We do not store a full card number.
Commercial information. Invoices, the plan or pack you bought, the amount, the status, a payment reference, and the balance ledger.
Customer content. Agent names, instructions, schedules, notes, run logs, memory the agent keeps, notifications, and the text of a chat message at the moment we send it to a model or a safety check.
Connection data. If you connect another service, the account email that service returns and the access tokens needed to act for you. New tokens are encrypted before they are stored. A token saved before encryption was turned on can remain readable by the host until it is sealed.
Sensitive personal information. An access token for a service you connect, because that token can open the service, and the contents of mail, files, or other items that connection returns when a run you asked for reads them. We use these only to provide the connection you asked for. We do not use them to infer characteristics about you.
Alert destinations. If you add one, the Telegram chat id, the Discord or webhook address and its secret, or the push address your browser gives us. Webhook secrets and bot tokens are encrypted before they are stored.
Developer data. API keys (we store a hash, never the key), the names and permissions you give them, connected AI assistants, and daily counts of the calls and charges your keys made.
Payments in USDC. If your software pays through x402, the paying wallet address, the amount, the network transaction, and the time. These are public on the network as well.
Marketplace data. If you list a service or subscribe to one, your handle, profile, the conditions you publish, sales, earnings, and the public record of that service.
Sanctions screening. Before a USDC payment, a listing, or a first paid plan, the result of checking your name or paying address against the US Treasury sanctions list, and the country your request came from, found from the IP address in a database on our own server.
Messages to us. Feedback you send from the app, and email you send us.
Invites and referrals. The invite code or referral link you used, and which account it came from.
Usage events. We record a short list of product steps, such as a visit, a sign-up, a confirmed email, a first alert or a payment, with the time, the page path, and an account id or a random visitor id. For the first visit we also keep the referring site's domain and any campaign tags in the link. We do not store your IP address, your email address, or anything you typed in these records. We use them to count how many people reach each step, not to profile you.
Internet and device data. We do not build a browsing profile. For sign-in and request limits we store a hash of your IP address and a hash of the email address, not the address itself. We delete the hash when that short window ends, which is within an hour.
Renewal consent. When you start a renewing plan, we keep the renewal terms shown to you at checkout, the time, your browser's user-agent string, and a keyed hash of your IP address. This is the record that you agreed to the renewal. We keep it for at least three years, or one year after the plan ends if that is later. If you delete the account, we keep the record without your account id.
Safety-check records. When the check is on, the decision, the stage, and the time it took. We do not keep a separate chat transcript.
Inferences. The safety check's allow-or-not result. We do not build a marketing profile.

We do not collect government identifiers, precise location, health information, or biometric identifiers. We do not knowingly collect personal information from anyone under 18.

Sources are you, your software, the sign-in provider you choose, the services you connect, TokensMarketCap if you sign in through that site, Stripe if you pay by card, the public crypto network and Coinbase's payment service if you pay that way, Telegram if you write to our bot, Typesafe if the safety check is on, the model provider (Anthropic, xAI or Groq) when a note or chat reply is generated, and our own records of how the service ran.

Why we use it

We use personal information to:

Open and secure your account, including email confirmation and password reset
Run the agents you turn on and write the notes you asked for
Answer chat
Take payment, keep a ledger, and send a receipt
Send email you asked for, and email the account needs (confirmation, a failed run, a payment, a price watch or an alert you left on)
Check abuse and enforce the terms, the Acceptable Use Policy, and the sanctions rules
Keep payment and tax records after an account is deleted, with the identity link removed
Fix the service and respond to you

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use it to tell you to buy, sell, or hold an asset. We do not use sensitive personal information to infer characteristics about you.

Who else receives it

These providers receive personal information only to do the job named here. The Subprocessors list has each one in a table, with the server host and backup storage. This list is not a promise that a signed service-provider or processor contract is already in place for each of them. Counsel attaches those contracts. Until a contract is signed, do not read a name below as a legal status.

