The short version
Maketo is a free, education-only Bitcoin information site. Nobody has to sign up to read it.
We use Google Analytics and Microsoft Clarity to see how the site is used and how to make it better. Where they load depends on where we place you, by the time zone your device reports (read in your browser, not sent to us) and the country your connection comes from:
- In the EEA, the UK and the places whose law asks the same way (Gibraltar, Monaco, San Marino, Serbia, Montenegro, North Macedonia, Albania, Moldova, France’s overseas territories outside the EU, Colombia and Peru), they load only if you say yes in our cookie banner, and you can change your answer at any time with Cookie choices at the bottom of our pages.
- In Switzerland, Guernsey and Kosovo, they load, and a notice on your first visit lets you turn them off, as does Cookie choices afterwards. Until you tell the notice that’s fine, we tell Clarity not to keep cookies. In Guernsey and Kosovo, Global Privacy Control also turns them off.
- In the United States, Jersey, the Isle of Man, Bosnia and Herzegovina and the Faroe Islands, they load unless your browser sends Global Privacy Control, and you can turn them off at any time with Cookie choices at the bottom of our pages.
- In Vietnam, Turkey, Nigeria and mainland China, or if we can’t tell where you are, they don’t load.
- Anywhere else, they load, and you can block or delete their cookies in your browser settings.
Separately, we count page views ourselves with two small scripts on maketo.com. They set no cookie and store nothing on your device, so they run wherever you are, whatever you chose above. What they send is listed under What we collect.
We don’t run advertising, and we don’t use your data to advertise to you or to profile you.
If you have any question about your data, email privacy@maketo.com.
What we collect
Hosting / request metadata. When your browser asks maketo.com for a page, our hosting provider receives the standard information every website receives: IP address, browser (user-agent), the address requested, the page you came from, and the time. We use it to serve the site, fix errors, and stop abuse such as scraping or attacks. We also use the IP address to tell which country a visit comes from, so we know whether to ask before loading analytics. That answer is used on the spot and not stored. Legal basis (GDPR / UK GDPR): legitimate interests, Art. 6(1)(f).
Google Analytics. We use Google Analytics 4 to count visits and see which pages are read, where readers come from, and how the site performs. When it loads, it sets cookies in your browser and sends information about your visit to Google. We turn off its advertising features and its link to Google accounts in our setup. Where we ask first (see above) it loads only after you say yes in the cookie banner (legal basis: consent, GDPR Art. 6(1)(a)). Elsewhere it loads as the short version above says, and where a legal basis is needed we rely on legitimate interests. Google handles this information under its own terms and Google’s Privacy Policy, which Google sets and may change.
Microsoft Clarity. We use Microsoft Clarity to see how pages get used, so we can find what’s confusing or broken. When it loads, it records how you use each page, such as clicks, scrolling, mouse movement and the pages you visit, along with basic device and browser details, and it sets cookies. It loads under exactly the same rules as Google Analytics above, and we tell it not to store anything for advertising. Microsoft handles this information under its own terms and the Microsoft Privacy Statement, which Microsoft sets and may change.
Page counts. We count page views ourselves, beside the tools above, with two small scripts on maketo.com: one reports the page that loaded, the other each time you move to another page of the site. They set no cookie and store nothing on your device. They read the page’s path, the address of the page you came from without anything after “?”, the three campaign tags (the first script only), and one browser setting that says whether the browser is run by automation. A browser run by automation is not counted. They read no cookie, file or storage on your device. From the request itself we keep the country it comes from (never your city), the kind of device, and whether it looks like a person or an automated visitor.
The visitor code is a number of 16 bits made from your IP address, your browser’s user agent, this site and the date. It changes every day and is made differently for each website, so it cannot link your visits from one day to the next or from one website to another. It lets us estimate how many different readers a page had in a day. If your browser sends Global Privacy Control or Do Not Track, we make no visitor code, and your page view still counts in the totals. Your IP address and user agent are used only while your request is answered. The count keeps no name, no IP address and no cookie. Because the count stores nothing on your device, it does not wait for your cookie choice. Legal basis (GDPR / UK GDPR): legitimate interests, Art. 6(1)(f). We weighed counting visits against your privacy: the count stores nothing on your device, keeps no IP address, uses a number that changes every day, and its notes are deleted after about three months.
