Privacy Policy

Effective date: October 2, 2026

Company: Citrine Edge. Address: Mailing address available upon request. Contact: support@citrineedge.com.

Privacy rights clarification updated October 14, 2026.

Overview

Citrine is a local-first Android application. Most app settings, imported Coinbase credentials, cached market data, backtest data and results, trading state, and account-derived display values remain on the user's device. Citrine Edge does not sell personal data, use advertising SDKs, or build advertising profiles.

Local app data and credentials

Coinbase API credentials are imported through Android's document picker. Imported credential profiles are stored in app-private encrypted storage backed by Android Keystore. They are not included in the app package and are not sent to Citrine Edge for remote custody. The app may also store preferences, subscription state, backtest history, cached archive data, logs, selected-account state, and position-protection state locally so its features can operate and recover safely.

Local app data can generally be removed by deleting it inside the app where that option is available, clearing Citrine's app data, or uninstalling Citrine. Android backup and device-transfer rules are configured to exclude Citrine's private app data and imported credentials.

Deleting app data does not delete original import files or exports stored elsewhere. Trading notifications may display position and financial information; lock-screen visibility depends on Android and user settings.

Coinbase account and trading data

When a user imports a Coinbase API key or uses connected features, Citrine sends signed requests directly from the device to Coinbase. Coinbase may receive the API key identifier, request signature, market or product request, and user-authorized account, position, or order instructions. Citrine retrieves the account, portfolio, position, order, fee, product, and market information needed to provide the requested display, backtesting, monitoring, and automation features. Citrine Edge does not receive the user's Coinbase API secret or centrally store the user's Coinbase account and order history.

Coinbase controls Coinbase accounts, eligibility, API-key creation, derivatives access, custody, and trading services. Coinbase processes information under its own terms and privacy policy.

Subscription and app-integrity verification

For users with a Google Play purchase, Citrine may send a Google Play purchase token, a random app-install identifier, the app version, a one-time request identifier, and a Play Integrity token over an encrypted connection to Citrine's entitlement-verification service. The service sends the verification request to Google to confirm subscription state, app recognition, licensing, signing identity, request integrity, and device integrity.

The Citrine entitlement service does not use a database or analytics store and does not persist verification request bodies, purchase tokens, or install identifiers. It returns a short-lived signed entitlement lease to the device. Google and infrastructure providers may retain data or technical request metadata under their own policies and fixed retention schedules.

Affiliate referrals and commissions

Optional affiliate tracking is off by default. Only after you separately enable it may Citrine read Google's install referrer and click/install timestamps or verify an affiliate referral. To verify an eligible subscription referral, it sends the referral receipt, a Google Play purchase token and order identifier, app version, one-time request identifier, and Play Integrity token over an encrypted connection to a separate Citrine affiliate service. That service checks the purchase with Google. Referral processing does not control subscription access or trading, and does not send Coinbase credentials or trading information.

While the optional choice is enabled, a private retry record on the device temporarily holds the referral receipt, purchase token, order identifier, and purchase time so an interrupted verification can resume. Withdrawing that choice cancels affiliate verification work and clears pending referral and purchase data on the device. Otherwise, raw pending purchase data is removed when processing finishes or, when the app next processes the queue, after its ninety-day retry window expires. Clearing app data or uninstalling also removes these local records. They are excluded from Android backup and device transfer. Withdrawal does not erase records already lawfully retained for accounting or legal claims under the separate retention rules in this notice.

The affiliate ledger stores the referring affiliate, verified order identifier, a cryptographic hash of the purchase token, relevant referral and payment dates, currency, verified revenue, commission, and refund or payout adjustments. Eligible monthly renewal orders are linked to the original accepted referral for commission and refund verification, using the same pseudonymous purchase lineage. No new customer identity or trading information is collected for renewal commissions. Purchase tokens and integrity tokens are processed transiently by this service, not stored in its ledger. We do not retain customer names or addresses returned by Google's order service. These purchase records are pseudonymous, not anonymous. No advertising ID, fingerprinting, advertising SDK, or customer account is added for this purpose. Affiliates receive aggregate commission statements, not customer identifiers or financial-account data.

Private affiliate portal

The private affiliate portal collects an applicant's name, email, public channel links and proposed promotion. We use these records to review applications and administer the program, not to add applicants to unrelated marketing lists. The portal also records application status, terms acceptance and version, onboarding and review history, commission statements and payment records. Applications previously sent through the website contact form remain subject to the support-email handling described below; they do not automatically create a portal account.

Where the portal's language-choice feature is enabled, the language saved in your profile is used for the portal and transactional emails. This is a language preference, not proof of residence or program eligibility.