Model providers. A model writes notes and chat replies, and which company runs it depends on whether your account pays. For paying accounts, Anthropic receives the prompt at api.anthropic.com. For everyone else (free accounts, trials, beta and complimentary grants), a Grok program on our server sends the prompt to xAI under our own xAI subscription. That second arrangement is temporary. A non-paying account's prompt is never sent to Anthropic. On a host set up another way, Groq (api.groq.com) or xAI's API (api.x.ai) can take either place. An xAI API request sets store to false, which turns off saved conversation state on that call. That flag is not, by itself, a promise that xAI keeps no copy. All of these companies are based in the United States. The prompt can include your instructions, market facts, stored notes for that agent, names of connected accounts, text read from a connected account for that run, and the chat message. It does not include your password, your API keys, or your payment details. If no provider is available for your account, notes show the market facts only and chat says answers are not available. [Counsel will attach the provider retention terms.] We do not sell that text.
Typesafe. Safety check at api.typesafe.ai, only when that check is configured. Receives the chat message, or the agent name and instructions. Returns a decision we store. If the check is off, we do not send the text.
Resend. Transactional email when the host is not using SMTP. Receives your email address and the message, which can include your name, a confirmation link, a receipt, or an alert note.
SMTP provider. If the host is configured with an SMTP server, that provider sends the mail instead of Resend and receives the same message.
Stripe. Card checkout, when card payments are open. Receives the plan or pack name, the price, and the payment. Stripe handles the card. We store the invoice and whether it was paid. We do not store the full card number.
Google. Sign-in uses your name, email, and Google account id (openid, email, and profile). If you connect Gmail, Drive, Calendar, Sheets, Docs, or YouTube, Google also exchanges the tokens and the content those connections need. Gmail access can include reading mail and composing mail. Drive access can include reading files and files the connection creates. Calendar, Sheets, and Docs access can include the items you ask an agent to read or change. YouTube access is read-only. We revoke Google tokens we still hold when you delete the account.
GitHub. Sign-in, if you choose it. Receives and returns your name, email, and profile id. We do not get your GitHub password.
Telegram. If you add Telegram as an alert destination, Terminal's bot sends your alerts to your chat, and Telegram receives the alert text and your chat id. If you write to the bot, Telegram passes us your message, and a question you ask goes to the model provider as chat. If you connect a bot of your own, we store its token encrypted and the bot identity Telegram returns.
Discord. If you add a Discord webhook as a destination, Discord receives the alerts sent to it.
Your browser's push service. If you turn on phone or browser alerts, the push service your browser uses (for example Google, Apple, Mozilla, or Microsoft) carries an encrypted alert to your device. It receives the push address, not the alert text.
Coinbase. If your software pays through x402, Coinbase's payment service checks and settles the payment. It receives the paying wallet address, the amount, and the signed payment.
Webhooks and bots you set up. We send alerts to the address you chose. That company works for you, not for us.
TokensMarketCap. We request market data to build a note. That request is for public market figures. We do not send your password or your contact list to fetch a price.

A crypto payment is public on the network you send it from. Anyone can see a transfer to the invoice address. We store the invoice so we can credit what that invoice bought.

We can also disclose information if the law requires it, or to defend the service against abuse. We do not sell lists of users.

Email

Email about the account or about a charge does not include an unsubscribe link. It is about the account or the payment.

Other product email, such as an alert or a morning brief, includes an unsubscribe link. One click stops that kind of mail. It does not close the account, and it does not stop email about a charge. The message also uses a list-unsubscribe header so a mail client can send the same request.

Commercial email has to include a valid postal address. Once the street address in the contact section is a real address, commercial email includes it. Until that line is filled in, treat the address on the message as missing.

Cookies

We use only first-party cookies. We do not set advertising cookies, and no other company sets cookies on this site. The Cookies notice lists every cookie and every value the app keeps in your browser.

terminal_session. Keeps you signed in. HttpOnly, SameSite=Lax, and Secure on HTTPS. If you leave "Remember me" checked, it lasts 30 days. If you clear that box, the cookie ends when the browser closes and the server session lasts one day.
oauth_state. Matches a Google or GitHub sign-in to your browser. HttpOnly, about 10 minutes.
oauth_next. Remembers whether that sign-in was for login or for connecting an account. HttpOnly, about 10 minutes.
oauth_return. Remembers the page to return to after that sign-in. HttpOnly, about 10 minutes.
terminal_invite. Holds a beta invite code until it is used. HttpOnly, 7 days.
terminal_ref. Remembers the first invite link or shared alert page this browser opened, for the referral program. HttpOnly, 30 days. A shared alert page does not set it when your browser sends Do Not Track or Global Privacy Control.
terminal_vid. A random visitor id for our own sign-up statistics, so we can tell which page or link brought a visitor who later signs up. HttpOnly, SameSite=Lax, 180 days. We do not set it when your browser sends Do Not Track or Global Privacy Control.
terminal_market. Remembers that a link turned the marketplace's labelled demo off (Terminal staff use it to see live data). HttpOnly, SameSite=Lax, ends when the browser closes.