Site search. When you use the search box, we count the words searched and which result was opened, with nothing that says who searched. We use the counts to improve search and to learn what readers look for. Legal basis: legitimate interests.
Limits on repeat requests. To stop abuse of the feedback form, The Weekly Read signup and the search box, we keep short-lived counts of requests per IP address with Upstash. They expire within about two days. To stop abuse of sign-in codes, we also count code requests per email address and per IP address in our account storage. Those counts are deleted within a day. Legal basis: legitimate interests.
Inbound email. If you email us at privacy@maketo.com, we keep the message so we can reply and so we have a record of your request. Legal basis: legitimate interests, and for requests the law obliges us to act on (such as a data-subject access request), legal obligation (GDPR Art. 6(1)(c)).
Feedback form. If you send us a message through our feedback form at /feedback, we collect whatever you put into the form: the topic, your message, and (if you choose to provide them) your name, email, company, and the URL of the page you were on. Each message also arrives with your IP address and country for abuse checks. We use that information to read your message and reply if appropriate. We use your email address only to reply to you, and we don’t add it to any mailing list. The message is delivered to us through our email provider, Resend. Legal basis: consent (you tick a box before submitting) and legitimate interest in operating a contact channel.
The Weekly Read. If you sign up for our weekly email, we keep your name, your email address, the date you signed up and the page you signed up from. We use them only to send you The Weekly Read and to greet you by name. Nothing is sent yet: the first edition goes out once enough readers have joined, and every edition will carry a one-click unsubscribe link. Before then, email privacy@maketo.com and we will remove you. When sending starts, the list moves to the service that delivers it, and we will name that service on this page first. We don’t share the list with anyone for marketing. Legal basis: consent (you choose to sign up).
Starred charts. When you star a chart, the list of charts you starred is kept in your browser. It stays there until you remove the stars or clear this site’s data. The list does not reach us unless you have an account. Your My Maketo page does ask our site for the small card of each chart you starred, which is the same request that opening the chart makes. We do not use those requests to build a list of what you star.
Your account. If you sign in, we keep your email address, the date you signed up, your starred charts, and for each device you are signed in on, when it signed in and when it was last used. We use them only to sign you in and keep your charts in step across your devices. We send your sign-in codes by email through Resend, and we store your account with our hosting provider, Cloudflare. A sign-in code works for 10 minutes and is deleted within a day. A device that has not been used for 180 days is signed out. You can download your data or delete your account at any time from your account page; deleting removes your email, your stars and every sign-in at once. We don’t share any of it with anyone for marketing. Legal basis: providing the service you asked for (GDPR Art. 6(1)(b)).
Your alerts. If you make an alert, we keep the alert, its history for 30 days, and where you asked us to send it. That can be your email address, a Telegram chat, a webhook link, a Discord or Slack link, or a browser you allowed to receive notifications. A webhook, Discord or Slack link and a browser subscription are stored encrypted, are never shown back in full, and are used only to send your alerts. If you watch a Bitcoin address, we keep that address the same way, only to check it for payments and tell you; we show only its last 6 characters, and the message never names a sender or receiver. Deleting an alert, removing a channel or deleting your account removes them. When an alert goes off, its text is sent to the service you chose (your email provider, Telegram, Discord, Slack, your browser’s push service, or your own server), which handles it under its own terms. An alert is a tool you set, not advice. Legal basis: providing the service you asked for (GDPR Art. 6(1)(b)).
Nothing else. We do not run a wallet integration: we never ask for a key or a seed, and a watched address is described above. Apart from what is described above, the only ways Maketo learns anything about you are a message you choose to send us, a Weekly Read signup, or an account you choose to create. If that changes, we’ll update this policy first.
Cookies
Maketo sets no advertising cookies. This is what the site may store in your browser:
- Your cookie choice. If you answer our cookie banner or notice, your answer is kept in your browser so we don’t ask on every page: a yes for up to a year, a no for as long as your browser keeps it. Some browsers delete it on their own, for example after a week without a visit or when a private window closes, and a browser that blocks site storage keeps nothing; then we ask again. It is stored without asking because it is what makes your answer stick.
