01Who we are
Best Crypto India ("BCI", "we", "us") provides an educational, rules-based trading-discipline tool and the 100-Day Trade Challenge. Best Crypto India is not a company. It is run by Gaurav Vyas as an individual, from Bengaluru, Karnataka, India, and "we" in this policy means him. For the purposes of India's Digital Personal Data Protection Act, 2023, Gaurav Vyas is the "data fiduciary" for the personal data described here. Read this policy with our Terms & Conditions.
02What we collect & why
| Data | Purpose | Kept for |
|---|---|---|
| Name, email address | Create and secure your account; contact you about your account | Life of the account |
| Telegram username | Deliver trade ideas to you on Telegram (the reason you gave it) | Life of the account |
| Password (salted one-way hash only) | Sign you in. We never see or store the plain password | Life of the account |
| Challenge data: trades posted to you, trade cards you generate, the outcomes you report | Run the Challenge and show your scorecard | Life of the account |
| Consent records: document versions, date/time, IP address, browser | Evidence that you accepted the Terms, Privacy Policy and risk acknowledgement (see section 4) | Account life + up to 3 years (legal claims) |
| Sign-in records: time and IP of logins, failed attempts | Detect account misuse, block brute-force attacks, show you your last login | Failed attempts 7 days; last login for the life of the account |
| Technical data: session cookie, server logs, error records | Operate, secure and debug the Service | Logs up to 90 days |
| Emails you send us: your address, name and message (corrections, support, partnerships, privacy requests) | Reply to you and keep a record of the request | Up to 2 years, or longer where needed for a legal claim |
We do not collect anything else from members. Public pages (prices, charts, articles) can be used without an account; for visitors without an account we only receive the technical data above (IP address, browser, pages requested) in our server logs, plus what the analytics and advertising services described in section 6 collect.
03What we never collect
- No exchange API keys or private keys. BCI is not connected to your exchange.
- No funds and no wallet access. We cannot move, view, or touch your money.
- We do not ask for government ID, card numbers, bank details, PAN or Aadhaar to use the Service.
- We do not sell or rent your data to anyone, and we never give your account details (name, email, Telegram) to advertisers.
04Consent records
When you tick the boxes at signup (and whenever we ask you to accept a new version) we store an append-only record of each acceptance: which document, its version, the date and time (UTC), the IP address and browser user-agent used, and where the tick happened. We keep this as evidence of the contract between us and to show you, on your dashboard, exactly what you agreed to and when. This record is not used for any other purpose.
05Legal basis
We process your data (a) with your consent, given by the separate tick-boxes at signup, for the purposes listed above; (b) to perform our agreement with you (running your account and the Challenge); and (c) for our legitimate interest in keeping the Service secure and defending legal claims. You may withdraw consent at any time by deleting your account (section 10); we then stop processing except where the law requires us to keep a record.
06Cookies & local storage
We use one strictly necessary session cookie (bci_sess: HttpOnly, SameSite, Secure on HTTPS) to keep you
logged in, and browser local storage for conveniences such as your watchlist and checklist ticks. These stay in
your browser and are never sent to us. Public pages load Google Analytics and Ahrefs Analytics, which set their own
cookies for aggregate traffic statistics; you can block them with your browser or an ad-blocker without affecting the
Service. We do not set advertising or cross-site tracking cookies of our own.
Advertising. Public pages show ads served by Google AdSense. Google and its partners use cookies and similar identifiers to serve ads based on your prior visits to this and other websites, to limit how often you see an ad and to measure performance. You can turn off personalised ads at Google Ad Settings (or opt out of other vendors at aboutads.info), and learn more in how Google uses data from partner sites. Visitors in the EEA, UK and Switzerland are asked for consent through Google's consent message before personalised ads are shown. Ads are not shown on member dashboard pages.
Content from other servers. To show coin logos and charts, pages load images from CoinGecko's image servers and chart code from the jsDelivr network. Like any website you visit, these services receive your IP address and browser details when your browser fetches those files; they do not receive your account details.
Partner links. Where a page carries a partner or affiliate link (always labelled; see our affiliate disclosure), the partner platform may set its own cookie when you click it, so it can credit us for the referral. What happens on that platform is governed by its own privacy policy.
Managing cookies. You can delete or block cookies in your browser settings. Blocking the session cookie means you cannot stay logged in; blocking analytics or advertising cookies does not affect the rest of the Service.
07Sharing & third parties
We do not sell or rent your personal data. We share limited data only with: our hosting and database provider (to run the Service, under confidentiality obligations); Telegram (your handle, so trade ideas can be delivered to you); the analytics providers named above (aggregate, pseudonymous usage data on public pages); and Google as our advertising partner (cookie and device identifiers, IP address and pages visited on public pages, as described in section 6). We may disclose data if required by law, court order or a lawful request from an authority, or to protect the rights, safety, or security of our users and the Service.
Where your data is processed. Our hosting provider and some of the services named above (such as Google, Ahrefs and Telegram) may store or process data on servers outside India. We use only established providers, and we transfer data abroad only as permitted under the Digital Personal Data Protection Act, 2023, and not to any country the Government of India restricts.
08Data retention
We keep your account, challenge and consent data for as long as your account is active. If you delete your account we delete or anonymise your personal data within 30 days, except consent and sign-in records that we may keep for up to 3 years to defend legal claims, and anything we must retain by law. Failed-login records are deleted after 7 days and server logs after 90 days.
09Security
We use reasonable technical and organisational measures to protect your data: bcrypt password hashing, HTTPS, hardened session cookies bound to your browser with idle and absolute timeouts, login rate-limiting, CSRF protection on every form, prepared database statements, and access limited to the people who operate the Service. No system is perfectly secure; please use a strong, unique password and keep it confidential. If we become aware of a breach that affects your personal data we will inform you and the relevant authority as the law requires.
10Your rights & how to use them
Subject to applicable law, you may: access a copy of your personal data; correct inaccurate data; erase your account and data; withdraw consent; and nominate someone to exercise these rights for you. To do any of these, email info@bestcryptoindia.com from your registered address with the subject "Privacy request"; we respond within 30 days. Your dashboard already shows your profile, sign-in activity and the agreements you accepted. If you are not satisfied with our response you may complain to the Data Protection Board of India once its complaint process is operational.
11Children
The Service is only for adults (18+). We do not knowingly collect data from anyone under 18, and signup requires you to confirm your age. If you believe a minor has provided us data, contact us and we will remove it.
12Changes
We may update this policy from time to time. Material changes get a new version number and date here, and members are asked to accept the new version on their dashboard before continuing to use member features.
13Contact & grievances
Privacy questions, requests or grievances: email info@bestcryptoindia.com (grievance contact for the purposes of the DPDP Act and the IT Rules). Please include your registered email address.
Grievance Officer: Gaurav Vyas, Bengaluru, Karnataka, India · info@bestcryptoindia.com. We acknowledge a grievance within 24 hours and resolve it within 15 days.
Version history: 2026-09-25: Google AdSense advertising cookies and opt-out links; emails you send us; content loaded from CoinGecko and jsDelivr; partner links; cookie controls; processing outside India. 2026-09-21: itemised data table, consent and sign-in records, retention periods, DPDP rights and grievance contact.