Version 2026-09-11.2 — Last updated: September 11, 2026
Coin Bank ("the game", "we", "us") is operated by:
Coin Bank SRL is also the data controller for the personal data described in this policy. Hostinger (hosting) and Cloudflare (encrypted backup storage) act as processors on our instructions for those specific purposes — see §5 for the short, complete list of who we share data with, and why. We do not share data with any other third party beyond what's listed there.
If you have a question about this policy or your data, write to the address above.
Coin Bank is a Telegram Mini App game. It is 100% virtual — there is no real money anywhere in it. You play with simulated cash and simulated Bitcoin at the real, live market price, purely for entertainment and to learn how trading works. Nothing you do in the game can be withdrawn, cashed out, or exchanged for anything of real value, today or ever.
There are no payments in the game today. We may in the future offer optional Telegram Stars purchases (Telegram's own in-app currency) for cosmetic or convenience items — never a way to buy anything that converts to real money, and never a way to affect the odds or outcome of anything. If we do, this policy will be updated first.
We collect the minimum needed to run the game, keep it fair, and keep it secure. Every category below is something we can point to a real, specific reason for.
When you open Coin Bank through Telegram, Telegram tells us your numeric Telegram ID and (only to suggest a starting name) your first name — never your Telegram username, never your last name. Your first name is only ever used, once, to suggest a starting display name for your account (which we then change and never touch again automatically) — we do not keep your first name anywhere afterward.
Why: your Telegram ID is how we recognize your account is you, the next time you open the game.
Lawful basis: performance of the contract between you and us (you can't play the game without an account) and, for the identity check itself, our legitimate interest in running the service securely.
The name other players see on the leaderboard. It starts as a suggestion (see above) and is entirely yours to change at any time, subject to a short cooldown and a basic list of disallowed names.
Why: the leaderboard is a core part of the game; a display name is how you appear on it. This is the one piece of information in this policy that is deliberately public — visible to every other player.
Lawful basis: performance of the contract (a display name is required to use the leaderboard feature).
Every trade, claim, upgrade purchase, order, and challenge you complete — all denominated in simulated dollars and simulated Bitcoin, never real money.
Why: this is the game itself.
Lawful basis: performance of the contract.
The language your Telegram client is set to, so the game shows you the right one of its three languages (English, Romanian, Russian).
Why: to speak to you in the right language.
Lawful basis: performance of the contract.
When you open the game, we record: your device platform, your app language, a one-way cryptographic hash of your IP address (never the IP address itself — the hash cannot be reversed back into your IP, even by us), and a coarse country (never a city or precise location, and only when we can determine it from your own connection, computed entirely on our own servers with no data sent to anyone else for this purpose).
Why: to detect abuse — specifically, whether the same device or network is being used to control many player accounts at once, which undermines fairness for everyone else. This is the only reason we keep this data, and it is the only thing it's used for.
Lawful basis: our legitimate interest in keeping the game fair and secure, balanced against the minimal, non-identifying way this data is kept (a hash and a country code, never a raw address).
Retention: 90 days, then automatically and permanently deleted.
A record of when you open the game (not what you do inside it) — used only to understand overall usage patterns (how many people played yesterday, how many come back after a week) and never shown as an individual's activity log to anyone but you being able to infer it from your own play.
Why: to understand whether the game is working as intended and where to improve it — pure product analytics, computed only in aggregate.
Lawful basis: our legitimate interest in understanding and improving the game, balanced against how little this reveals (a bare timestamp, no device or network information attached to it).
Retention: kept indefinitely, in order to compute long-run trends (e.g., "do players who joined 3 months ago still come back"); this is the one exception to short retention in this policy, and it's a deliberate trade — a bare timestamp carries very little privacy weight on its own.
If someone invited you to the game (or you invited someone), we keep a record of who invited whom, so the inviter can earn the invite reward.
Why: the referral reward program.
Lawful basis: performance of the contract (for both the inviter and the invited player).
Whether you've ever messaged the bot, and whether you've blocked it — so we don't try to message you if you have.
Why: to know who we can legitimately send occasional game announcements to, and to respect a block.
