1. Controller
Cabal Hunter is a registered business name (no. 791866) of Paul Fitzgerald, a sole trader established in Ireland. Business address: 18 Willow Wood Close, Hartstown, Clonsilla, Dublin, D15 XF5Y. We are the data controller for the processing described here. Contact [email protected] for any privacy question, or to exercise the rights in section 8.
We have not appointed a Data Protection Officer; we are not required to.
2. The short version
No advertising, no tracking cookies, no data sold, ever. The only cookie we set is an owner/administrator login cookie that ordinary visitors never receive. Most analytics we keep are stored against a salted hash of your IP address rather than the address itself. The two places we keep a raw IP are free-tier metering and abuse prevention, because the free allowance is counted per address.
3. What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| IP address (raw) — free-scan and map usage counters | Metering the free allowance and preventing quota abuse; the free tier is counted per address | Legitimate interests; performance of a contract | 13 months |
| Hashed IP (SHA-256, salted, truncated) — page and API visits, country, referrer, path, response status and, for a request made with an API key, the plan type (free, paid or Pro — never the key itself) | Understanding usage, diagnosing faults, distinguishing served scans from rejected ones | Legitimate interests | 13 months |
| Browser or client identifier — the user-agent string your browser, bot or AI agent sends | Telling automated traffic, browsers and AI agents apart, so usage figures mean something | Legitimate interests | 13 months |
| Token mint addresses you scan | Producing and caching the result you asked for | Performance of a contract | 13 months |
| Addresses you ask a feature to keep — tokens you watch and where the alert goes, wallets on your avoid list, developers you follow in the Telegram bot | Running the feature you set up | Performance of a contract | Until you remove them, or ask us to delete your key |
| Wallets you look up — stored with a one-way hash of your API key (in the bot, the key linked to your chat) and the month | Counting your monthly wallet allowance; looking the same wallet up again that month is free | Performance of a contract | 13 months |
| Email address, if you request an API key | Delivering the key, service notices, billing | Performance of a contract | Until you ask us to delete it |
| Pro week orders paid in SOL — your email, the order's payment reference, and the paying wallet's address and transaction | Matching the payment to your key, refunds, our accounts | Performance of a contract; legal obligation (accounting records) | As long as accounting law requires (normally 6 years in Ireland) |
| Marketing consent flag | Only set if you opt in; defaults to off | Consent | Until withdrawn |
| Purchase records — transaction reference, amount, credits, timestamp | Issuing credits, support, accounting | Legal obligation (tax); contract | 6 years (Revenue) |
| Help-assistant questions — the text you type into the on-page assistant, with page, locale, country and hashed IP | Answering the question and improving the answers | Legitimate interests | 13 months |
| IP classification — IP address, country, network operator, and whether it belongs to a hosting provider | Telling automated traffic from people, which is what the free allowance and the abuse limits depend on | Legitimate interests | 13 months |
| Feedback you send us — your message and, if you give one, your email address | Reading it and replying | Legitimate interests | 24 months |
Owner/admin cookie (ch_owner) | Keeps the operator logged in to internal pages | Legitimate interests | 1 year |
Those periods are enforced by a job, not by good intentions. A nightly task deletes rows once they pass the retention period above. A published retention period with nothing behind it would be a claim rather than a policy.
We do not ask for, and do not want, your name, your postal address, your wallet's private keys or any special-category data. Do not send them to us.
4. Cookies
We set one cookie, ch_owner, and only for the operator of the site after authenticating at an internal URL. It is HttpOnly, Secure, SameSite=Lax and lasts one year. It carries no personal data beyond an authentication token.
There are no analytics cookies, no advertising cookies and no third-party trackers, which is why you are not being shown a cookie banner. If that ever changes, consent will be requested before anything is set.
5. Who else processes your data
We keep this list short on purpose. Each of these receives only what it needs:
| Processor | What it receives | Where |
|---|---|---|
| Amazon Web Services — hosting | Everything, at rest on the server | EU (Frankfurt) |
| Cloudflare — CDN, TLS and abuse protection | Request metadata including IP | Global edge; EU-first routing |
| Helius — Solana RPC | The mint and wallet addresses being analysed. Not your identity. | United States |
| Dexscreener — market data | The mint address being analysed | United States |
| Stripe — card payments | Payment and billing details. We never see or store your card number. | United States / EU |
| Anthropic — the on-page help assistant | The question text you type into the assistant | United States |
| ip-api.com — country lookup | Your IP address, to resolve a country code | United States |
Transfers outside the EEA rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by the provider.
On-chain payments are public by design. If you pay in USDC or SOL on Solana, that transaction — its amount, timing and the wallets involved — is permanently public on the blockchain. Neither we nor anyone else can delete or amend it.
