Privacy Policy
Last updated 6 November 2026
This policy explains what personal data Elyvo, a project operated by an individual (“Elyvo”, “we”) processes when you use elyvo.trade and api.elyvo.trade, why, and what choices you have.
1. What we collect
Request data (website and API)
When you load a page or call the API, our servers and our network provider receive technical data: your IP address, the date and time, the URL requested, the HTTP method and status, the user agent, and a request ID. API request logs exclude the authorization and x-api-key headers.
API keys
If we issue you an API key, we store only a SHA-256 hash of it, a label you give us, and when it was created or revoked. We never store the key itself.
Operator sign-in
The operator console (for Elyvo’s own curators) uses one strictly necessary cookie, al_operator, to keep an operator signed in for up to eight hours. It is HTTP-only and is not set for regular visitors. Operator decisions are recorded with the operator’s handle in an audit log.
Price chart (TradingView)
Passports for stock and ETF tokens embed TradingView’s chart widget for the underlying share or fund. Your browser loads it directly from TradingView, which receives your IP address and request details and may set its own cookies under its own privacy policy. Elyvo receives nothing from the widget. Other pages do not load it.
Wallet connection and trading
Connecting a wallet happens in your browser; Elyvo never receives your keys. When you request a quote or a swap, your wallet address, the tokens and the amount are sent through Elyvo’s API to Uniswap Labs’ Trading API, which builds the quote and the transaction. Elyvo’s API does not store them beyond Cloudflare’s request logs, and uses your country as reported by Cloudflare only to apply regional restrictions. Your eligibility confirmation is kept in your browser’s local storage (elyvo.trade.attested.v1). Transactions you send are public on the blockchain. If you connect with WalletConnect, its relay service handles the connection under WalletConnect’s own policy.
Price alerts (stored in your browser)
Price alerts you set are kept in your browser’s local storage (elyvo.alerts.v1) and never sent to Elyvo. While an Elyvo tab is open, your browser asks Elyvo’s API for a Uniswap quote of each alerted token about once a minute; that request contains the token, not your wallet. If you allow notifications, your browser shows them itself.
Watchlist (stored in your browser)
Assets you star are kept in your browser’s local storage under elyvo-watchlist, together with your theme choice. They are never sent to Elyvo. Clearing your browser’s site data removes them.
Portfolio check
When you check a wallet, your browser sends the wallet address directly to a public RPC endpoint for the chain to read token balances: PublicNode (Allnodes) first, and Robinhood’s own public RPC if that fails. That RPC operator receives the address and your IP address under its own terms. Elyvo’s servers do not receive the address, and nothing about the check is stored.
Messages you send us
If you email us, we keep your message and address to answer and, for correction requests, to document the change.
What we don’t collect
No accounts, names or payment details for visitors; no analytics or advertising scripts of our own; no fingerprinting. The site’s fonts are served from the site itself. Elyvo describes token contracts; it does not index or profile wallet holders.
2. Why we use it
- To provide the Service: delivering pages and API responses.
- To protect it: rate limiting (per IP address, or per API key), preventing abuse, and investigating incidents.
- To fix problems: request IDs let us trace an error you report.
- To keep a record: the audit log documents who changed curated data and why.
Our basis is our legitimate interest in operating a secure, reliable public information service, and, for messages, handling your request.
3. Who processes it
We use these service providers, who process data on our behalf:
- Cloudflare: DNS, TLS and hosting of the website and the API (Workers and the D1 database) at elyvo.trade and api.elyvo.trade; it sees your IP address, which is used for rate limiting.
- PublicNode (Allnodes): the public RPC endpoint your browser calls for the portfolio check (see above). Only you send it the wallet address; Elyvo’s own servers use it to read token contracts, not visitors’ data.
- Hugging Face: hosting of a static copy of the site.
- Uniswap Labs: the Trading API that returns quotes and unsigned swap transactions for the swap panel (see above), under its own terms and privacy policy.
- TradingView: the embedded price chart on stock and ETF token passports, loaded by your browser from TradingView (an independent provider under its own terms).
These providers may process data in countries other than yours. We do not sell personal data or share it for advertising.
4. How long we keep it
Request logs are kept only as long as needed for security and troubleshooting, then deleted or overwritten. API key records are kept until the key is revoked and the record is no longer needed. Audit log entries are kept permanently, because the integrity of the curation record depends on it.
5. Your rights
Depending on where you live (for example under the EU/UK GDPR or Indonesia’s Personal Data Protection Law), you may have the right to access, correct or delete personal data about you, to object to or restrict its use, and to complain to a data protection authority. To make a request, contact truvowork@gmail.com. We may need to verify that a request is yours.
6. Children
The Service is not directed at children and we do not knowingly collect their personal data.
7. Changes and contact
We will update this policy when our practices change; the date at the top shows the latest version. Questions: truvowork@gmail.com.
See also the Terms of Use.