Invited affiliates provide a payout method and recipient contact email: a PayPal account email or a Square recipient contact email, as applicable to the agreed method. Email confirmation establishes access to that inbox, not ownership of a payment-provider account or completed payee verification. Citrine Edge separately reviews the payee and required tax documentation. Payments are initiated manually through the agreed provider, not automatically by the portal. Square and PayPal process payment information under their own policies. Recipient banking details are entered through the provider's approved process, not in portal text fields.

Required tax PDFs are submitted through an authenticated, restricted upload and encrypted by the portal before storage in a private object-storage bucket. Authorized program administrators can decrypt and review the documents through separate protected owner access. The portal records document-access events. This is not end-to-end encryption against Citrine Edge, and uploading a document does not automatically verify it. Do not put bank details, tax identifiers, API keys or account credentials in application text or ordinary support messages, and do not email completed tax documents.

Private affiliate messages are exchanged in a thread between an authenticated affiliate and the Cloudflare Access-verified program owner. Messages are accessed in the private portal inbox; no email notifications are currently sent for these messages. Messages are plain text only and encrypted at rest by the portal using its existing service encryption key. The authorized owner can decrypt and read them to administer the program; this is not end-to-end encryption against Citrine Edge. Messages are limited to 2,000 characters, with sending limits of 20 per hour and 100 per day. Storage is capped at 1,000 messages per thread and 100,000 across the service. Do not include API keys, trading-account data, bank details or tax identifiers. Required tax documents remain part of the separate restricted onboarding upload, not a message attachment.

Private affiliate messages are normally retained for 180 days, subject to legal or account-retention holds. Archiving an affiliate account is reversible, revokes its portal sessions and pauses its referral link; it is not deletion of the account's records. Financial, tax and audit records remain subject to their separate retention requirements. The owner can read, but cannot post to, an archived thread. Archiving does not promise immediate message deletion or override a retention hold.

Portal sign-in uses private, single-use email links that expire after 20 minutes and a necessary secure session cookie lasting up to 24 hours. Authentication tables store cryptographic hashes of login and session tokens; the sign-in email itself contains the usable link. Payout-email confirmation links expire after 24 hours. Sensitive onboarding changes require a recent sign-in. The session cookie is used for authentication, not advertising or cross-site marketing tracking. Routine sign-out security events are normally removed after 180 days, unless an active retention hold or controlled disposal operation requires them to remain. This does not shorten the separate retention of financial, onboarding-review or tax-document-access records.

Transactional emails cover sign-in, application decisions, onboarding, payout-contact confirmation or changes, and payment-status updates. Outbound message payloads are encrypted while queued. A delivery acknowledgement is not proof that an email reached or was read in an inbox; uncertain delivery may lead to a duplicate notice. These emails are not marketing subscriptions and do not themselves send money. Cloudflare provides portal hosting, database and private document storage, transactional email delivery, abuse protection and owner-access controls.

Affiliate accounting records are retained for up to seven years after the relevant payment or adjustment where needed for accounting, disputes, fraud prevention, or legal obligations. Unsuccessful applications are normally removed after twelve months from a decline or the last meaningful application or onboarding activity, unless an ongoing matter requires retention. Repeated sign-in alone does not extend that period. We apply these periods through scheduled cleanup and documented operator review. Accounting-related tax retention is based on the relevant payment or adjustment and a review of settled obligations, not simply the date a replacement document was uploaded. To request access, correction, or deletion, contact support@citrineedge.com. A Google Play order identifier can help locate a purchase record; never send your purchase token, API keys, bank information, or tax identifier by email. Records required by law or for a current dispute may need to be retained.

Removal or minimization of a portal profile and its tax documents does not itself erase accounting records, payment-recipient snapshots, audit history or provider recovery copies. Those records require separate retention review and, where appropriate, a controlled disposal process. Retention exceptions are reviewed; deletion is not an automatic promise that every copy disappears at the same moment.

Support communications

If a user submits an in-app support request, Citrine sends the message, category, and any optional name or reply email the user enters. It also includes limited diagnostics: app version, app version code, Android version, device manufacturer and model, package name, and a non-secret support request identifier. Support requests are delivered to Citrine Edge's support mailbox and retained as needed to answer the request, maintain service records, prevent abuse, and meet legal obligations.

Do not send Coinbase login credentials, API keys, private key material, passphrases, seed phrases, account identifiers, raw order history, or other secrets in a support message, screenshot, export, or email. Citrine applies secret-pattern redaction to support text, but users remain responsible for reviewing what they submit.

Archive, notices, and network data

Citrine downloads historical backtest archives and a read-only notices feed from Citrine Edge services. Those requests may include ordinary network information such as IP address, user agent, app version targeting, request time, and cache headers that hosting and security providers process to deliver and protect the service. Citrine does not use those requests for advertising or cross-app tracking.

