Version of 7 October 2026. Provided by [operator legal name] trading as ACRO.
This policy explains how [operator legal name] trading as ACRO (we, us) handles personal information in connection with ACRO: the website, the desktop app, the online version, purchases and support. Personal information is information about an identified person, or a person who is reasonably identifiable.
Small businesses with an annual turnover of A$3 million or less are generally exempt from the Privacy Act 1988 (Cth). Whether or not that exemption applies to us, we handle personal information in line with the Australian Privacy Principles and this policy.
ACRO has no accounts and no passwords. Licence keys are checked on your own device. Your wallet history is downloaded, stored and calculated on your device. The rest of this policy describes the limited information that does reach us, or the services we use.
Payments are made on Stripe's checkout pages. Stripe collects your payment details directly, under its own privacy policy, including information it uses to prevent fraud. From Stripe we receive your email address; any name, country or postcode you entered at checkout; the amount, currency and date; the Stripe payment reference; the financial year you bought; and limited card details (such as the card brand and last four digits) that are visible in our Stripe account. We never receive your full card number.
We then create and store:
Your licence key contains your licence ID, email address, financial years, online allowance and issue date, digitally signed so ACRO can check it. Anyone who has your key can read these details, so keep it private.
We send service emails only: your licence key, key recovery, refund notices and pack confirmations. They are delivered by Resend, which processes your email address and the message, including your licence key. We don't send marketing emails. If we ever want to, we'll ask for your consent first and every message will let you unsubscribe.
We use the email address you enter to find and resend your licences. To limit repeat sends, we keep a hashed form of that address for up to 10 minutes.
By default, both the desktop app and the online version look up prices through our server. These requests contain asset identifiers only, such as token contract addresses and coin IDs. They never contain wallet addresses, amounts, transaction dates or your licence key. Our server gets the prices from CoinGecko, token names from Jupiter, and exchange rates from frankfurter.app, so those services see our server, not you.
In the desktop app, your blockchain requests (including your wallet addresses) go straight from your computer to Alchemy under your own account, to public blockchain endpoints, or to endpoints you enter, depending on your choice. If you switch off Fetch prices through ACRO's relay, your computer contacts CoinGecko, Jupiter and frankfurter.app directly. In each case the provider sees your IP address and the request, under its own privacy policy, and we don't receive it.
When you visit the website or use our online services, our hosting provider, Vercel, processes technical information such as your IP address, browser type, the address requested and the time. Our own server logs record events such as errors, payment references and licence IDs. They never record wallet addresses, licence keys or card details, and our hosting provider keeps them for up to 24 hours. To prevent abuse, we keep your IP address in our database as part of rate limiting, for at most about 12 minutes. Vercel may keep its own logs for security purposes under its privacy policy.
We don't currently use a third-party error-monitoring service. If we start using one, we'll update this policy first.
We receive your email address, your message and anything you attach. If you send the diagnostics copied from ACRO's Settings, they contain recent error messages and your browser or app details. Please never send your seed phrase, private keys or exchange passwords; we will never ask for them.
Installers are hosted on GitHub, which processes your IP address and download request under its own privacy policy.
We don't use cookies for advertising or analytics, and the website has no analytics trackers. The online version stores your data in your browser's local storage, as described above. If our hosting provider's bot protection is switched on, it may set a cookie to remember that your browser passed a security check. Stripe's checkout pages use cookies under Stripe's policy.
We never receive the wallet addresses or nicknames you enter (except in transit through the relay in the online version), your transaction history or balances, your review answers and manual records, your gains, losses, income or reports, the API keys you enter, or your backup files. These stay on your computer or in your browser, under your control.
We don't sell personal information, use it for advertising or profiling, or use it to make automated decisions about you.
We share personal information only with the service providers who run parts of ACRO for us, and only what each one needs:
| Provider | What it handles | Why | Where |
|---|---|---|---|
| Stripe | Payment details, email address, name and country | Payments, fraud prevention and refunds | Australia and the United States |
| Resend | Email address and email content, including licence keys | Sending service emails | United States |
| Vercel | IP address, request details and server logs | Hosting the website and server; our server code runs in Sydney | United States, and other countries where Vercel operates |
| Upstash | Licence, payment and usage records; IP addresses for rate limiting | Our database | [database region] |
| Alchemy | Online version only: wallet addresses and blockchain requests, sent from our server | Reading the blockchain | United States |
Our server also sends asset identifiers to CoinGecko (Singapore), Jupiter and frankfurter.app to look up prices, token names and exchange rates. These requests don't contain information about you.
We may also share personal information with our professional advisers, such as an accountant or lawyer, under a duty of confidentiality; with government agencies, courts or law enforcement when the law requires or authorises it; and with a buyer of the ACRO business, who would have to handle it in line with this policy. We don't share it with anyone else.
As the table shows, some of our providers store or process information in the United States and other countries. We choose providers with strong privacy and security practices and take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles.
All connections to our website and servers use HTTPS. Our service credentials are stored encrypted with our hosting provider, our database can't be accessed without a secret token, email lookups use one-way hashes, licence keys are digitally signed, and access to our systems is limited to the people who run ACRO. Our hosting provider's automatic DDoS protection and our rate limits help keep the service available. No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we'll tell the people affected, and the Office of the Australian Information Commissioner (OAIC) where required, as soon as practicable.
Stripe, Resend and Vercel keep information under their own retention policies.
You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing [support email] from the address you bought with. If you can't do that, we'll verify who you are another way. We'll respond within 30 days, and there's no charge.
Some limits apply. We may need to keep records the law requires, such as tax records. If we delete your licence records, we can no longer resend your key or process refunds, although your key keeps working in the desktop app because it's checked on your computer. If we can't do what you ask, we'll explain why. We can't see or delete data stored on your own device; you can remove it in ACRO with Settings → Reset everything.
If you're concerned about how we've handled your personal information, contact us at [support email]. We'll acknowledge your complaint within 5 business days and give you a response within 30 days. If you're not satisfied, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
ACRO isn't directed at children under 18.
We'll update this policy when our practices change. The version date is at the top. For material changes, we'll give notice on the website, and by email to licence holders where we reasonably can.
[operator legal name] trading as ACRO
[business address]
Email [support email]