Privacy
Policy.

This policy explains what Bitomine does with personal data on bitomine.me: what we collect, why, who else receives it, how long we keep it and what you can ask us to do about it.

We are the controller of that data. If you want it changed or deleted, or you simply want to know what we hold, write to [email protected] from your account email address.

The honest summary is this: we collect very little, because a cloud-mining account needs very little. We do not sell it, we do not use it for advertising, and we do not build a profile of you.

What you give us

• Email address — your account identity, and the only way we can reach you.
• Password — stored only as a one-way hash. We cannot read it, recover it or tell it to you.
• Payout destinations — the wallet addresses you save, or the FaucetPay account email you withdraw to.
• Anything you write to support — by email or on Telegram, including whatever you choose to put in the message.

What the platform records as you use it

• Financial activity — deposits, plan purchases, accrued earnings, withdrawal requests and affiliate commission, with timestamps.
• Referral link — which account, if any, invited you, and which site you arrived from.
• IP address — recorded at registration and updated on login, together with the derived country.
• Security events — failed logins, payout and admin actions, kept in a short-lived event log so that an incident can be reconstructed.

What we deliberately do not collect

No real name, no date of birth, no postal address, no phone number, no identity documents, no card or bank details. Deposits and withdrawals move in cryptocurrency and are handled by the processors named in clause 5, so no card number ever reaches this site to be stored in the first place.

We use cookies. Three of them, none for advertising:

PHPSESSID — strictly necessary

Keeps you logged in. Deleted when you close the browser or log out. Without it there is no way to have an account at all.

i — functional, 14 days

Remembers which affiliate link brought you, so that whoever referred you is credited if you register later.

rsite — functional, 14 days

Remembers the site you arrived from, so we can see which channels bring real users.

The panel also stores small display preferences in your browser’s local storage — for example whether you collapsed the sidebar. These never leave your device and are not readable by us.

We do not run advertising networks, tracking pixels, session recording or cross-site analytics. Clearing your cookies logs you out and loses the referral credit; it does not harm your account or your balance.

Each item above exists for a stated reason, and is not used for others:

• To run your account — log you in, show your balances, credit accruals, process withdrawals to the destination you gave.
• To answer you — support cannot help with a payout without knowing which account it belongs to.
• To pay affiliates correctly — commission needs a recorded link between two accounts.
• To prevent fraud and abuse — the IP and event records are what let us spot multi-accounting, bonus farming and a login that suddenly does not look like you. This is also the basis on which an account can be closed under clause 11 of the Terms.
• To meet legal obligations — where a law that applies to us requires records to be kept or disclosed.

We send transactional email — account and payout matters. If we ever send anything promotional it will carry an unsubscribe link, and using it stops those without affecting the transactional ones.

We do not make decisions about you by automated means alone. Payouts above the automatic limit are reviewed by a person, not by a scoring model.

We do not sell, rent or trade personal data. It reaches other parties only where the service cannot work otherwise:

Payment processors

Paykassa and FaucetPay handle deposits and payouts. They receive the transaction data needed to move funds — amounts, currencies and the destination you provided. They are independent controllers of what they hold, under their own policies.

Hosting and network

Our server provider and our CDN process traffic to this site, which necessarily includes IP addresses, in order to deliver pages and absorb attacks.

Email delivery

Outgoing mail passes through an SMTP provider, which sees the address and the message.

Translation widget

The language switcher is served by GTranslate. Loading it means your browser contacts their servers, which sees your IP address and the page you are on. Fonts and icons load from Google Fonts and a public CDN in the same way.

We may also disclose data where a valid legal request obliges us to, or to establish or defend a legal claim.

Because these providers operate internationally, data may be processed outside your country. Where that happens we rely on the provider’s own safeguards for such transfers.

• Account data — while the account exists, and for a reasonable period afterwards so that a payout dispute can still be resolved.
• Financial records — deposits, plan purchases and withdrawals are kept as long as needed for accounting and anti-fraud purposes, and may outlive the account itself.
• The security event log — short-lived by design. Entries older than two days are discarded automatically.
• Support correspondence — kept while it is useful for context, then deleted.

Deleting an account does not erase a completed blockchain transaction. Those live on a public ledger that nobody, including us, can edit.

What is actually in place:

• The whole site is served over HTTPS; there is no unencrypted version.
• Passwords are stored as bcrypt hashes, never in readable form.
• Repeated failed logins are throttled per IP address, and the session identifier is regenerated on login to blunt session-fixation attacks.
• Every action that moves money is written as a parameterised database query and guarded against being replayed or run twice.
• Administrative actions require a valid one-time token, so a link cannot make a change on an administrator’s behalf.
• Access to the database and the server is limited to the people who operate the platform.

None of that is a guarantee. No system is perfect, and anyone who claims otherwise is selling something. Use a password you do not use anywhere else, and tell us at once if you think your account has been reached by someone else.

Depending on where you live you may have some or all of the following rights. We apply them to everyone regardless, because it is simpler and fairer than checking:

• Access — ask what we hold about you and get a copy.
• Correction — have inaccurate data fixed. Most of it you can edit yourself in your account settings.
• Deletion — ask us to erase your data. We will, except where a record must be kept for legal or anti-fraud reasons, and we will tell you which parts those are.
• Restriction and objection — ask us to stop a particular use while a dispute is resolved.
• Portability — receive your account data in a machine-readable form.
• Complaint — raise the matter with your local data protection authority. We would rather you came to us first, but that right is yours either way.

To use any of them, email [email protected] from your registered address and say what you want. We answer within 30 days, usually much sooner. Requests are free unless they are repetitive or clearly excessive. We may need to confirm it is really you before acting — an unverified deletion request is itself an attack.

Withdraw your balance before requesting deletion. Closing an account does not refund plans still running, and we cannot pay out to an account that no longer exists.

This platform is for adults. It is not directed at anyone under 18, and we do not knowingly hold data about a child. If you believe a minor has registered, tell us at [email protected] and we will close the account and delete the data.

If this policy changes, the updated version appears at this address and the date at the top changes with it. Material changes are announced on the News page. We will not quietly broaden what we collect and leave the old text standing — that is exactly what went wrong with the page this one replaces.

Questions, requests or complaints about privacy: [email protected], or Telegram @cryptoizsupport. Please use email for anything involving your data, so there is a record on both sides.