← Back to Home

Privacy Policy

Last updated: September 18, 2026 · Effective: September 18, 2026

In short: the website sets no cookies, has no accounts and no ads. It keeps standard server logs for 14 days and counts visits with self-hosted, cookieless analytics. Our Telegram bots (Dryup and Santala Bot) store only the data needed to run them, on our own server, and never sell or share it. You can ask us to see, correct or delete your data at any time.

1. Who is responsible for your data

This policy is issued by Santala Research ("we", "us"), an independent, non-commercial blockchain research project run by a small group of contributors. We are the data controller for the processing described here.

• Website: santala-research.com
• Contact for any privacy matter: contact@santala-research.com

2. What this policy covers

It covers (a) the website santala-research.com and its RSS feeds, (b) the Telegram bots we operate — Dryup (@dryup_bot) and Santala Bot (@santalars_bot), including the Santala Bot Mini App — and (c) email correspondence with us. It does not cover YouTube, TikTok, Telegram, GitHub or any other third-party platform where we publish or that you reach through our links; those platforms have their own policies.

3. Data processed when you visit the website

3.1 Server logs

Like almost every web server, ours (nginx) records each request: your IP address, date and time, the page requested, the referring page, and your browser's user-agent string. We do not build profiles from these logs.

• Purpose: security (detecting abuse, attacks and errors) and keeping the site running.
• Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f) and equivalent provisions of other applicable laws).
• Retention: logs rotate daily and are deleted after 14 days.
• Location: our server is hosted by Oracle Cloud in Tokyo, Japan.

3.2 Visit statistics (GoatCounter, self-hosted, no cookies)

To know which content is useful we run GoatCounter on our own server. It sets no cookies and stores nothing in your browser. For each page view it records, in aggregate: the page path, the referrer, browser and operating system family (derived from the user-agent), screen width, language, and the country or region derived from your IP address. The IP address itself is not stored; a hashed combination of IP and user-agent is held in memory for at most 8 hours to distinguish unique visits and is then discarded. The resulting statistics are anonymous aggregates and are kept indefinitely.

• Legal basis: legitimate interest in measuring the audience of our own site (GDPR Art. 6(1)(f)). Because the tool stores nothing on your device and produces only aggregate data, we consider it exempt from the consent requirement for cookies and similar technologies (ePrivacy Directive Art. 5(3)); it meets the audience-measurement conditions described by the French CNIL.
• Opt out: you can exclude your browser from counting at any time. This sets a single flag in your browser's local storage and nothing else. Exclude me from statistics . Content blockers that block /stats/count.js also work.

3.3 Browser local storage

The site uses localStorage only for: your theme choice (light/dark), your language preference, a short-lived cache of market data (to avoid repeated API calls), and the analytics opt-out flag above. This data never leaves your device and is not accessible to us.

3.4 Market data requested by your browser

Pages that show live prices (the home page, the terminal and some articles) make requests directly from your browser to third-party APIs. Those providers therefore receive your IP address and standard request headers, under their own privacy policies. We do not send them anything else and we do not receive any data about you from them.

• CoinGecko — prices and market data
• Binance — spot and futures market data, including a WebSocket price stream
• Alternative.me — Fear & Greed index
• Cloudflare and PublicNode — public Ethereum RPC endpoints used to read on-chain data

3.5 Sharing buttons, feeds and external links

The share buttons on articles are plain links; nothing is loaded from X, Facebook, LinkedIn, Telegram or WhatsApp unless you click. We embed no videos, no fonts from third parties, no advertising and no social plug-ins. Our RSS feeds are served by us and contain no tracking.

3.6 Email

If you write to us we keep your email address and message for as long as needed to answer you and, where a request has legal relevance (for example a data-subject request or a complaint), for up to 3 years as evidence of how it was handled.

3.7 Santala Quest (badge server)

The quest game at /quest/ runs entirely in your browser: your sandbox key, the simulated chains and your progress are stored only in your browser's local storage. When you complete a quest, your browser sends our badge server a claim containing your sandbox address (a public key fingerprint generated in your browser, unrelated to any real wallet), the cryptographic proof of the quest, a signature, and, if you chose one, a display name. The server stores the address, the display name, the badges earned and their timestamps, and publishes the display name (or a shortened address), points and badges on the public leaderboard. Your IP address is used transiently for rate limiting and is not stored. Purpose and legal basis: providing the game and its leaderboard at your request (GDPR Art. 6(1)(b)). Retention: until you ask us to remove your entry, which you can do by email quoting your sandbox address. A display name is optional; do not use your real name if you prefer to stay anonymous.

4. Data processed by our Telegram bots

Both bots run on a small server operated by us. Telegram delivers to the bot your numeric Telegram user ID, display name, username (if any), interface language, the chat ID and the messages you send to the bot. Telegram's own processing is governed by the Telegram Privacy Policy. Neither bot reads messages in groups other than commands addressed to it. We never sell bot data, never use it for advertising and never share it with anyone except as stated in section 6.

4.1 Dryup (@dryup_bot) — sobriety streak counter

• Stored: your Telegram user ID and display name, chosen language, the date you started, and your daily check-in history (each day marked as "sober" or "drank"), from which streak counters are computed.
• Sensitive data notice: your check-in history describes alcohol consumption and is treated as health-related data, which is a "special category" of data under GDPR Art. 9 and "sensitive personal data" under most other data-protection laws. We process it only with your explicit consent, which you give by starting the bot and recording check-ins, and only to run the streak feature. It is never analysed for any other purpose, never shared and never used to contact you outside the bot.
• Purpose and legal basis: providing the service you asked for (GDPR Art. 6(1)(b) and Art. 9(2)(a), or your consent under other applicable laws).
• Retention: for as long as you use the bot. The /reset command archives your current streak but keeps your record; to erase everything, email us with your Telegram user ID and your record is deleted within 72 hours. We may also delete records that have been inactive for more than 12 months.
• Scheduled messages: the bot sends two messages a day (08:30 and 19:30 Vietnam time). Blocking the bot in Telegram stops them immediately.

