1. Summary
This Privacy Policy describes what data iDEX Exchange ("we", "us") collects when you use our platform, how we use it, and what rights you have. In plain terms:
- We collect very little: your email, a hashed password, and the transactional data needed to run the exchange.
- We never collect government IDs, selfies, phone numbers, or addresses.
- We never sell or rent your data to third parties.
- You can delete your account at any time and all your personal data is removed.
2. Information We Collect
2.1 Account information
- Email address — required for account creation and login.
- Password hash — a bcrypt hash of your password. We never store or see your plain password.
- Account timestamps — when you registered and last logged in.
2.2 Transactional data
- Deposits, withdrawals, order history, and trade records on your account.
- Balances of supported assets associated with your account.
2.3 Technical data
- Session cookies (see section 5) to keep you logged in.
- IP address and user-agent strings may be logged briefly for security and anti-fraud purposes.
3. Information We Do Not Collect
- Government-issued identity documents (passports, driver's licenses, national IDs);
- Photographs, selfies, or biometric data;
- Phone numbers or SMS verification;
- Physical addresses or proof of address documents;
- Bank account numbers or card numbers;
- Social media accounts or profile data.
We chose a no-KYC model deliberately. Our platform is designed to work without any of this.
4. How We Use Your Information
We use the limited data we hold to:
- Create and authenticate your account;
- Process your deposits, trades, and withdrawals;
- Communicate service-related notices (security, downtime, changes);
- Comply with legal obligations (e.g., responding to valid court orders);
- Detect and prevent fraud, abuse, or violation of our Terms.
We do not use your data for advertising, profiling, or automated decision-making that affects your access to the service.
7. Data Retention
We retain your account data for as long as your account is active. If you delete your account:
- Your email, password hash, and login history are permanently deleted.
- Transactional records may be retained for a limited period where required by applicable law, stripped of personal identifiers where possible.
8. Your Rights
Depending on your jurisdiction, you may have some or all of the following rights:
- Access: Request a copy of the data we hold about you.
- Correction: Update or correct your account information.
- Deletion: Delete your account and personal data at any time.
- Portability: Receive your data in a machine-readable format.
- Objection: Object to specific processing activities.
To exercise any of these rights, use the Settings page or contact us. We will respond within 30 days.
9. How We Protect Your Data
- Transport: All traffic is encrypted with TLS.
- Passwords: Hashed with bcrypt; we cannot read them or reset them without generating a new one.
- Sessions: CSRF tokens on all state-changing requests; session IDs regenerated on login.
- Storage: The majority of digital assets are held in cold wallets, physically isolated from the internet.
- Access: Administrative access is restricted, logged, and reviewed.
No system is 100% secure. If you suspect a breach of your account, change your password immediately and contact us.
10. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will close it and delete associated data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Platform after changes constitutes acceptance.
12. Contact
For privacy questions or requests, open a support ticket from your dashboard.