Security

What we store, and what we never touch

Alphabit is an analytics product. The most important security property we have is what we deliberately don't do: we never take custody, never connect to your exchange, and never ask for a password.

No custody, ever

We never hold, move, or have access to your crypto. There is no deposit address, no wallet connection, no transaction signing anywhere in the product.

No exchange API keys

We never ask you to link an exchange account or paste API keys. Portfolio data is numbers you type in manually — we have no ability to trade or withdraw on your behalf.

No passwords

Sign-in uses email magic links (one-time codes) via Supabase Auth. There is no password for us to store, and none for an attacker to steal.

Local-first portfolio data

By default, Portfolio Tracker holdings live in your own browser's storage and never reach our servers. If you sign in, holdings sync to your account, protected by per-user access rules (row-level security).

Everything we store, itemized

Your email address

When: If you create an account or join a waitlist

Where: Supabase (managed Postgres)

Portfolio holdings (coin, amount, cost basis)

When: Only if you sign in and use the Portfolio Tracker

Where: Supabase, row-level security scoped to your user ID

Subscription status

When: Only if you purchase a paid plan

Where: Stripe (payment details never touch our servers)

Anonymous portfolio data

When: If you use Portfolio Tracker without an account

Where: Your browser's localStorage only — never sent to us

That's the complete list. No trackers beyond basic hosting analytics, no selling of data, no third-party ad networks.

Infrastructure

Hosted on Vercel; all traffic is HTTPS-only.
Authentication and database by Supabase, with row-level security on every user-scoped table.
Payments (when live) handled entirely by Stripe — card numbers never pass through Alphabit servers.
Market data comes from read-only public market-data APIs; no user data flows to them.