Website data

The public Citrine Edge website does not require a user account and does not connect to a visitor's Coinbase account. The separate affiliate portal requires email authentication to access private affiliate records; it does not create access to a Coinbase account. The hosting provider may process ordinary request information such as IP address, browser type, requested page, and request time to deliver and secure the site. If a visitor emails Citrine Edge, the visitor's email provider and Citrine Edge's email provider process that communication.

The website can remember your chosen reading language using first-party localStorage in your browser. That preference stays only in that browser until you clear it. It does not trigger an IP-based location or residency check and is not used for cross-site analytics.

The website contact form sends the name, reply email, topic and message you enter, along with a request identifier, to our support service. It does not attach app logs, account data or files. Messages are delivered through our support email provider, Resend, and retained under the support-communications policy above. We do not add website correspondents to a marketing list.

Cloudflare Turnstile protects the support form and the portal's public application and sign-in forms from automated abuse. Cloudflare processes technical information such as your IP address, browser and challenge interaction for this purpose. These forms also use short-lived rate limiting. See Cloudflare's privacy policy. This website does not add advertising pixels or cross-site marketing analytics.

Cloudflare acts as a processor for Turnstile's website-protection processing and as an independent controller for improving its bot detection. See the Turnstile Privacy Addendum.

Service providers and data sharing

Citrine uses Coinbase for user-requested account and trading functions, Google Play for distribution, billing, licensing, and integrity verification, Android for operating-system and security services, Cloudflare for website, affiliate portal and app-service infrastructure, and email providers for support communications. Providers may process data on our behalf or act as independent controllers for their own purposes, depending on the service and processing activity. Citrine Edge does not sell user data or share it with data brokers, advertisers, or unrelated marketing partners.

Purposes and lawful bases

Where the GDPR applies, we rely on contractual necessity to deliver requested paid software and verify subscription access, and for processing necessary to take steps you request before a creator agreement or to perform that agreement.

We rely on legitimate interests to answer support requests, secure and administer our services, prevent fraud, maintain accurate referral and commission accounts, and establish, exercise or defend legal claims. We limit data and retention to these purposes and use the access controls, pseudonymisation and security measures described in this notice. You may object where the GDPR applies.

We rely on your separate optional consent for affiliate tracking and the associated device access. This choice is off by default and must be enabled before any Install Referrer read or affiliate verification. General privacy acknowledgement, a creator agreement or buying software is not that consent. You may withdraw the choice; this cancels affiliate verification work and clears pending referral and purchase data on the device. Declining or withdrawing does not cancel paid software access. Records already lawfully held for accounting or legal claims remain subject to the separate retention rules in this notice.

International processing and safeguards

Citrine Edge operates from the United States. We use global service providers, including Cloudflare for infrastructure and portal transactional email and Resend for website support-message delivery. Personal data may be processed in the United States and other countries outside the EEA. Processing locations depend on the service and its subprocessors.

Our applicable Cloudflare and Resend provider agreements include data processing terms and standard contractual clauses for restricted transfers where required by applicable law. Where an applicable adequacy decision covers a transfer, the provider agreement may instead rely on that decision. The relevant terms and subprocessor information are available here:

• Cloudflare Data Processing Addendum
• Cloudflare subprocessors
• Resend Data Processing Addendum
• Resend subprocessors

For more information about processing locations or to request copies of applicable transfer safeguards, contact Citrine Edge.

Retention and deletion

Entitlement verification request bodies are processed without application-level persistent storage. Support communications are retained only as reasonably needed for the purposes described above. A user may request deletion of support information controlled by Citrine Edge using the protected support form (support@citrineedge.com). The request should identify the relevant support request or reply email. Citrine Edge may retain information where required for security, fraud prevention, dispute resolution, accounting, or law.

Contact Citrine Edge about personal data for which we are responsible, including data processed on our behalf by service providers. Where Google, Coinbase or another provider acts as an independent controller for its own services, its own rights process also applies.

Data protection rights

Where the GDPR applies, you may request access to, correction or erasure of your personal data, or restriction of processing, subject to applicable conditions and exceptions. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. Where processing is automated and based on consent or a contract, you may request portability of personal data you provided. Applicable GDPR response deadlines apply, normally one month, with extensions only where the law permits.

To exercise applicable data protection rights, contact Citrine Edge.

You may also complain to the competent data protection supervisory authority. Find your authority in the EDPB member directory.

Security

Citrine uses encrypted transport for network requests, Android Keystore-backed encryption for imported credentials, app-private storage, secret redaction, and signed entitlement verification. No security system is perfect. Users should secure their device and Coinbase account, use only the minimum API permissions Citrine requires, and revoke an API key if a device or credential may be compromised.

Children

Citrine is intended only for adults who are legally eligible to use the connected financial products. It is not directed to children.

Updates

This policy may be updated when Citrine's features, providers, or legal obligations change. The effective date at the top identifies the current version. Material changes may also be communicated through Citrine's Notices section or Google Play listing.