What we collect. Almost nothing.
Every page is public and needs no account. We don't run ads, sell data, or fingerprint you.
Website (pegana.xyz)
The dashboard, asset detail pages, and methodology docs are served as static or server-rendered HTML. We don't set any analytics cookies or embed third-party tracking pixels. The following providers process visitor or service data as part of normal operation: Hetzner (backend hosting), Vercel (web hosting + analytics), Sentry (error monitoring), and Cloudflare R2 (backup storage). Standard server logs (IP, user-agent, requested path, response code) are retained for 30 days for abuse investigation and discarded afterwards.
API + WebSocket (/v1/*)
Every API request is logged the same way as the website. We rate-limit by IP to keep the service responsive. That rate-limit bucket lives in memory and resets when the process restarts. No request body inspection, no per-key analytics.
Third parties we talk to
Pegana pulls public data from Pyth, Sanctum, Jupiter, DexScreener, DefiLlama, and Solana RPC providers. Those calls don't carry any information about you, they're server-to-server requests asking for on-chain or oracle data.
Storage and security
Operational data lives in Postgres. Backups go to a private Cloudflare R2 bucket. Both are encrypted at rest. Sentry receives backend error telemetry only. No request bodies or PII are sent. Browser-side Sentry Replay is not enabled.
Data retention
Server logs are retained for 30 days. Backups are retained for 30 days in Cloudflare R2. Sentry events are retained per Sentry's default retention period of 90 days; no PII is sent to Sentry.
Children
The service is not directed at children under 13. If you believe a minor has submitted data to us, contact the email above and we will remove the record.
Changes
If we ever expand what we collect, the new policy ships before the new collection does. The Last updated date at the top of this page is the source of truth.