Confirmation links last two hours. Password reset links last one hour. Those links are in email, not in a cookie.

Do Not Track and Global Privacy Control. We do not track you across other companies' sites. When your browser sends Do Not Track or Global Privacy Control and you are not signed in, we record no usage events and set no visitor cookie. We treat Global Privacy Control as an opt-out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. Once you have an account, we record the product steps above with your account id, because we need them to run the service you asked for. We do not use that signal to build a profile across other companies' sites.

Retention

We keep account information, agents, notes, logs, memory, notifications, connection tokens, and safety-check records until you delete the account.

We keep invoices and the balance ledger after deletion. We remove the link to your account. We keep those rows as payment and tax records for as long as tax, accounting, and sanctions rules require. [Counsel will set the number of years.]

Usage events are deleted after 400 days, or with the account.

USDC payment records, sanctions screening results, and marketplace sales are payment and compliance records. We keep them for as long as tax, accounting, and sanctions rules require, including after the account is deleted. [Counsel will set these periods. Engineering will confirm what deletion removes from each of these records.]

Rate-limit hashes are deleted when the window ends, within an hour. Verification and reset secrets expire on the timers above and are cleared when they are used.

The machine that serves the site may keep ordinary connection logs. Those logs are not a product profile, and this policy does not set their schedule. [Counsel will confirm host-log retention.]

Deletion and export

You can delete the account yourself. Sign in, open Account deletion, and type your email to confirm. Deletion removes your profile, sessions, agents, runs, memory, queue jobs, notifications, safety-check log, and connection tokens, and it asks Google to revoke access you granted. It cancels unpaid invoices. It cancels a renewing plan immediately and does not refund the days left in the period you already paid for, except where the law requires a refund. It does not cash out credits that are left. It does not delete market data on tokensmarketcap.com. You cannot undo it.

You can ask for a correction of your name from your profile. For any other correction, email us.

You can ask us to export a copy of your data. We do not offer a download button yet. Write from the account email and ask for a copy. We will send a readable file to that email after we confirm you control the account. The file covers the profile, agents, notes, and notifications we still have. Payment rows that no longer point at an account are not a full history of your identity.

California privacy rights (CCPA)

The California Consumer Privacy Act applies to a business that meets its size or data thresholds. We may not meet them yet. [Counsel: confirm whether the CCPA applies.] We still give California residents these rights in personal information we hold:

The right to know the categories and specific pieces we collected, the sources, the purposes, and the categories of third parties we disclosed them to
The right to delete personal information, which you can do on the deletion page or by asking us
The right to correct inaccurate personal information
The right to opt out of sale or sharing for cross-context behavioral advertising. We do not sell personal information and we do not share it for that advertising, so we do not show a "Do Not Sell or Share" link. If you still want to send an opt-out request, email us and we will confirm. Global Privacy Control is described in the cookies section.
The right to limit use of sensitive personal information. The sensitive information we collect is listed above. We use it only to provide the connection you asked for. We do not use it for the extra purposes the statute lets you limit. You can disconnect a service, or delete the account, to stop that use.
The right not to be discriminated against for exercising these rights. We will not charge you a different price or cut off a feature you paid for because you asked.
The right to use an authorized agent. The agent must show permission, and we may still ask you to confirm the request from the account email.

To use a right, delete the account on the deletion page, or write to contact@tokensmarketcap.com or through tokensmarketcap.com. We will verify that you control the account email. We will respond within 45 days. If we need more time, we will tell you why and may take one extra 45 day period, as the statute allows.

In the 12 months before this draft, the categories we collect and the categories we disclose are the ones listed above. We disclose them to the providers listed above, for the purposes listed above. We do not sell them.

