What we collect. Almost nothing.
Pegana is a read-only public dashboard plus an optional Telegram alert bot. We don't run ads, we don't sell data, we don't fingerprint you, and there's no account to create on the website. Last updated May 22, 2026.
Website (pegana.xyz)
The dashboard, asset detail pages, and methodology docs are served as static or server-rendered HTML. We don't set any analytics cookies, don't embed third-party tracking pixels, and don't share IPs with any vendor outside what our hosting provider (Hetzner) sees as part of normal HTTP serving. Standard server logs (IP, user-agent, requested path, response code) are retained for 30 days for abuse investigation and discarded afterwards.
API + WebSocket (/v1/*)
Every API request is logged the same way as the website. We rate-limit by IP to keep the service responsive — that rate-limit bucket lives in memory and resets when the process restarts. No request body inspection, no per-key analytics.
Telegram alert bot (@PeganaWatchBot)
If you /start a chat with the bot we store your Telegram user_id, chat_id, language preference, and the assets you subscribe to. This is the minimum we need to actually deliver the alerts you ask for. You can /stop at any time, which marks the row as blocked but doesn't hard-delete it — we keep it so we can prove to ourselves we stopped sending you messages. If you want a full hard delete instead, email privacy@pegana.xyz with your Telegram handle.
Third parties we talk to
Pegana pulls public data from Pyth, Sanctum, Jupiter, DexScreener, DefiLlama, and Solana RPC providers. Those calls don't carry any information about you — they're server-to-server requests asking for on-chain or oracle data.
Storage and security
Subscription data lives in a managed Postgres instance on the same VPS that serves the API. Backups go to a private Cloudflare R2 bucket. Both are encrypted at rest. Operational telemetry (Sentry, Prometheus) is configured to never send PII — error reports do not include request bodies or chat IDs.
Children
The service is not directed at children under 13. If you believe a minor has subscribed, contact the email above and we will remove the record.
Changes
If we ever expand what we collect, the new policy ships before the new collection does. The Last updated date at the top of this page is the source of truth. Material changes go in the changelog too.