Lawful basis: legitimate interest in not wasting effort messaging someone who has blocked us; consent, in effect, since blocking the bot is exactly how you withdraw that.
If a member of our team looks at or changes something about your account (for example, to help with a support request, or in response to suspected abuse), we keep a permanent record of what was changed, by whom, and why.
Why: accountability. A team with the ability to change game balances needs its own actions to be auditable — this protects you, not just us.
Lawful basis: legitimate interest in operating the game safely and being accountable for how it's operated.
We share data with the following third parties, and only for the specific reasons below:
| Who | What they get | Why |
|---|---|---|
| Telegram | Messages we send to your own chat (game replies, notifications you'd expect from a bot you're using) | Telegram is the platform the game runs on — this is how the game reaches you at all |
| Cloudflare (backup storage, EU region) | An encrypted nightly backup of the entire game database | Disaster recovery only — see §7 |
| Hostinger | The server the game runs on | Infrastructure — running the service requires a server somewhere |
| Let's Encrypt | Standard, automated website security certificate requests | Keeps the connection to the game encrypted (HTTPS) |
We do not share data with any advertising network, analytics company, or data broker, because we don't use any.
Public exchange price data (Bitcoin's price) is fetched from Binance and KuCoin — this is a one-way, anonymous read of public market prices; no information about you or your account is ever sent to either of them.
The game's server and database are hosted by Hostinger in Lithuania (an EU/EEA member state). Encrypted backups are stored with Cloudflare in a bucket specifically located in the European Union. We do not knowingly process or store personal data outside the EU/EEA on our own infrastructure or through any processor acting on our instructions.
Telegram, the platform Coin Bank runs on, operates its own infrastructure globally — this is inherent to using Telegram at all, not a choice we make about where your data goes, and is limited to exactly the messages described in §5 (delivered to your own chat, or to our own operator chat).
Most of your account data is kept for as long as your account exists, because it's needed for the game to function (your balance, your trade history, your progress). Some categories have a shorter, specific retention period, listed above (device/network data: 90 days).
If you ask us to delete your account (see §9 — this is genuinely supported, not just a promise): we will anonymize your account — replacing your display name, making your Telegram ID permanently unrecoverable, and deleting your device/network records — while keeping your gameplay history only as anonymous, aggregate numbers (never tied back to you), because those numbers are part of the game's shared integrity (the leaderboard, other players' referral credit, and our own accounting) and cannot selectively be removed without breaking things for other people.
One honest limitation: we take an encrypted nightly backup of the entire database, purely for disaster recovery (restoring the whole game if something breaks catastrophically) — never to look up or export any individual player's data. We keep 30 days of daily backups plus 12 months of monthly backups at all times. A deletion request removes your data from the live game immediately, but a copy of it existed in a backup taken before your request can remain in that backup rotation for up to approximately 13 months, until it ages out naturally. We do not shorten this backup schedule to make this sentence shorter — a real disaster-recovery capability that can reach back months is a deliberate, considered security measure, not an oversight, and backups are never searched or restored to serve an individual request; they exist for whole-database disaster recovery only.
Wherever you are, you can ask us to:
To exercise any of these, message info@coinbank.md or, for deletion specifically, use /delete in the bot. We will respond within one month of your request (extendable to three months for a complex or unusual request, as data protection law allows).
If you are in the European Economic Area or UK, you also have the right to complain to your local data protection authority.
Send /delete to the Coin Bank Telegram bot. You'll be asked to confirm once (deletion cannot be undone). Once confirmed:
Coin Bank is only for players aged 16 or older. When you first open the game, you're asked to confirm this yourself, alongside agreeing to this policy and our Terms of Use — see §12.
We have no way to independently verify your age, and we do not claim to. There is no separate sign-up step or ID check in Coin Bank; your own confirmation is the entire mechanism. If we become aware that an account belongs to someone under 16, we will disable it.
If we change this policy in a way that matters, we'll show you a one-time notice the next time you open the game, and — for a new player — you'll see, and confirm you're 16 or older and agree to, the current version before you can play. We keep a record of which version of this policy you last agreed to, and when.
info@coinbank.md
Coin Bank SRL
Chișinău, Moldova