California's Shine the Light law (Civil Code section 1798.83) lets residents ask whether we shared personal information with third parties for their own direct marketing. We do not.

California online privacy (CalOPPA)

This section meets the California Online Privacy Protection Act.

The categories of personal information we collect are listed above.
The third parties we share it with are the providers listed above.
You can review and ask us to change your information from the profile page, the deletion page, and the contact path above.
If we change this policy, we will update the date at the top. If we start using personal information for a materially different purpose, we will email the account address before we do that.
This draft is dated 23 October 2026. It takes effect when it is published and you agree to the terms.
Our Do Not Track practice is described in the cookies section. We do not track users across third-party sites. When the browser sends Do Not Track or Global Privacy Control and you are not signed in, we record no usage events and we set no visitor cookie.

A link to this policy is in the site footer.

Residents of other US states

Several states give their residents privacy rights, for example the right to know what we hold, to get a copy, to correct it, to delete it, and to opt out of sale, targeted advertising, and profiling. Some of those laws apply only to businesses above a size or data threshold. We give these rights to every US resident, whether or not a state's law applies to us yet.

We do not sell personal information, we do not use it for targeted advertising, and we do not use it for profiling that has legal or similarly significant effects.
To make a request, delete the account on the deletion page, or write to contact@tokensmarketcap.com from the account email. Say which right you want to use and which state you live in. An authorized agent can make a request for you, with your permission.
We confirm that you control the account email, and we answer within 45 days. If we need more time, we tell you why, and we may take one extra 45 days.
If we say no, you can appeal. Reply to our answer with the word "Appeal" and why you disagree. We answer the appeal within 45 days. If we still say no, you can contact your state's attorney general.

People in the EEA, the UK, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, this section also applies. We have not appointed a representative in those places.

We are the controller for Terminal account information. Contact us through the contact section below.

We use personal information on these bases:

The contract with you, for the account, the alerts you turn on, chat you ask for, and payments
A legal obligation, for tax, accounting, and sanctions records
Legitimate interests, for security, abuse prevention, and counting product steps. You can object. We stop where the law says your rights come first.
Consent, where we ask for it, including an optional connection to another service. You can disconnect that service, and you can withdraw that consent.

We do not claim that an adequacy decision or a set of standard contractual clauses is already in place. Providers named in this policy process information as that section describes. Most of them are in the United States. Counsel names the transfer tool when the contracts are signed. Until then, this section is not a promise that a transfer tool is signed.

You can ask to access, correct, or delete your information, to restrict processing, to receive a portable copy, to object to processing based on legitimate interests, and to withdraw consent. You can complain to your supervisory authority. Start with the deletion page or the contact section. If the law does not require us to grant a request, we will say why.

The safety check can block a message or an agent setup. It does not decide credit, housing, employment, or insurance. Write to us if you want a person to review a block.

A purchase from outside the United States may come with a right to cancel that the refund policy cannot take away. The refund policy says how to ask.

Children

Terminal is for people 18 and older. It is not directed to children under 13. We do not knowingly collect personal information from a child under 13, or from anyone under 18. If we learn an account belongs to someone under 18, we will delete it. Write to us if you believe we have a child's information.

Security

No method of storage or transmission is perfectly secure. We use access controls, encrypted transport, hashes for passwords, sessions, and API keys, and encryption for connection tokens, webhook secrets, and bot tokens. The Security page describes these measures and what is not finished yet. You are responsible for your password and for the devices you sign in from.

New York's SHIELD Act (General Business Law sections 899-aa and 899-bb) requires a business that holds New York residents' private information to keep reasonable administrative, technical, and physical safeguards, and to give notice of a breach. We follow it for everyone, not only New York residents. If someone gets your personal information without permission, we tell you by email without unreasonable delay, and within the time the law sets, and we tell the regulators the law names.

Changes and contact

We will post changes on this page and change the date. A material new purpose gets an email, as the CalOPPA section says.

Virtus Blockchain Labs LLC, a New York limited liability company

Street address: 1735 62nd Street, Apt 2R, Brooklyn, NY 11204

Support email: contact@tokensmarketcap.com

tokensmarketcap.com