- Analytics and Google’s button. Google Analytics, Microsoft Clarity and Google’s Preferred source button can set their own cookies or other browser storage, only when they load under the rules above.
- Signing in. If you sign in, we set two cookies: one that keeps you signed in, which pages on this site cannot read, and one that only tells our pages you are signed in. Both last up to 180 days and are removed when you sign out. While you sign in, a third cookie, lasting up to an hour, ties your code to this browser. They are needed for signing in, so we set them without asking.
- Small settings. Choices you make on the page, such as pausing motion or which menu sections are open, kept only for your visit. Your starred charts, kept in your browser until you remove them.
- Hosting. Our hosting provider may set a cookie it needs to deliver pages or to block abuse.
Where the short version above says so, you can change your answer with Cookie choices at the bottom of our pages. Turning the tools off there switches both off straight away and deletes the cookies they set on maketo.com. Wherever you are, you can also block or clear cookies in your browser settings. Where the short version says so, we treat the Global Privacy Control signal as a no.
Anti-spam protection
To stop bots from abusing our feedback form and our sign-in form, we use Cloudflare Turnstile. It runs a check in your browser when the form loads, usually without you noticing, to confirm that a person is sending the message. When the form is sent, we pass Cloudflare your IP address with the check, and we receive back whether it passed.
Cloudflare handles what Turnstile collects under its own terms and Cloudflare’s Privacy Policy, which Cloudflare sets and may change. Legal basis: legitimate interests in keeping the form free of spam.
Preferred sources on Google
Chart pages can show a button from Google that lets you mark Maketo as a source you want to see more of in Google Search. The button is Google’s own code, drawn by Google on our page.
Because it is Google’s code, it loads under the same rules as our analytics: where we ask first, only after you say yes, and never where we treat Global Privacy Control as a no and your browser sends it. If you press it, Google opens its own window, and what happens from there is between you and Google, under Google’s Privacy Policy.
Third parties
Maketo uses a small number of outside companies: a hosting provider to serve the site, Google and Microsoft for the analytics above, Google for its Preferred source button, Resend to deliver feedback-form email, an email provider for mail sent to our addresses, Upstash to store The Weekly Read signup list, the site search counts and the request limits, and Cloudflare for the spam check. We choose which companies we use and how we set up their tools. What each company does with data for its own purposes is governed by its own terms and privacy policy, which it sets and may change, not by this policy. We use these companies only to run Maketo, and we don’t pass visitor data to anyone for advertising, marketing or resale.
Live prices. To show live and past prices, on every page and in the calculators, your browser asks public exchange price services directly: for the live price every few seconds while a page is open, and for past prices when a calculator needs them. Like any web request, those requests show the service your IP address, your browser type and that the request comes from a Maketo page, and a calculator’s request shows which coin you picked. We send them nothing else about you. Legal basis: legitimate interests, since a live price has to come from a live source.
Where we use AI models to score and rank publicly available news, we send those AI services no visitor data, and we do not use visitor data to train any model.
How long we keep things
- Hosting / access logs: kept by our hosting provider for the period its terms and our plan set.
- Analytics data: Google and Microsoft keep what their tools collect for the periods their terms and our account settings allow.
- Page counts: Cloudflare deletes these notes after about three months, and we keep nothing from them after that. They hold no IP address, no user agent text and no cookie.
- Site search counts: kept as running totals of words and results, with nothing that says who searched.
- Request limits: the counts per IP address expire within about two days.
- Inbound emails: kept for up to 24 months, then deleted on a rolling basis. We may retain individual messages longer where we’re legally obliged to.
- Feedback-form submissions: delivered to us as email and treated the same as inbound email, kept for up to 24 months, then deleted on a rolling basis.
- Weekly Read signups: kept until you unsubscribe or ask us to remove you.
- Your cookie choice: in your own browser, a yes for up to a year and a no for as long as your browser keeps it.