6. What we do not do
- We do not sell, rent or trade personal data.
- Our analytics do not record who made a request: a visit carries a hashed IP and, at most, the plan type of the key used. Addresses are kept against your key or Telegram chat only where a feature you use needs them — watches, your avoid list, the wallet allowance and the bot's recent scans (sections 3 and 7). We do not build behavioural profiles of visitors.
- We do not use your data to train machine-learning models.
- We do not run advertising or share data with ad networks.
7. The Chrome extension and the Telegram bot
The Chrome extension
Added 3 October 2026. The Cabal Hunter extension for Chrome reads which Solana token you have open on a trading website and shows our findings about it in the browser's side panel.
- What it reads. On the supported trading sites, and on other sites only if you switch on "Work on every website", it reads the token address from the page address or from token links and contract-address text on the page. On cabal-hunter.com it reads your own API key, if you already use the site in that browser. On a wallet page (from version 0.4) it reads which wallet the page is about from the page address. On Axiom's Pulse page (from version 0.6, "feed labels", on when you have saved a key, switched off in the panel's settings) it reads the coin addresses of the rows on screen.
- What it sends to us. The token address, and your API key if you have one, to api.cabal-hunter.com. On a wallet page it sends that wallet's address, to show how many wallet lookups you have left and whether it is on your avoid list; the wallet's case file is read only when you press the button, and is then shown from cabal-hunter.com inside the panel, with your key handed to that page in the browser (never in a web address). For feed labels it sends the coin addresses of the Pulse rows on screen, in batches of up to 50, with your key; we answer with what our own record says about the wallet that launched each coin. We do not keep which coins a key asked about: to apply the daily limit we count them per key in memory only, which is gone at the end of the day or on a restart, and we store a daily total of label requests by plan type. It does not send the address of the page you are on, your browsing history, the rest of the page or anything that identifies you. Those requests are handled exactly like any other API request, as described in section 3.
- What it stores. Your API key and your settings, in Chrome's storage on your own device. Removing the extension deletes them.
- What it does not do. No tracking, no analytics, no advertising, and no data sold or shared with anyone.
The Telegram bot
Added 12 October 2026. @TheCabalHunter_Bot answers in the chat with the same findings as the site.
- What it keeps. Your Telegram chat ID; the last 50 tokens you scanned in it, for /recent and follow-up messages (older ones are deleted as new ones arrive); the API key you link with /key, and through it the email on that key; the watches, developers and avoid-list wallets you set up; the wallets you look up, for the monthly allowance; your bot settings; and a record of when you first started the bot.
- Replies to us. If you reply to a message we sent you, the reply is kept and passed to the operator so we can answer it. Replies are kept for 24 months, like other feedback.
- Telegram itself. Your messages travel through Telegram, which handles them under its own privacy policy. We do not control what Telegram keeps.
- Deleting it. Remove watches, followed developers and avoid-list wallets in the bot (/unwatch, /undevwatch, /unavoid), or email [email protected] and we will delete everything held against your chat.
8. Your rights
Under the GDPR you can ask us to: give you a copy of your data; correct it; erase it; restrict or object to how we use it; or send it to you in a portable format. Where processing relies on consent, you can withdraw consent at any time — withdrawing it does not affect what was lawful before.
Email [email protected]. We will respond within one month. There is no charge unless a request is manifestly excessive. We may need to verify that a request relates to data that is actually yours — for a key, that normally means sending the request from the email on the account.
Two practical limits, stated plainly rather than buried: we cannot erase records we are legally required to keep for tax purposes until that period expires, and we cannot alter the public blockchain.
If you are unhappy with how we have handled your data you can complain to the Irish Data Protection Commission (dataprotection.ie), or to the supervisory authority in your own EU country.
9. Security
The site is served over TLS. Administrative routes are authenticated, rate-limited and fail closed. Data is held on an encrypted volume in the EU with restricted access. No system is perfect: if you find a vulnerability, report it to [email protected] — see security.txt. We will not pursue researchers who act in good faith and give us a reasonable chance to fix the issue.
10. Children
The service is not intended for anyone under 18, and we do not knowingly collect data from children.
11. Changes
Material changes will be published here with a new effective date, and sent to paid customers by email.
9 November 2026: section 7 describes the extension's feed labels on Axiom's Pulse page (version 0.6): what is read, what is sent, and that we do not keep which coins were asked about.
12 October 2026, later: section 7 describes the extension's wallet case files (version 0.4).
12 October 2026: sections 3, 6 and 7 now describe what the watch, avoid-list, wallet-lookup and Telegram features keep against your key or chat, and that a keyed request records its plan type. These features already existed; this corrects what the policy said about them.