Privacy Policy

This policy explains what personal data Elyvo, a project operated by an individual (“Elyvo”, “we”) processes when you use elyvo.trade and api.elyvo.trade (or their former addresses truvo.site and api.truvo.site), why, and what choices you have.

Request data (website and API)

When you load a page or call the API, our servers and our network provider receive technical data: your IP address, the date and time, the URL requested, the HTTP method and status, the user agent, and a request ID. API request logs exclude the authorization and x-api-key headers.

API keys

If we issue you an API key, we store only a SHA-256 hash of it, a label you give us, and when it was created or revoked. We never store the key itself.

Operator sign-in

The operator console (for Elyvo’s own curators) uses one strictly necessary cookie, al_operator, to keep an operator signed in for up to eight hours. It is HTTP-only and is not set for regular visitors. Operator decisions are recorded with the operator’s handle in an audit log.

Price chart (TradingView)

Passports for stock and ETF tokens embed TradingView’s chart widget for the underlying share or fund. Your browser loads it directly from TradingView, which receives your IP address and request details and may set its own cookies under its own privacy policy. Elyvo receives nothing from the widget. Other pages do not load it.

Watchlist (stored in your browser)

Assets you star are kept in your browser’s local storage under elyvo-watchlist, together with your theme choice. They are never sent to Elyvo. Clearing your browser’s site data removes them.

Portfolio check

When you check a wallet, your browser sends the wallet address directly to a public RPC endpoint for the chain to read token balances: PublicNode (Allnodes) first, and Robinhood’s own public RPC if that fails. That RPC operator receives the address and your IP address under its own terms. Elyvo’s servers do not receive the address, and nothing about the check is stored.

Messages you send us

If you email us, we keep your message and address to answer and, for correction requests, to document the change.

What we don’t collect

No accounts, names or payment details for visitors; no analytics or advertising scripts of our own; no fingerprinting. The site’s fonts are served from the site itself. Elyvo describes token contracts; it does not index or profile wallet holders.

• To provide the Service: delivering pages and API responses.
• To protect it: rate limiting (per IP address, or per API key), preventing abuse, and investigating incidents.
• To fix problems: request IDs let us trace an error you report.
• To keep a record: the audit log documents who changed curated data and why.

Our basis is our legitimate interest in operating a secure, reliable public information service, and, for messages, handling your request.

We use these service providers, who process data on our behalf:

• Cloudflare: DNS, TLS and hosting of the website and the API (Workers and the D1 database) at elyvo.trade, truvo.site and their APIs; it sees your IP address, which is used for rate limiting.
• PublicNode (Allnodes): the public RPC endpoint your browser calls for the portfolio check (see above). Only you send it the wallet address; Elyvo’s own servers use it to read token contracts, not visitors’ data.
• Hugging Face: hosting of a static copy of the site.
• TradingView: the embedded price chart on stock and ETF token passports, loaded by your browser from TradingView (an independent provider under its own terms).

These providers may process data in countries other than yours. We do not sell personal data or share it for advertising.

Request logs are kept only as long as needed for security and troubleshooting, then deleted or overwritten. API key records are kept until the key is revoked and the record is no longer needed. Audit log entries are kept permanently, because the integrity of the curation record depends on it.

Depending on where you live (for example under the EU/UK GDPR or Indonesia’s Personal Data Protection Law), you may have the right to access, correct or delete personal data about you, to object to or restrict its use, and to complain to a data protection authority. To make a request, contact truvowork@gmail.com. We may need to verify that a request is yours.

The Service is not directed at children and we do not knowingly collect their personal data.

We will update this policy when our practices change; the date at the top shows the latest version. Questions: truvowork@gmail.com.

See also the Terms of Use.