- Backups: encrypted, and replaced on a rolling basis.
International data transfers
Some of the companies above are based outside the EEA, the UK and Switzerland, including in the United States. Where the law requires a safeguard for sending personal data there, we rely on the one the company offers, such as the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) or the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum). We will update this section if the legal basis for these transfers changes.
Your rights
If you are in the EEA or UK, you have the rights granted by the GDPR and the UK GDPR: to access your data, to correct it, to ask us to erase it, to restrict or object to processing, to data portability, to withdraw consent (where consent is the basis), and to lodge a complaint with a supervisory authority: the UK Information Commissioner’s Office (ico.org.uk) for the UK, or your local Member-State data-protection authority for the EEA (the EDPB lists them at edpb.europa.eu). You can withdraw your analytics consent at any time with Cookie choices at the bottom of our pages.
If you are a California resident, you have rights under the CCPA / CPRA: to know what personal information we collect, to delete it, to correct it, to opt out of the “sale” or “sharing” of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. We don’t sell personal information for money, we don’t use it for advertising, and we don’t collect sensitive personal information. Because the analytics companies handle what their tools collect under their own terms, we treat the Global Privacy Control browser signal as an opt-out of any sale or sharing: with it on, neither analytics tool nor Google’s button loads, and nothing asks you about it. Our own page count, which sets no cookie and keeps no name or IP address, still counts the view, with no visitor number. You can also opt out with Cookie choices at the bottom of our pages. Global Privacy Control is the signal we honour. The older Do Not Track signal changes nothing for the analytics tools, and our own page count leaves out its visitor number for it as it does for Global Privacy Control. When they load, Google and Microsoft may collect information about your activity over time and across different websites, under their own terms.
If you live in another US state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, Florida, Iowa, New Hampshire, New Jersey, Delaware, Tennessee, Minnesota, Maryland, Nebraska, Indiana, Kentucky, Rhode Island, and others), you have rights similar to those listed above, and the same two ways to opt out: Global Privacy Control and Cookie choices.
To exercise any of these rights, email privacy@maketo.com. We aim to respond within 30 days, and in any case within 45 days as required by some US state laws. We may need to verify your identity (usually a reply from the email address on file is enough).
Children
Maketo is not directed to children under 16, and we don’t knowingly collect personal data from anyone under 16. If you are under 16, please don’t use Maketo. If we become aware that we have somehow collected personal data from a child under 16, we will delete it. If you believe we have data about a child, contact privacy@maketo.com.
Embeddable readings
Many Maketo pages offer a small card that other websites can embed. The card is delivered from a separate, cookie-isolated domain. It does not set cookies, use browser storage, run advertising, or send analytics. It needs no cookie choice of its own, because it does no tracking.
As with any page request, the hosting platform may receive standard delivery information such as an IP address, time, requested path, and browser details for security and reliable delivery. The public card contains only a reduced reading and a link back to Maketo; it does not expose Maketo’s full page snapshots or a general data feed.
Security
We follow standard practices for a small operator: traffic is served over TLS, and access to operational systems is restricted. No system is perfectly secure, and we cannot guarantee that data will never be compromised. If we discover a personal-data breach, we will notify the relevant supervisory authority within 72 hours where required by law (GDPR Art. 33), and we will notify affected individuals directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms (GDPR Art. 34).
What Maketo does not touch
Maketo is a market-intelligence and education site, not a wallet, exchange, or custodian. To be specific: we do not collect, request, or have any way to discover your Bitcoin addresses, your holdings, your transaction history, your seed phrase, or any other on-chain identity. We don’t hold cryptoassets on your behalf, and we do not provide any brokerage, custody, deposit, or settlement service.
If anyone claiming to be Maketo asks you for a wallet address, a seed phrase, a private key, or a payment to “verify your account” or unlock something, it is not us. Please report it to privacy@maketo.com.
Changes to this policy
We will update this Privacy Policy as Maketo evolves. The “Last updated” date at the top of this page will tell you when. For material changes (changes that affect your rights or how we use your data), we will post a notice on the site.
Contact
For any privacy question or to exercise any right described above, email privacy@maketo.com.