4.2 Santala Bot (@santalars_bot) — crypto market bot and Mini App

• Stored: your Telegram user ID; settings (preferred fiat currency, time zone, language); your watchlist; price alerts (coin, target, chat where to notify); portfolio entries you type in (coin, amount, optional entry price); group settings for chats where an admin enabled daily summaries; a log of which commands were used and when (for capacity planning and abuse prevention); and, if you buy Premium, a payment record (your user ID, Telegram's payment charge ID, the number of Stars, the number of days and the date).
• Not stored: any card, bank or wallet details. Payments are processed entirely by Telegram (Telegram Stars); we never see payment instrument data.
• Portfolio entries are optional, are provided by you, and are used only to compute the totals you ask for. Consider them financial information and enter only what you are comfortable storing.
• AI market brief: the brief is generated from public market data using Anthropic's Claude API. No data about you (not your ID, watchlist or portfolio) is sent to the AI provider. Generated briefs are cached for a short time and shared among users.
• Video download command: when you send a social-media link, the bot fetches the public video, forwards it to you and deletes the temporary file immediately. The link and file are not kept.
• Mini App: the dashboard opened from the bot authenticates you with the signed data Telegram provides (Telegram WebApp initData) and shows the same data described above. It is served through a Cloudflare tunnel, so Cloudflare sees your IP address as a network intermediary.
• Purpose and legal basis: performance of the service and of the Premium contract (GDPR Art. 6(1)(b)); legitimate interest in preventing abuse and keeping the service reliable (Art. 6(1)(f)); legal obligation to keep payment records (Art. 6(1)(c)).
• Retention: your settings, watchlist, alerts, portfolio and usage log are kept while you use the bot and deleted together on request within 72 hours. Payment records are kept for as long as accounting and tax rules require (up to 10 years) and to handle refunds and disputes.

5. AI-generated content and your data

News summaries, the hourly Radar and the research briefs on the website are generated automatically with Google Gemini models from public sources, and the Santala Bot brief with Anthropic Claude. These pipelines process public market and news data only; no visitor or user data is sent to any AI provider. The News page states the model used; this policy and our Terms identify the Radar, the briefs and the bot brief as AI-generated.

6. Who receives your data

We do not sell personal data and we do not share it for marketing. The only recipients are service providers that act on our instructions, or as required by law:

• Oracle Cloud (Tokyo, Japan) — hosting for the website and its logs.
• Telegram — the platform that delivers messages between you and our bots and processes Stars payments.
• Cloudflare — network tunnel in front of the Santala Bot Mini App.
• Google (Gemini API) and Anthropic (Claude API) — AI generation from public data only; they receive no personal data.
• Our own badge server (same Oracle Cloud host as the website) — Santala Quest addresses, names, badges and leaderboard.
• Authorities — where a valid legal request obliges us to disclose data.

7. International transfers

The website is hosted in Japan, a country the European Commission recognises as providing adequate data protection. Bot data is stored on infrastructure we operate ourselves; we apply the security measures in section 9 and keep the data to the minimum described above. Data is transferred to the providers listed in section 6 only for the purposes described there.

8. Your rights

Depending on where you live you have some or all of the following rights, and we honour them for everyone regardless of location:

• to be informed about how your data is processed (this policy);
• to access the data we hold about you and receive a copy;
• to rectify inaccurate data;
• to erase your data ("right to be forgotten");
• to restrict or object to processing, including the analytics opt-out in section 3.2;
• to data portability (a machine-readable export of your bot data);
• to withdraw consent at any time, without affecting prior processing;
• to lodge a complaint with a supervisory authority and to claim compensation for damage.

To exercise a right, email contact@santala-research.com from the address you want us to reply to, or message the bot concerned. For bot data we will need your Telegram user ID (the bot can show it) so we can find your record. We answer within 30 days (GDPR Art. 12) and act on deletion and consent-withdrawal requests within 72 hours. We may ask you to confirm a request from the same Telegram account or email address to protect your data from impersonation. Exercising your rights is free.

Supervisory authorities. In the EU/EEA: the data protection authority of your country (for Spain, the AEPD). In the UK: the ICO. Elsewhere: your national data protection authority.

9. Security

The website is served only over HTTPS with modern security headers and a strict content-security policy. Servers are accessed only with SSH keys, run minimal software, and are updated regularly. Bot data is stored on hardware we control, on a private network, with access limited to the operator; it is transmitted only over Telegram's encrypted API. No method of transmission or storage is completely secure; if a breach affecting your data occurs we will notify the competent authority within 72 hours and inform you where required.

10. Children

The website is general-audience educational content and collects no personal data from anyone. The Telegram bots are intended for adults: Dryup deals with alcohol consumption and Santala Bot with financial market data and paid features, so you must be 18 or older to use them. We do not knowingly process data of children under 16; if you believe a child has provided us data, contact us and we will delete it.

11. No automated decisions, no profiling

We make no decisions about you by automated means that produce legal or similarly significant effects, and we build no profiles of visitors or users.

12. Changes to this policy

We will update this page when our practices change, showing the new date at the top. Material changes affecting bot users are also announced through the bot. Substantive changes to how bot data is used will require your renewed consent where the law so provides.

13. Contact

Santala Research · contact@santala-research.com · Telegram: message @dryup_bot or @santalars_bot for bot-related requests.