Privacy notice

When you contact us or request beta access. Your name, work email, company (optional), the topic you choose, roughly how many operational wallets you run (optional), and your message.

When your organization uses the service.

• Account details: name, email address, and a password, which we store only as a one-way hash.
• Two-factor authentication factors and backup codes, used to confirm sensitive actions.
• Organization and team details: members, roles, and invitations.
• The wallet addresses you register and the network each one is on, your gas policies, and the balances and low-balance events we record for them. Wallet addresses and balances are public blockchain data.
• If you verify that you control a wallet, the one-time message we ask it to sign and the signature your wallet returns. A signature proves control of the address; it cannot be used to move funds.
• Alert destinations, such as email addresses and Slack or Discord webhook URLs. We encrypt these and never show full webhook URLs in logs or audit records.
• If you connect an exchange (Bybit, Binance, Coinbase, Gate, KuCoin, OKX, or more than one): a dedicated API key for each (for KuCoin and OKX, together with the key's passphrase). It needs only read access; we accept a key that can also trade, transfer, or withdraw, but we only read with it. We encrypt it and never return it in the dashboard or API, and we record whether the exchange reports it as read-only. Before a new key replaces your current one, we test it against the exchange you chose; a key that fails replaces nothing, and we delete it and keep only the reason it failed. When you revoke a key we delete it at once. When a new key replaces one, we keep the old key encrypted for seven days so you can restore it, then delete it. Deleted keys can remain in our encrypted backups until they rotate out. With it we read only your USDC balance and your balances of the networks' own coins (such as ETH, SOL, and XLM), from your Bybit Funding account, Binance Spot wallet, Gate Spot account, KuCoin or OKX Funding account, or the Coinbase portfolio the key is limited to, and the exchange's withdrawal fees and minimums for those networks.
• An audit trail of sensitive actions in your organization: who did what, and when.
• Requests you send us for a network, token, or feature: what you asked for, how much it matters to you, your notes, any contract address or wallet estimate you give, and who in your organization sent it. Other customers don't see your requests. GasTanker staff see them with your name, email, and organization, along with how many wallets your organization monitors and whether it has connected an exchange, which we use to rank requests.

Technical data. Like most websites, our servers may record request details such as IP address and browser type for security and troubleshooting. To stop the contact form being flooded, we count recent messages by the sender's IP address and email address.

We never ask for seed phrases, recovery phrases, or wallet private keys.

• To reply to your enquiry and run the design-partner beta.
• To provide the service: monitor your wallets, evaluate your policies, and send the alerts you set up, including an alert when your connected exchanges cannot cover the gas your wallets need.
• To keep accounts and organizations secure, including two-factor checks and the audit trail.
• To operate, back up, and troubleshoot the service.
• To decide what to add to GasTanker next, and to follow up with you about what you asked for.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

We do not use analytics or advertising cookies. If you sign in, we set a session cookie that keeps you signed in, and the workspace remembers whether its sidebar is open. The website stores your light or dark theme choice in your browser. All of these are needed for the features you use.

If you use the API playground in our documentation, the API key and other values you enter are kept in your browser's local storage so you don't have to enter them again. They stay on your device until you clear this site's data, and requests you send from the playground go from your browser directly to the GasTanker API.

We share data only with providers that help us run GasTanker:

• Cloudflare, which hosts the website and delivers it through its global network. Every request to gastanker.xyz, including the dashboard's requests to our API, passes through it.
• Our hosting provider, which runs the API and database.
• An email delivery provider, for verification, security, and alert emails.
• Slack, which receives contact and beta-access requests from the website form.
• An independent storage provider that holds encrypted database backups.
• Blockchain data providers, which we query with your registered wallet addresses to read their balances: a commercial RPC provider, and public endpoints that each network, its foundation, or an infrastructure provider runs for anyone to use (for example, the Stellar network's Horizon service and Sui's data service). Each of these sees the wallet addresses we ask it about.
• A gas-price data provider (LI.FI), which our server asks how much gas each network typically needs, so the dashboard can show an estimate next to your threshold and target. It receives only network identifiers, never your wallet addresses or account details.
• Your connected exchanges (Bybit, Binance, Coinbase, Gate, KuCoin, OKX, or more than one), if you connect any, which we query with the keys you provide. These requests come from a dedicated GasTanker server in Japan, so you can restrict the key to that server's IP address.

We may also disclose information when the law requires it. Some providers may process data outside your country; where that happens, we rely on the safeguards the applicable law provides.

We keep enquiries for as long as we need them to follow up. We keep account and organization data while your organization uses GasTanker. When it stops, we delete or anonymize it, except audit records and other data we must keep for security or legal reasons. Stopping monitoring for a wallet doesn’t delete it: we keep its address, readings, and history with your organization’s records, so its audit trail stays complete and adding the address again restores it. Encrypted backups rotate out on a fixed schedule. You can withdraw a request at any time, which deletes it and your note. If we have already acted on what you asked for, we keep its title, its status, and our record of what we did. The contact form's count of recent messages forgets an IP or email address within two hours of its last message.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict how we use it. To make a request, email privacy@gastanker.xyz. We may need to confirm your identity first. If UK data protection law applies to you, you can complain to the Information Commissioner's Office (ico.org.uk); elsewhere, to your local data protection authority.

Credentials are encrypted individually and decrypted only by an isolated component. Sensitive changes require a second factor. No system is perfectly secure, but we design GasTanker to limit what any single failure can expose. Read more on our security page.

GasTanker is a business service and is not directed at children.

We will update this notice when our practices change and revise the date above. Questions about privacy go to privacy@gastanker.xyz.